SynodicAC privacy policy

Synodic Studio ("Synodic", "we", "us") runs SynodicAC and is the data controller for the personal data described in this policy. That means we decide why and how the data is processed and we are responsible for it.

Synodic Studio is a trade name, not yet a registered company. Until it is, the controllers are the studio's two founders, Nicklaz Lentz and Kian Nikolaj, acting jointly. As joint controllers we have agreed in writing how we share responsibility under Article 26 GDPR. Nicklaz Lentz is the point of contact for questions and requests about personal data, but you may exercise your rights against either of us.

The studio is based in Aarhus, Denmark. You can reach us about anything in this policy at contact@synodicstudio.com. We have not appointed a data protection officer, because the scale and nature of our processing does not require one under Article 37.

SynodicAC is our private, in-house, server-side anticheat. It runs only in Synodic Studio's own Roblox experiences and is not offered to other developers. This policy covers the data SynodicAC processes about players in those experiences, the records our staff keep when they moderate, and the public status page at ac.synodicstudio.com.

Roblox itself is run by Roblox Corporation, which is an independent controller for the data on its platform. Your Roblox account, chat and everything else Roblox does are covered by Roblox's own privacy policy, not this one. The same applies to Discord Inc. for data on Discord.

SynodicAC keeps as little as it can. There are two kinds of record.

Detections

When one of the checks in the game server is triggered, it records your Roblox user ID and username, which check fired (for example speed, teleport, fly or remote spam), how severe it was (low, medium or high), what action was taken (log, rubberband, kick or ban), a short technical detail of at most 300 characters (for example "moved 60 studs in 0.25s" or the name of a remote), and the IDs of the experience, place and server instance.

Moderation records

When a member of our staff kicks, bans or unbans a player using our Discord commands, we record the player's Roblox user ID, the experience, the action, the reason the staff member gave, the duration, and the Discord username of the staff member who took the action.

To run its checks, the game server measures things like your position, speed and how often your game calls the server. Those measurements stay in the game server's memory only while you are in that server. They are never sent anywhere or stored.

SynodicAC does not collect your display name, your avatar, your IP address, your chat, data about your device, your age, your location or any payment data.

We do not ask you for any of this data directly. Detections are created by the game server of the Roblox experience you are playing, from the information Roblox gives every game server about the players in it, and sent to SynodicAC. Moderation records are created by our staff when they take an action.

Every purpose below relies on our legitimate interests under Article 6(1)(f) GDPR.

Detecting and preventing cheating

Detections let us spot cheating, protect other players and keep our games fair and secure.

Enforcing the game rules

When a check is triggered, SynodicAC or our staff can move a player back, remove them from a server or ban them, as described in the next section.

Handling appeals and repeat offences

Moderation records let us review a decision when a player appeals, and recognise players who break the rules again.

Keeping the service secure

Server logs and the security measures described below protect SynodicAC and the status page from abuse and attacks.

We have weighed these interests against yours. Many Roblox players are children and teenagers, so we keep the data to a minimum: no chat, no IP address, no age, no location, no device data, movement measurements that never leave the game server, records deleted after 12 months, and access limited to our staff. A human reviews any action you contest. Fair games protect every player, including the youngest, and with these limits we consider that our interests and those of other players are not overridden by yours. You can object at any time, as described under your rights.

Some of SynodicAC's actions happen automatically, without a person deciding in the moment. This is how it works.

How the checks decide

Each check compares what your character does with what the game allows. Most violations add points to a strike count, and those points fade away over time, so a single glitch or a moment of lag does not add up to much. Teleport- and fly-style violations are flagged straight away.

Rubberband

The game moves your character back to an earlier position. You stay in the game and nothing else happens.

Kick

SynodicAC can automatically remove you from the server, for example after repeated remote-spam flags. You see the message "[SynodicAC] Unusual activity detected." and you can join again.

Ban

A ban stops you from joining the experience, including all its places, for a set time or permanently. Bans are applied through Roblox's own ban system and may also cover alternate accounts, as Roblox determines. You see the message "You were banned by SynodicAC." Automatic bans are only used where a check is configured to ban. That is currently switched off, and bans are normally issued by our staff.

You have the right to obtain human intervention, to express your point of view and to contest any of these actions. Open an appeal at support.synodicstudio.com and a member of our staff will review it. You can also write to contact@synodicstudio.com.

