Privacy policy

Aurimals is operated by REAL LABS in England. In this policy, “we”, “us” and “our” mean REAL LABS. We are the data controller for the personal information we decide to collect and use through Aurimals.

Contact privacy@aurimals.com about this policy or your information. For other legal questions, use legal@aurimals.com. Roblox and Discord are separate services and are responsible for the information they process for their own purposes.

We collect information from you, from your use of Aurimals, and from Roblox or Discord when you use features connected to those platforms.

• Account information. Your Roblox user ID and username; your Discord user ID and the server context of a command or verification request. Roblox group memberships and assigned role names are read when we synchronize Discord roles.
• Game information. Progress, experience, balances, settings, achievements, missions, mail, items and Aurimal inventory. Inventory records can include original and current Roblox owner IDs, transaction identifiers and ownership history.
• Verification and transaction records. Temporary verification identifiers, expiry times, completed account links, queued changes and records that prevent the same reward or inventory operation from being applied twice.
• Technical information. Website requests can produce server logs containing your IP address, requested page, browser information, time and response status. Service logs can include account or request IDs and error information needed to investigate a problem.
• Messages you send us. Your email address, message and any evidence you choose to include in a support, privacy or legal request.

We do not ask for your Roblox or Discord password. Roblox sign-in supplies an account identifier and basic profile information; it does not give us your password. Roblox access tokens are used briefly to confirm your identity, then revocation is attempted. They are not retained in our account-link database.

Please do not send passwords, payment card details, identity documents or sensitive personal information unless we have explained why a particular item is necessary. We do not receive your full payment card details for purchases processed by Roblox.

Under the UK GDPR, we need a lawful basis for using personal information. The basis depends on what we are doing:

Providing the service you request — contract

We use account IDs and game data to save progress, manage inventory, deliver supported purchases and rewards, answer service requests, and provide account linking or role synchronization when you request those features.

Keeping Aurimals safe and reliable — legitimate interests

We use limited logs, ownership records and transaction history to prevent fraud, duplicate grants, misuse and data loss, investigate faults, and enforce fair community rules. These interests must be balanced against your rights and reasonable expectations.

Meeting a legal requirement — legal obligation

We may use or retain information when necessary to respond to a valid legal request, meet applicable record-keeping duties, or handle a statutory privacy request.

Optional uses that require permission — consent

If we introduce a feature that requires consent, we will explain the use and request that consent separately. You can withdraw it without affecting earlier lawful processing. Authorizing a Roblox connection does not give us permission to use your information for unrelated purposes.

We do not sell personal information, use it for targeted advertising, or use linked accounts to track you across unrelated services. The current website does not include advertising cookies or third-party analytics trackers.

1. You run /verify in Discord and receive a personal link to our website.
2. Roblox asks you to sign in and authorize basic identity access. You return to our website, then review and confirm the Roblox account in Discord.
3. We save the account link, synchronize supported Discord roles with the roles assigned to you in the Aurimals Roblox group, and queue your linked Discord ID for your game profile.

A link is one-to-one: one Roblox account can be actively linked to one Discord account. Changes to your game profile apply while you are online or when you next join, and may take time to save.

Your Discord server roles are visible to other people as allowed by Discord. A linked Discord ID is stored in your private game profile; it is not included in our public species catalog or sent to other players through that profile. Game features can separately show normal gameplay information, such as a username or an Aurimal’s recorded ownership.

The /profile command lets people look up a saved player profile by Roblox username or ID, or by a linked Discord mention. It displays the player name and Roblox username, selected owned namecard, public avatar, rank and progress, and supported display counts. It does not reveal balances, full inventories, mail, linked Discord IDs or security records. Our avatar image endpoint renders public Roblox avatar artwork; it does not return game data.

Role synchronization is automated: we match assigned Roblox group role names to the corresponding Discord role names. It does not make decisions with legal or similarly significant effects. If the result looks wrong, contact us so a person can review it.

The verification flow uses an essential cookie called aurimals_verify. It binds the return from Roblox to the browser that started verification, helps prevent account-linking attacks, and expires after ten minutes. It is marked Secure, HTTP-only and SameSite=Lax.

You can block or clear cookies in your browser. Ordinary catalog browsing will still work, but Roblox verification may fail if its essential cookie is blocked. We would request any consent required by law before introducing non-essential cookies.

Standard website access logs are rotated daily and normally retain fourteen rotations. OAuth and private game-data routes have access logging disabled to reduce exposure of authorization details; limited error or security logs may still be produced.

