Privacy Policy

What we collect

• Your account. An internal account number, a hashed copy of your account ID, its last 8 characters, when you made your account, your subscription time, and when you accepted our terms. We don’t store your full ID, but it passes through our server and Cloudflare when you sign in or the app checks your license.
• Discord, if you link it. Your Discord user ID, username, and profile picture link. Linking doesn’t let us see your messages or servers, and we don’t keep your Discord login.
• Your device. A hashed device ID, made from a number Android gives your phone. It keeps your subscription on one device and limits free use.
• How you use Kawaii. How many times you’ve opened it, overall and per day, when you first and last opened it, when it last checked in, and how long it was open on some days. Our staff can see this for each account.
• Your IP address. We don’t store unhashed IP addresses. Cloudflare, which our traffic passes through, may be able to see your IP address.
• Server logs. Our servers record the time, what you visit, and your browser, app version, or phone model and Android version. They can show when the app is running.
• Hashed IP addresses. We keep hashed copies of your IP to limit free use and block floods of traffic.
• Keys and orders. Which subscription keys you redeemed and when. If you’re a reseller, also your linked Discord, shop details, orders, and payment references. If your shop is listed, its name, link, description, and image are public.
• Staff records. Logs of staff actions, which can name your account and any changes to your subscription.

What we don’t collect

• Your Roblox password or login.
• Your card or wallet details. SellAuth or your reseller handles customer payments.
• Your scripts. We don’t store the scripts you run.
• Your AI chats. They go from your device to the AI service you choose, not to us.

Who else sees data

We don’t sell your data. We only share it with the services that help run Kawaii, or if the law requires it or we need to stop fraud or abuse.

• Cloudflare and our server host. Website and app traffic passes through them.
• SellAuth and resellers. They handle purchases under their own policies. A reseller can see when a key they sold was redeemed, but not who redeemed it.
• Discord. It’s involved if you link your account or sign in with it, and your Discord picture loads from Discord. If you join our Discord server, our bot can see activity there and records your Discord ID for verification and moderation.

Some features in the app connect directly to other services:

• The Scripts tab loads lists from ScriptBlox, RobloxScripts, HaxHell, and Rscripts when you open it, and sends your search to each source you’ve selected. Pictures and scripts may load from other sites those sources link to.
• The decompile function, whether you use it or a script does, sends the script’s compiled code to decompiler.lol.
• AI tools send your messages to the AI service you choose, along with your Roblox username and user ID, your current game and server, and any scripts, files, console output, or screenshots the AI reads. Your sign-in or API key is saved on your device and only sent to that service.
• Scripts you run can connect to the internet, and we don’t control what they do. Kawaii adds a device fingerprint to their web requests, and scripts can read your hashed device ID, so sites they contact could recognize your device.

Cookies

We use up to three cookies. One keeps you signed in for up to 30 days. One lasts 10 minutes while you sign in with Discord. If you use the reseller or admin dashboard, one remembers the sidebar for 7 days. Your browser also saves some settings on your device, like your theme and recent docs pages. We don’t use advertising or tracking cookies.

How long we keep it

• Account details and total opens: until you delete your account. We don’t delete inactive accounts automatically.
• Your daily open counts: 90 days, or until you delete your account.
• Server logs: about 14 days.
• Daily-use records: forever, even after a device reset or account deletion. On up to 6 days a month, for free and paid accounts, these record your account, hashed device ID, hashed IP addresses, when that day’s window started and ended, and how long the app was open. They stop free use being claimed twice. If you delete your account, your account is replaced with a deleted-user label and how long the app was open is removed.
• Redeemed keys, reseller orders, and staff logs: forever. If you delete your account, they stay, marked with a deleted-user label instead of your account.
• Backups: can hold copies of deleted data for longer.

Your choices

• On your account page, you can unlink Discord, replace your account ID, reset your device once every 12 hours, and delete your account. Deleting needs your full account ID, can’t be undone, and isn’t available for 24 hours after you replace your ID. A device reset doesn’t erase daily-use records.
• To get a copy of your data, message us on Discord. We’ll ask you to prove the account is yours.
• Depending on where you live, such as the EU, UK, or California, you may have more rights, including complaining to your country’s privacy office.

Keeping it safe

We hash account IDs and sign-in tokens before storing them. No system is perfectly secure, so keep your ID file private.

Changes and questions

If we change this policy, we’ll update this page and the date at the top. Questions? Ask us on Discord.