Privacy Policy

1. Scope

This Privacy Policy applies to the AntiLua website, dashboard, browser authentication, Discord verification flow, and developer API available through obf.antilua.xyz (together, the “Service”).

The AntiLua script hub and loader use different request, key, and device information and are covered by the separate Script Hub Privacy Policy.

It does not control the privacy practices of Discord, Cloudflare, hosting providers, processing workers, Roblox, or other third-party services.

2. Information we process

Service and network information

• IP address, used for security, abuse prevention, request-rate limits, and request routing. Workspace 24-hour credits and cooldowns are tracked by Discord account, not by shared IP address.
• Token identifiers, token type, creation date, credit usage, limits, reset times, cooldown timestamps, and active status.
• Managed access tokens are linked to the Discord account that first registers them from the dashboard. We store the owner's Discord user ID and registration time. One managed token can be linked to each account. The account's authenticated browser session is required to use it, including when your IP address changes.
• Basic request and server error information needed to operate and troubleshoot the Service. The current front-end does not include an advertising or behavioral analytics tracker.

Discord information

If you choose or are required to verify through Discord, the Service receives and stores your Discord user ID, username, global display name and avatar when available, email address when authorised through Discord, and verification time. The OAuth access token received during the callback is used to request your Discord profile and is not written to the application database by the current server code.

API information

If you create an API key, the Service stores the key record, its associated Discord user and web-token identifiers, usage credits, limits, reset and cooldown timestamps, creation time, and active status.

Submitted Luau code

Source code submitted for obfuscation and the generated output are processed to fulfill your request. Code may be held temporarily in memory, compressed while waiting in the in-memory queue, and transmitted to one or more configured AntiLua processing workers together with the requesting IP address.

Browser storage

The browser stores your selected theme, protection-option preferences, and a display name for each Discord account locally. Clearing browser storage removes the saved display name; it does not change your Discord profile. Older versions may have stored an access token locally; the current flow uses an HttpOnly browser session for Discord login and removes legacy token values. Tokens entered for registration are sent to the server and are not saved in browser storage.

3. Cookies and sessions

AntiLua uses cookies that are necessary for authentication and OAuth security:

• antilua_web_session authenticates browser requests. It is configured as HttpOnly and SameSite=Lax, uses Secure in production or HTTPS environments, and may remain for up to 30 days.
• antilua_oauth_binding protects the Discord OAuth flow against request substitution. It uses the same cookie protections and expires after approximately 10 minutes.

These cookies are not advertising cookies. You may clear the browser session from the login page or through browser controls, but disabling required cookies may prevent authenticated features from working.

4. How we use information

Information is processed to:

• Authenticate browser sessions through Discord and connect managed workspace access tokens to their owners. API keys remain associated with the Discord account and have separate usage limits.
• Run obfuscation requests and return protected output.
• Create and manage API access requested by Discord-verified users.
• Track credits, enforce cooldowns and limits, distribute worker capacity, and prevent duplicate or abusive use.
• Protect the Service, investigate failures, maintain availability, and comply with valid legal obligations.

5. How information is shared

AntiLua does not need to disclose personal information publicly to provide the Service. Information may be processed by or disclosed to:

• Configured processing workers, which receive submitted code, selected protection options, and the requesting IP address to perform obfuscation.
• Discord, when you start OAuth verification, and from which AntiLua receives the profile fields described above.
• Cloudflare Turnstile, when the abuse-prevention challenge is used.
• Infrastructure providers, such as hosting and database services, that process information as necessary to operate AntiLua.
• Authorities or affected parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or secure the Service.

The current application does not implement a feature that sells personal information or submitted source code.

6. Retention

Submitted code and output are intended to remain only for the duration of in-memory queuing and processing in the current web application. A worker may necessarily hold code in memory while performing the requested job.

Session cookies expire according to the periods described above. Regular browser-session records expire after 30 days of inactivity. Started workspace usage windows are scheduled for automatic deletion 35 days after their 24-hour reset. Unstarted window records remain available for account usage tracking. Managed-token, Discord API ownership, and API-key records are retained while needed to provide access, enforce limits, prevent abuse, and protect the Service.

Records may be kept longer when required for security investigations, dispute resolution, or legal compliance, or deleted earlier when no longer needed.

7. Security

AntiLua uses measures including HttpOnly and SameSite session cookies, Secure cookies in production or HTTPS environments, signed tokens, OAuth request binding, access keys between the web service and workers, request limits, and restricted credential comparisons.

No internet service can guarantee absolute security. Keep your access token and API key private, remove secrets from submitted code, and notify the official support channel if you believe a credential or session has been compromised.

8. Your choices and rights

Depending on your location, you may have rights to request access to, correction of, or deletion of personal information, to object to or restrict certain processing, or to receive a portable copy. Some information may need to be retained where required by law or necessary to protect the Service and other users.

You can clear the active browser session on the login page, remove site cookies and local preferences through your browser, and avoid Discord-linked or API features by not initiating those flows. Requests concerning server-side records can be made through the official AntiLua support channel announced at obf.antilua.xyz.

9. International processing

Hosting, database, Discord, Cloudflare, and processing-worker infrastructure may operate in countries other than your own. As a result, information may be processed across regional or national borders, subject to the protections available through the relevant provider and applicable law.

10. Younger users

The Service is intended for users who are permitted to use developer tools and agree to these terms under the laws and platform rules that apply to them. AntiLua does not intentionally request a child’s real name, address, payment details, or other sensitive profile information. A parent or guardian who believes a child submitted personal information may contact the official support channel to request review.

11. Changes to this Policy

This Policy may be updated when the Service, providers, or legal requirements change. The “Last updated” date will identify the latest published version. Material changes should be reflected before new collection or use begins where reasonably possible.

12. Contact

Questions, privacy requests, or concerns can be raised through the official AntiLua support channel announced through obf.antilua.xyz. To help locate a record, include the relevant Discord ID or token identifier when safe to do so—never send your full access token or API key in a support message.