Who we are

WEPPY provides tools that connect AI agents to Roblox Studio, including the MCP server, Studio plugin, Dashboard, Explorer, installation guides, and paid license services. This policy covers those services and the account preview where it is available.

The operator is WEPPY (위피), based in the Republic of Korea.

For privacy questions or requests, contact [email protected]. This mailbox is our privacy contact point.

Information we process

Website visits

Our website uses Google Analytics 4 to measure visits and interactions, such as pages viewed, installation steps, and checkout link clicks. Analytics can include browser and device information, referrer and campaign information, pseudonymous browser and session identifiers, and an approximate location derived by Google. We do not intentionally send your name, email address, full license key, or authentication tokens as analytics event data.

Cloudflare provides website hosting, network delivery, and security. It processes technical request information, including IP addresses, to deliver and protect the service. Infrastructure processing is separate from the information stored in our account and analytics records.

Toolkit usage

When toolkit telemetry is enabled, usage information is sent to Google Analytics and WEPPY’s installation reporting service. This includes feature and command categories, success or error categories, timing, AI client name, operating system, language and time zone, product version, license tier, and a random installation identifier. A public IP address may be sent to Google to derive an approximate location. WEPPY receives a derived installation key for installation reporting and stores a further protected identifier.

An installation identifier distinguishes repeated use of an installation. It is not your Roblox account name or email address, but pseudonymous identifiers can still be personal information. We do not treat hashing as a guarantee of anonymity.

Product telemetry excludes AI prompts, chat text, script source, file names and paths, Roblox object paths and project contents, terminal output, playtest logs, screenshots, media files, full license keys, and credentials. The AI client name supplied by your client is included; avoid putting personal information into a custom client name.

If you choose Google sign-in, Google shares a provider account identifier and basic profile information permitted by the sign-in scopes, which may include your name, email address, email verification status, and profile image. We process this information to verify the sign-in and associate it with a WEPPY account. A name or profile image may be stored when supplied by the authentication provider.

The current authentication service replaces the email field in its account database with a pseudonymous internal alias. Your Google email address is not automatically saved as a contact email. We keep provider identity associations, account and project identifiers, session records, and security audit records. Google access, refresh, and ID tokens are used during authentication and are not retained in the account database.

Google sign-in does not request access to your Gmail inbox, Google Drive files, contacts, or calendar. Our own Google Workspace mailbox is used separately for support and transactional emails; it does not grant us access to your mailbox.

Account sign-in and purchase linking are currently available in the account preview. A Google sign-in does not automatically establish ownership of a purchase made using the same email address.

Purchases, license access, and purchase linking

Payments are handled by Polar or Gumroad. The checkout provider receives the payment and billing details you submit, including information it needs for payment, tax, and fraud checks. WEPPY does not store your full payment card details.

WEPPY processes order, checkout, subscription, product, and receipt identifiers; payment and refund status; amounts, currency, and country; license identifiers and state; and device activity needed to verify access and address misuse. Purchase email addresses are represented by protected identifiers in our operational records. A purchase email may be retrieved from the checkout provider when needed to verify a support request or send a purchase verification email.

Where purchase linking is enabled, we record the account and purchase association, a protected email identifier, and verification attempt and delivery status. Verification links are short-lived and can be used once. We send them to the verified purchase email through our company mailbox. We do not send your Google sign-in information to a payment provider simply because you sign in.

License credentials are processed to verify access. Depending on the license service, persistent records use hashes or encrypted credentials; account pages display only permitted, masked license information.

Support messages

If you email us, we receive your email address, message, attachments, and any purchase or diagnostic information you provide. Support email is handled through Google Workspace. Public GitHub issues are visible to others: use email for account or purchase questions, and do not post passwords, API keys, payment card details, or full license keys in a public issue.

Why we use this information

We use the information described above to:

Deliver the website and toolkit and maintain the preferences you choose.
Authenticate accounts, maintain sessions, and prevent unauthorized access.
Verify paid access, check subscription and refund status, and link purchases when you request it.
Send requested verification emails and respond to support and privacy requests.
Understand product usage and diagnose feature reliability through usage metadata.
Protect the service against misuse and meet applicable recordkeeping obligations.

We do not sell Google sign-in information or use it for personalized advertising. Access to account and purchase information is limited to authorized service operations and support. Our handling of Google data follows the Google API Services User Data Policy, including its Limited Use requirements where applicable.

