This Privacy Policy explains what information scriptmaker.net collects, how we use it, who we share it with, how long we keep it, and what rights you have over your data. It applies to the website at scriptmaker.net, the bridge script distributed for Roblox executors, the Discord bot that issues signup links, the encrypted account store on the server, and the operator's admin panel (collectively, "the Service").
| Data | Why | How long |
|---|---|---|
| Username | Account login only | Until account deletion |
| Password (hashed with bcrypt) | Account login — we never store the plaintext | Until account deletion |
| Plan (basic / premium / admin), account status (active / hold / disabled) | Service operation, limits, admin support | Until account deletion |
| Created-at, last login, last dump timestamps | Service operation, cooldown enforcement, abuse detection | Until account deletion |
| Terms of Service and Privacy Policy acceptance (version + timestamp) | Proving consent to the version you accepted | Until account deletion |
No billing information is collected. We do not store card numbers, billing addresses, invoices, or payment-processor identifiers. The only billing-related field in your account is which plan you are on. Any payment for a plan is handled outside this Service, between you and the operator directly.
Because your plan includes a DeepSeek token quota, we keep a server-side record of your usage. This is written by our server from DeepSeek's response; the bridge never sees or supplies these numbers.
| Data | Why | How long |
|---|---|---|
| Current token window start and tokens used in the current window | Enforcing your quota, showing the progress bar on the dashboard | Rolled over each window; lifetime total kept until account deletion |
| Lifetime tokens used | Dashboard display, admin support, fraud detection | Until account deletion |
| Per-chunk prompt and completion token counts, and cache-hit/miss counts | Billing reconciliation with DeepSeek, capacity planning, abuse detection | Until account deletion |
An Ease Code is a credential that lets the bridge act on your account. We store a bcrypt hash of each Ease Code and metadata — created-at, last-used-at, revoked-at. We do not store the plaintext Ease Code, and the bridge does not write it to disk.
| Data | Why | How long |
|---|---|---|
| Decompiled game client scripts and instance attributes you submit | Sent to the AI provider to produce a Vulnerability Dump; stored in your session history so you can re-read the result | Until account deletion or you clear the session |
| Session metadata (session ID, timestamps, phase, chunk counts, deferred-script list, any errors) | Service operation, progress display, abuse detection | Until account deletion |
| The Vulnerability Dump output (the findings text) | Displayed to you in the browser and bridge; stored in session history | Until account deletion |
| Game context you submit (game name, PlaceId, creator type, gravity) | Context for AI analysis | Until account deletion |
Our web server and hosting provider may log standard technical information when you access the website, including IP address, browser user-agent, and request timestamps. These logs are used for security, abuse detection, and debugging, and are typically retained for a short period consistent with the hosting provider's default log retention. API endpoints (push, pull, analyze, ease_login, ease_sessions) may also be logged by the hosting provider as standard HTTP access records.
The bridge script that runs in your Roblox executor sends the decompiled scripts and attributes you select to our server. It does not send your Roblox password or your Roblox session. The bridge stores decompiled scripts locally in your executor's scriptmaker folder for caching purposes — you can clear this at any time via the bridge's "Clear cache" button.
The bridge does not store your account password. The Ease Code you paste into the bridge is held in memory during the session only and is not written to disk by the bridge. The bridge does write a small config file (scriptmaker_bridge.json) that records only whether you accepted the Terms of Service, so it does not re-prompt you on every launch.
When you obtain an account through our Discord bot, the bot issues a single-use signup token to your Discord account and the website uses that token to create your account. The bot keeps a mapping between the signup token it issued and the Discord user ID it issued it for; the website keeps a mapping between the same token and the internal account ID of the account that was created. This linkage exists so we can verify account ownership — for example, when you request account deletion or support — and so the bot can notify you when your account is ready.
The bot does not store your username or password. Those live only in the encrypted account database. The linkage is removed when your account is deleted.
We do not send you marketing email, billing notices, or account-update notifications. We do not use your username for any purpose other than verifying your identity at sign-in and identifying your account to the operator for support.
| Third party | What they receive | Why |
|---|---|---|
| DeepSeek | Decompiled scripts, attributes, game metadata, prompts, generated output | AI analysis |
| Discord | Discord user ID and username of the account the bot issued a signup link to | Sending the signup link and confirming account creation via DM |
| Hosting provider | Standard server access logs, encrypted account store on disk | Hosting the website and storing your account data |
We do not sell your personal information to any third party. We do not share your username or password hash with any third party.
An operator with access to the admin panel can view your username, plan, account status, token usage (window and lifetime), per-user session counts and script counts, ease-code status (active/revoked, not the plaintext), last login, and creation date. The admin panel can place your account on hold, disable it, delete it, reset your cooldown, reset your token window, and revoke your ease codes. These actions are recorded only insofar as the encrypted store is written; we do not currently keep a separate immutable audit log of admin actions, and we make no representation that we do.
The Service uses a single session cookie (PHPSESSID) to keep you logged in. This is a "strictly necessary" cookie — it exists only to maintain your authenticated session and is not used for advertising or tracking. It expires when you close your browser or log out.
We do not use advertising cookies, third-party analytics, or tracking pixels.
We retain your account data, token usage, sessions, and generated content until you delete your account or request deletion. If you delete your account through the dashboard or by contacting us, your account record, sessions, token usage, ease codes, and the bot's Discord linkage for that account are permanently deleted from our storage.
Server access logs may be retained by our hosting provider per their default retention schedule, which is outside our direct control. DeepSeek retains submitted data per their own retention policy, which is outside our direct control.
Depending on where you live, you may have the following rights:
To exercise any of these, contact us at scriptmakersp@gmail.com or via our Discord (link at the top of this page). We will respond within 30 days. Note that deleting your account is permanent and cannot be undone.
If you are in the EU/EEA, you have the right to lodge a complaint with your local data protection authority. If you are a California resident, you have rights under the CCPA, including the right to know, delete, and opt out of sale (we do not sell personal information).
The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us with evidence and we will look into it, which could lead to a deletion.
We use industry-standard practices to protect your data, including bcrypt password hashing, bcrypt hashing of ease codes, HTTPS for all traffic, and AES-256-CBC encryption at rest for the account store. However, no system is perfectly secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately.
Our servers are located in the United States. DeepSeek's servers may be located outside your country. By using the Service, you consent to the transfer of your data to these locations.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Material changes will be communicated by email or by a notice on the website. Continued use of the Service after changes are posted constitutes acceptance.
Privacy questions and data-deletion requests: scriptmakersp@gmail.com. For the quickest response, use the Discord link at the top of this page.
General support: scriptmakersp@gmail.com or the Discord above.