Legal

Privacy Policy

Last updated: June 11, 2026

1. Who we are

WCodes (“WCodes”, “we”, “us”) operates the WCodes mobile app and the website at wcodes.app (together, the “Service”) — a community list of free Roblox promo codes. The data controller is Christian Dreher; the postal address is published in the Legal Notice. For any privacy question, contact privacy@wcodes.app.

Because the controller is established in Germany, the EU General Data Protection Regulation (GDPR) applies to all processing under this policy, wherever you are located. Where you have additional rights under the law of your own country or state (US state privacy laws, PIPEDA, UK GDPR), those apply too — see §9.

2. What we collect

Browsing without an account — you can view and copy codes on the website and in the app without signing up. We don’t require an account and the website sets no advertising or tracking cookies.

If you create an account, we collect: your email address, a username, your birth year (for the 13+ age gate), and the activity that powers the product — codes you submit, your verify votes, XP, streaks, Trust, favourites and badges. Optionally: a short bio you choose, a device push token (if you enable notifications), and your timezone + quiet-hours settings (to time notifications). If you sign in with Apple or Google, we receive your email address (or Apple’s private relay address) from them — never your password.

Automatically: basic technical data such as IP address, device/OS type and app/version, and server logs, used for security, abuse-prevention and diagnostics. If analytics is enabled (see §7) we collect pseudonymous product-usage events.

We do not collect Roblox account credentials, precise location, or payment card numbers (purchases are handled by Apple/Google — see §5).

3. How we use it

To provide and secure the Service; to run the verify loop, XP, leaderboard, streaks and Trust; to send notifications you opt into; to enforce anti-cheat, rate limits and content moderation (automated filters plus human review of reports); to operate premium features (VaultPass); and to comply with legal obligations.

Advertising: the free version of the app shows ads served by Google AdMob. Ads are non-personalized only and the app is flagged for treatment as a teen-audience app — we never use your personal data to build advertising profiles, we do not request the iOS advertising identifier (IDFA), and we do not sell your personal information. To serve and fraud-check ads, Google receives technical data such as your IP address and device information under its own privacy policy. VaultPass subscribers and users with earned ad-free time see no ads. The website itself shows no ads.

4. Legal bases (GDPR)

We rely on: performance of a contract (Art. 6(1)(b) — providing your account and the Service); consent (Art. 6(1)(a) — push notifications and, where required, analytics; you can withdraw it any time); and our legitimate interests (Art. 6(1)(f) — keeping the Service secure, preventing abuse and fraud, serving non-personalized ads in the free app, and improving the Service), balanced against your rights.

5. Who we share it with

We use a small set of service providers (processors), bound by data-processing terms: Supabase (database, authentication, hosting), Vercel (website hosting), Expo (push-notification delivery), Resend (transactional emails such as sign-up confirmation and password reset), RevenueCat (subscription management — receives a pseudonymous user ID and purchase status, never your payment details), Google (AdMob ad serving in the app — non-personalized, see §3 — and automated safety checks on submitted text), and, if enabled, PostHog (product analytics). In-app purchases are processed by Apple and Google Play under their own privacy policies. We may disclose data if required by law or to protect the Service and its users. We never sell your personal information.

6. International data transfers

Our database is hosted in the United States (AWS us-east-1). If you access the Service from the EU/EEA, UK or Canada, your data is transferred to the US. For such transfers we rely on appropriate safeguards — the EU Standard Contractual Clauses and the UK Addendum with our processors, and, where the provider is certified, the EU–US Data Privacy Framework.

7. Cookies & analytics

The website currently sets no cookies and uses no advertising trackers. If we introduce product analytics or other non-essential technologies, visitors in the EU/EEA, UK and (where required) Québec will be asked for consent first via a cookie banner; you can decline or change your choice at any time.

8. Data retention

We keep account data while your account is active. If you delete your account (Settings → Delete account, or via wcodes.app/delete-account), we delete your personal data and associated activity, except where we must retain limited records to meet legal obligations or prevent abuse. Codes you submitted may remain in the community list in de-identified form. Server and security logs are kept for a short, limited period.

9. Your rights

Everyone (GDPR): because we are established in the EU, every user — wherever located — can request access, rectification, erasure, restriction, portability, object to processing based on legitimate interests, and withdraw consent at any time. You can also get a full copy of your data directly in the app (Settings → Download my data) and delete your account in the app or via wcodes.app/delete-account. You may lodge a complaint with a data-protection supervisory authority — in Germany, the authority of the federal state where the controller resides; in the EU/EEA, your local authority; in the UK, the ICO.

California (CCPA/CPRA) & other US states (VA, CO, CT, UT, TX and similar): the right to know, access, correct and delete your personal information, and to opt out of “sale” or “sharing”. We do not sell or share your personal information as those terms are defined (ads in the app are non-personalized and involve no cross-context behavioural advertising), and we do not use sensitive personal information for purposes requiring an opt-out. You won’t be discriminated against for exercising these rights.

Canada (PIPEDA) & Québec (Law 25): the right to access and correct your information and to withdraw consent. The person in charge of the protection of personal information is the operator named in §1, reachable at privacy@wcodes.app; a French-language version of this policy is available on request.

To exercise any right, email privacy@wcodes.app. We answer within the timeframes the applicable law requires (GDPR: one month; CCPA: 45 days).

10. Children

The Service is intended for users aged 13 and older; registration requires a birth year and under-13s are blocked from creating an account. We do not knowingly collect personal data from children under 13 (or under the higher digital-consent age set by your EU member state, where applicable). If you believe a child has provided us data, contact privacy@wcodes.app and we will delete it.

11. Security

We use encryption in transit, row-level access controls, and server-side enforcement of all scoring/anti-cheat logic. No method of transmission or storage is 100% secure, but we work to protect your data and will notify you and the relevant authorities of a breach where the law requires.

12. Changes

We may update this policy; material changes will be highlighted in the app or on this page with a new “last updated” date.

13. Contact

Privacy questions: privacy@wcodes.app — or by post at the address in the Legal Notice. WCodes is an independent project and is not affiliated with, endorsed by, or sponsored by Roblox Corporation.