We do not sell data and we do not share it with advertisers. It goes only to these places.

• Our staff, through a private Discord channel only staff can see. SynodicAC posts a message there for detections (limited so the channel is not flooded) and for every moderation action. The message contains your Roblox username, user ID and a link to your Roblox profile, the experience, the severity, the action, the technical detail, the number of flags and the server IDs. Moderation messages also mention the staff member, the duration and the reason. Discord Inc. hosts these messages.
• Roblox Corporation, when a ban is applied. We send your Roblox user ID and the ban to Roblox's ban system so that Roblox can enforce it.
• Hetzner Online GmbH in Germany, our hosting provider, which runs the server where the SynodicAC database is stored.

We may also disclose data where the law requires it, for example in response to a valid request from a public authority.

The SynodicAC database is stored on a server rented from Hetzner in Germany, inside the EU.

Discord Inc. and Roblox Corporation are based in the USA, so the staff log messages and the bans we send to Roblox involve a transfer outside the EU. Those transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the safeguards, such as standard contractual clauses, that the provider offers.

Measurements in the game server

Kept only in memory while you are in that server. Never stored.

Detections

Deleted 12 months after they were recorded.

Moderation records

Kept while the restriction is in force, and deleted 12 months after it ends, either because it expires or because the player is unbanned. A permanent ban is kept for as long as it is active.

Log messages in the staff Discord channel

Deleted after 12 months.

Server logs

IP address, time, requested URL and user agent, kept for at most 30 days.

The status page at ac.synodicstudio.com sets no cookies, runs no analytics and stores nothing in your browser's local storage. It shows only overall numbers, such as detections and unique players in the last 24 hours, the number of enforcement actions and totals, together with the health of the service. It never shows user IDs or names.

The game icons on the page are loaded from Roblox's image servers (tr.rbxcdn.com). To fetch them, your browser contacts Roblox directly, so Roblox can see your IP address. Roblox's privacy policy applies to that request. Like any web server, ours keeps a log of each visit, as described under how long we keep it.

Under GDPR you have these rights. You can use them by opening a ticket at support.synodicstudio.com or by writing to contact@synodicstudio.com. We answer within one month. For complex or numerous requests we can extend that by up to two more months, and we will tell you if we do.

Access

Ask whether we hold data about you and get a copy of it.

Rectification

Have inaccurate data corrected.

Erasure

Have your data deleted where there is no longer a good reason to keep it. When Roblox notifies us of a Right to Erasure request made to Roblox, we delete every record we hold about that player automatically, both in our database and in the staff Discord log messages.

Restriction

Ask us to keep your data but stop using it in certain situations, for example while we check whether it is accurate.

Objection

Object at any time, on grounds relating to your situation, to processing based on our legitimate interests (Article 21). We will then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims.

Human review

Not to be subject to a decision based solely on automated processing that significantly affects you, and to ask for a person to review it, as described under automated decisions.

Data portability does not apply, because we rely on legitimate interests rather than consent or a contract.

We may need to confirm that you own the Roblox account before acting on a request, so that we do not hand data to someone else.

Many players on Roblox are children and teenagers. That is a big part of why SynodicAC collects so little: it does not ask for or record anyone's age, and it applies the same short list of data to every player. Players must follow Roblox's own age rules. If you are a parent or guardian, you can contact us at contact@synodicstudio.com to have your child's data deleted.

• Game servers must authenticate with an API key, and only our own experiences are allowed to send data.
• Requests are rate-limited, and all traffic uses HTTPS.
• The API is only reachable through a web server in front of it, not directly from the internet.
• Secrets are restricted to the people who need them, and staff access is limited by their roles in our Discord server.
• The server is in the EU.

If a breach affects personal data, we notify Datatilsynet within 72 hours where the law requires it, and we tell the affected players where the breach is likely to put them at high risk.

If you believe we have handled your data unlawfully, you have the right to complain to a supervisory authority. Ours is Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk. You may also complain to the authority in the EU country where you live or work. We would appreciate the chance to fix things first, but you do not have to contact us before going to an authority.

We will update this policy when SynodicAC or the law changes. The date at the top tells you when it was last revised. We announce material changes on www.synodicstudio.com and in our Discord server.

Questions and requests about your data: contact@synodicstudio.com. To appeal an action taken by SynodicAC, use support.synodicstudio.com.