• Roblox. Hosts the game and its saved data, authenticates your Roblox account, supplies group role information, and processes platform purchases under its own policies.
• Discord. Hosts app interactions and server membership, and receives role changes and the responses to your commands under its own policies.
• Our hosting and communications providers. Oracle Cloud hosts our website and linking service in its London region. Providers handling our email or infrastructure may process limited information to operate those services.
• Authorized REAL LABS staff. Can access relevant information when needed for support, moderation, account security or authorized game operations. Private profiles and inventories are not part of the public website API.
• Legal or protective disclosures. We may disclose necessary information to meet a lawful requirement, establish or defend a legal claim, or protect people and the service. We do not treat this as permission for unrelated sharing.

Roblox, Discord and other providers may process information outside the UK. Where we are responsible for a restricted international transfer, we must use an applicable UK adequacy decision or another valid safeguard, such as approved contractual protections. You can ask privacy@aurimals.com for information about the safeguards relevant to your data.

The platforms’ own notices explain their independent processing: Roblox privacy policy and Discord privacy policy.

We use the following periods or criteria rather than promising that every record is deleted at the same time:

• Active links: kept while your accounts remain linked. Running /unverify removes the active link and queues removal of the linked Discord ID from your game profile.
• Verification attempts: stop working after ten minutes. Expired attempt records are cleared when new verification requests are created.
• Game saves: kept as needed to provide and restore your progress, deliver purchases and maintain reliable inventory ownership. Deleting a Discord link does not delete the Roblox game save.
• Transaction and security records: may remain after unlinking where needed to prevent replayed grants or copied inventory, investigate abuse, resolve a dispute or meet a legal obligation. Retention depends on the risk, the unresolved issue and whether the record is still needed.
• Support correspondence: kept while needed to handle your request and any related dispute or legal requirement. Routine website logs follow the rotation described above.

When information is no longer needed for these purposes, it should be deleted or anonymized. A deletion request is assessed against these criteria and any applicable legal exceptions; we will explain if a particular record needs to remain.

Depending on the circumstances, you can ask us to give you access to your information, correct inaccurate information, erase information, restrict how it is used, or provide portable information where the law requires it.

Your right to object: you can object to processing based on our legitimate interests. Explain your circumstances when contacting us, and we will assess the objection under the applicable law.

Email privacy@aurimals.com to make a request. Include your Roblox user ID or Discord user ID if it helps us locate the relevant records. We may ask for proportionate proof that the account belongs to you, so we do not disclose or delete someone else’s data. Do not send your password.

We will respond within the period required by applicable law, normally one month for a UK GDPR request. If a permitted extension or an exception applies, we will explain it. You do not have to pay merely to ask a routine privacy question or exercise your rights; any lawful exception to that rule will be explained.

You can also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, or another competent regulator where applicable. Contacting us first may help resolve the issue, but is not a condition of making a complaint.

Use /unverify to remove your active Roblox–Discord link and supported group roles. Permission or platform failures may delay the action; if it cannot complete, contact us. Your game-side link is cleared once the queued change is applied and saved.

You can also remove the app’s authorization through Roblox’s account settings. That prevents further access through the authorization, but does not itself delete a link or records we already hold. Likewise, removing the Discord app is not a data-deletion request.

For deletion of your game profile, support messages or other personal information, email privacy@aurimals.com. We will assess the request and tell you what can be deleted, what may need to be retained, and why. Account linking is optional, although features that depend on a verified account cannot work without it.

The Aurimals game follows Roblox’s applicable access and age settings. Discord and Roblox OAuth linking have their own age requirements: Roblox OAuth requires a 13+ account, and Discord requires at least age thirteen or a higher minimum where local law applies.

Do not use Discord or account linking if you do not meet those requirements. We do not ask you to provide a full date of birth or upload identification to this website for verification. Parents or guardians can contact privacy@aurimals.com about a child’s information, subject to appropriate checks and the child’s applicable rights.

We use HTTPS, restricted server access and authenticated private APIs. Game changes are checked by the game’s own inventory and ownership rules. Access credentials are held on the server and are not distributed in website assets or game clients.

No online service can promise absolute security. If you suspect an account-linking problem or unintended disclosure, contact privacy@aurimals.com promptly. We will assess the incident and provide any notices required by law.

We may update this policy when our features, providers or legal duties change. The date at the top shows the current version. We will provide appropriate notice of material changes and request any fresh consent required for a new purpose; publishing a change does not itself authorize unrelated use of your information.

Privacy requests and questions: privacy@aurimals.com. Legal questions: legal@aurimals.com. You can read the Terms of Service for the rules governing use of Aurimals.