Who runs this site

rileyyy.uk is built, hosted and run by Sowd (sowd.dev), a sole trader in the United Kingdom, for Riley. Sowd is the controller for any personal data handled here under UK GDPR. Contact: privacy@sowd.dev.

Under 13? Read this bit

A lot of people who visit are young. You can look at this site without telling it anything. If you are under 13 and want to use the /link page, ask a parent or carer to help you first. We only ask for what the link needs (below) and nothing else. Parents can email privacy@sowd.dev to see or delete their child’s data. We follow the UK Age Appropriate Design Code: no profiling, no ads aimed at you, no location, and the most private settings by default.

Just visiting

The site is a set of static pages served by Cloudflare (Cloudflare Pages). Like any web host, Cloudflare processes your IP address and basic request details (browser, page, time) to deliver the page and protect it from attacks. We don’t add any analytics and don’t receive a list of visitors. Legal basis: legitimate interests (running a secure website).

The follower and member numbers are fetched from Roblox, YouTube and Discord when the site is built, not from your browser, so those services don’t learn about your visit. The font is served from this site too, not from Google.

The /link page (Starlight bot)

When you press the button from the Starlight bot’s /verify command, you land on rileyyy.uk/link with a one-time code. The page talks to the bot’s own server at api.rileyyy.uk (run by Sowd, reached through Cloudflare). This is what happens:

• When you ran /verify, the bot saved your Discord user ID, display name and avatar picture link, and a short-lived Discord reply code, so the page can show “this is for you” and update your Discord message when you are done. The one-time code runs out after 10 minutes.
• You sign in on Roblox’s own page. We never see your Roblox password. We ask Roblox only for your basic profile (scopes “openid profile”) and get back your Roblox user ID, username and avatar picture link. We throw away the Roblox sign-in tokens straight away.
• The bot then saves your Discord user ID together with your Roblox user ID, Roblox username and the time you linked. Your private server listings in the bot follow this link. Your Roblox avatar picture is shown to you on the page but is not saved.
• The bot’s server logs only that a link was made. Its logs never contain your Discord ID, Roblox ID or username.

Why: so the Starlight bot knows which Roblox account is yours (for example, to show you as the host of your private servers). Legal basis: you asked for it, so it is needed to give you the bot’s linking feature (contract), and our legitimate interest in stopping people pretending to be someone else.

How long we keep it:

• Your Discord-to-Roblox link: deleted automatically 12 months after you last use the Starlight bot (any command, button or menu). To make this work, the bot notes the day you last used it, and that note is deleted at the same time. You can have the link deleted sooner by running /unverify, or by emailing privacy@sowd.dev with your Discord username. Running /verify again replaces it. Your server listings will then show as unlinked.
• Pending codes: the five-word code for the Roblox About check is deleted after 30 minutes, and the one-time website link code after 10 minutes.
• Screenshots shared with the bot’s /trade check that it can’t read, or that you correct with Fix (they can show Roblox usernames), are kept for up to 90 days so a person can check the reader, then deleted.
• Each /trade check saves a short record (the player names it read and a link to your screenshot) so the Fix button works. It is deleted after 7 days.
• Items you follow with /track: the bot saves your Discord user ID, which items, and the value it last told you about, so it can message you when a value changes. They are deleted when you run /track remove, or 12 months after you last use the bot. To decide how many you can track, the bot checks whether you boost rileyyyroblox’s Discord or have an Aurora Starlight role there; it doesn’t save that.
• Reports against a server listing are kept for 12 months from the report, for safety (so moderators can deal with repeat problems), then deleted.
• Logs: no personal identifiers (no Discord IDs, Roblox IDs or usernames), and size-capped, so older lines are overwritten.

While the page is open, your browser loads your Discord avatar from Discord and your Roblox avatar from Roblox, so those companies see a normal image request from you. The page also keeps the one-time code in your browser’s session storage until the tab is closed, so a cancelled sign-in can be retried.

Cookies and storage

This site sets no cookies. It stores only these, in your own browser:

Both are strictly necessary, so they don’t need consent. Cloudflare may set its own security cookie (such as __cf_bm) if it needs to check for bots; that is also strictly necessary. You can see the notice again with “cookie settings” at the bottom of any page.

Ads: there are none. If ads are ever added, they will only load after you press accept, they will be non-personalised, and this page will be updated first.

Links to other sites

The buttons to YouTube, Twitch, TikTok, Discord and Roblox are plain links, and so is the mod application form (a Google Form) when Riley shares it. Once you go there, that company’s own privacy policy applies, not this one. For the mod form that is Google’s privacy policy.

Who else is involved

Cloudflare (hosting, security and the tunnel to the bot’s server), Roblox (the sign-in) and Discord (the bot). Cloudflare is a US company, so some data can be processed in the US; that is covered by the UK–US data bridge and Cloudflare’s standard data protection terms. The bot’s data itself is stored on Sowd’s own server in the UK. We don’t sell data or share it with anyone else.

Your rights

You can ask to see, correct or delete your data, object to how it is used, or ask us to stop using it. Email privacy@sowd.dev and we will reply within a month. If you are not happy with the answer, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.