Cookies, storage, and your choices

The website stores your language preference in a cookie and browser storage. Google Analytics uses its own browser identifiers and cookies where available. Account preview pages use necessary session cookies and temporary sign-in state. Account and policy pages do not load our website analytics script.

You can manage cookies and site storage in your browser, use browser tracking protections, or use Google’s Analytics opt-out browser add-on. Blocking essential session storage or cookies may prevent sign-in. We do not currently provide a website cookie preference banner; browser controls are the available website controls.

You can disable MCP toolkit telemetry using the server’s telemetry setting or by setting ENABLE_TELEMETRY=false (or 0) before starting the server. Restart the server after changing its environment configuration. Disabling telemetry stops toolkit analytics and installation observations; license checks required for paid access are separate.

You can stop using account sign-in and revoke WEPPY’s access in your Google account connections. Revoking Google access does not itself erase WEPPY records or cancel a subscription. Contact us for a data deletion request.

We use the following providers for specific purposes:

Cloudflare: website delivery, application hosting, database storage, and security. See Cloudflare’s privacy policy.
Google: optional sign-in, website and toolkit analytics, and our company email. See Google’s privacy policy.
Polar and Gumroad: checkout, payment, customer portal, tax, subscription, and purchase verification services. See Polar’s privacy policy and Gumroad’s privacy policy.
GitHub: public software, documentation links, and issue reports. See GitHub’s privacy statement.

Our staff may use internal reporting tools to review aggregated product and commerce reports. We may also disclose information when required by law or when necessary to handle a verified security incident or legal claim. We do not provide your project content or Google sign-in data to advertising partners.

AI agents, model providers, Roblox, and optional asset services that you choose have their own data practices. To perform a requested task, your chosen agent or tool may read or send project content, prompts, or media. This processing is different from WEPPY product telemetry. Review the permissions and policies of those services before sharing sensitive project information.

International processing

WEPPY operates from the Republic of Korea. Our providers operate internationally and may process or store information outside your country. The destination and processing location depend on the provider and service you use. Contact us for information about a particular processing arrangement and the disclosures and safeguards that apply to it.

Retention and deletion

We keep account and purchase associations while needed to provide access, handle support, verify transactions, protect the service, and meet applicable legal obligations. We assess requests to delete data against those purposes. Records required for a legal obligation or an unresolved dispute may need to be retained separately with access restricted.

The license service has a 90-day retention policy for license event history. Device activity can be removed after inactivity, subject to security and access requirements. These cleanup policies do not mean that every account, installation observation, commerce, or support record is automatically deleted after 90 days. Some operational records currently have no automatic deletion schedule. Provider-managed records follow the provider’s own retention rules.

When information can be deleted, we remove it from the relevant active records or make it irreversibly unavailable. Deletion from backups and provider-managed systems may take additional time or require a separate request to that provider. We do not promise that signing out or uninstalling immediately deletes every stored record.

The current service does not apply a single, fixed automatic deletion period to account, installation reporting, support, or backup records. Contact us about the records associated with your account or purchase and the deletion options available. Publishing this policy does not introduce a new automatic deletion feature.

Security

We use access restrictions, protected session cookies, authentication checks, and hashing or encryption for the records described above. Sensitive tokens and verification values are kept out of normal application logs and analytics. No network or storage system can guarantee absolute security. Keep your license credentials and provider API keys private, and contact support if you suspect unauthorized use.

Your requests and children’s information

You may contact us to request access, correction, deletion, or restriction of your personal information, or to withdraw consent where processing relies on consent. The rights available depend on applicable law and the processing involved. We may need proportionate evidence of your identity or purchase ownership before acting. Send the request to [email protected]; do not send a password or full payment card number.

WEPPY is a development tool. Creating Roblox experiences does not mean that WEPPY collects information directly from the players of those experiences. If you use WEPPY to collect player data, you are responsible for that separate collection. If a child uses our service and parental consent is required by applicable law, a parent or guardian must be involved. A parent or guardian may contact us about a child’s information. Age eligibility and parental-consent arrangements must be confirmed before the public account rollout.

Changes and contact

We will update the date at the top when this policy changes. Material changes will be explained through the website or another suitable notice before they apply where required.

For questions about this policy or the Terms of Service, email [email protected].