Privacy Policy

At KlesLwR, your privacy is a priority. This document explains what we collect and how we use it across our website, license services, and the KlesLwR desktop app — including combat macros, visual macro editor, Macro Assistant, Roblox tools, and the built-in music player.

1. Information We Collect

When you use our site and Software, we may collect the following data:

• Discord account data: When you sign in with Discord, we receive your Discord User ID, username, and avatar from Discord. The desktop app stores a KlesLwR session token locally so you stay signed in and we can verify your license. We do not store Discord OAuth access tokens on your PC.
• License & device data: License keys, edition choice (Free or Premium), subscription status, and a non-identifiable hardware identifier (HWID) to bind licenses to your devices and prevent unauthorized sharing.
• Payment information: Processed by Stripe. We do not store or have access to your full credit card details.
• Optional music listening data: If Share listening activity is enabled, we receive anonymous song metadata (YouTube video ID, title, artist, thumbnail URL, and a one-way hashed device identifier for hourly deduplication). Your Discord ID, license key, and Roblox data are never included.
• Macro Assistant feedback (optional): When you send feedback or when the assistant records an interaction outcome, we may store truncated chat text, edit summaries, macro ID, app version, and provider name locally and upload it to our API to improve the assistant. We do not upload your full macro files unless you include that text yourself in feedback.

Roblox session cookies are not collected by our servers. They stay on your PC inside the desktop app — see Section 5. YouTube / Google OAuth tokens are also stored locally on your device — see Section 8.

2. How We Use Your Information

The information we collect is used strictly for:

• Signing you in and verifying your Free or Premium access.
• Linking licenses, Discord accounts, and desktop installations.
• Displaying your identity in the dashboard and admin tools for support.
• Preventing abuse, fraud, and unauthorized license sharing.
• Improving stability, performance, and Macro Assistant quality.
• Aggregating anonymous music play events into Popular on KlesLwR charts (only when Share listening activity is enabled).

3. Data Storage and Security

Website account and license data is stored securely using Cloudflare's global infrastructure (D1 Database). We implement industry-standard security measures to protect your information from unauthorized access.

Roblox credentials, music playlists, macro configs, OAuth tokens, and most app settings remain on your computer. See Sections 5, 7, and 8 for details.

4. Third-Party Services

Our services integrate with third-party providers including:

• Discord: Authentication, Rich Presence (optional), and community support.
• Stripe: Secure payment processing for Premium plans.
• Google / YouTube: Optional account connection for playlist import, streaming, captions/lyrics, and search. See Section 8.
• Roblox: The desktop app connects directly to official *.roblox.com endpoints. KlesLwR does not proxy or store your Roblox cookies on our servers.
• AI providers (Macro Assistant): Premium users may use KlesLwR-hosted AI or bring their own API key (e.g. Groq, OpenAI, Gemini). Prompts are sent only when you use the assistant and only to the provider you chose.

Each of these services has its own privacy policy which you should review separately.

5. Roblox Account Data (Fully Local)

KlesLwR includes Roblox account management, alt swapping, custom launching, and server browser joins. To do this, the desktop app works with Roblox player sessions on your machine.

• No password collection: KlesLwR will never ask for your Roblox password.
• Why session cookies are used: Roblox OAuth is limited to Open Cloud creator APIs and cannot launch the game client or authenticate player sessions. The app uses .ROBLOSECURITY session cookies locally for auth tickets, fast-join, and multi-instance sync.
• Local extraction only: Cookies are read from your Roblox app, supported browsers, or manual import. KlesLwR does not read browser passwords, history, or autofill — only the .ROBLOSECURITY value for roblox.com.
• Encrypted at rest: Every cookie is encrypted immediately with the Windows Data Protection API (DPAPI, CurrentUser scope) and saved locally in roblox_accounts.json. The file is bound to your Windows user profile and is unreadable on other machines.
• Never shared: Roblox session cookies are never uploaded, logged, or transmitted to KlesLwR servers or any third party. Decrypted values exist in memory only while the app is using them.
• Direct Roblox connections: When validating accounts or requesting launch tickets, the app talks directly to official Roblox HTTPS endpoints — not through KlesLwR as a credential proxy.

6. Cookies

KlesLwR uses two different kinds of cookies. They are not the same and are stored in different places:

• Website session cookies — Stored in your browser on kleslwr.com and api.kleslwr.com. Used only to keep you signed in to the dashboard and related web services.
• Roblox .ROBLOSECURITY cookies — Stored only on your PC, inside the desktop app, encrypted with DPAPI. Used exclusively for local Roblox features. These are never stored on our servers.

7. Music Player & Optional Listening Activity

KlesLwR includes a built-in music player with YouTube streaming, local files, synced lyrics, playlists, overlays, and optional Discord now-playing status.

• Share listening activity is a toggle in Music settings. It is on by default and can be turned off at any time.
• When enabled, the app sends anonymous song metadata to power Popular on KlesLwR charts: YouTube video ID, title, artist, thumbnail URL, and a one-way hashed device identifier (hourly deduplication only).
• When disabled, no listening data is sent to KlesLwR.
• Local files are never reported. Only streamed YouTube tracks with valid video IDs may be counted.
• This data is not sold and is not linked to your Roblox accounts, Discord ID, or license key.

8. YouTube & Google Account Connection (Optional)

This feature is opt-in and only runs when you click Connect YouTube in the music player. KlesLwR requests a single read-only scope: https://www.googleapis.com/auth/youtube.readonly.

Limited Use compliance: KlesLwR's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data we access from Google: When you connect YouTube, the desktop app may receive and store locally on your PC:

• Google OAuth access and refresh tokens
• YouTube channel ID, display name, and avatar URL
• Playlist metadata (playlist ID and title)
• Video metadata from your playlists and liked videos (video ID, title, and thumbnail URL)

We do not access Gmail, Google Drive, Google Calendar, contacts, or any other Google services through OAuth.

How we use Google user data: Solely to let you import, browse, and play your YouTube playlists and liked videos inside the KlesLwR music player on your device. We do not use Google user data for targeted advertising, credit/lending decisions, or any purpose unrelated to this user-facing feature.

Data transfer and sharing: Google OAuth tokens and imported YouTube library data are not uploaded to KlesLwR servers, sold, rented, or transferred to data brokers, advertisers, or other third parties. After you connect, the desktop app sends API requests directly from your PC to Google. The only exception is standard HTTPS transport required to reach Google's APIs.

Data protection: Google OAuth tokens and synced YouTube library data are stored locally in your app configuration on your Windows PC. They remain on your device and are not stored in KlesLwR's Cloudflare database.

Data retention and deletion: Google tokens and synced library data remain on your device until you use Disconnect YouTube in the music player, clear the app's local data, or uninstall KlesLwR. Disconnecting removes stored Google tokens from your device. You can also revoke KlesLwR's access at any time from your Google Account permissions page.

AI and machine learning: Google OAuth data and imported YouTube library contents are not used to develop, improve, or train general AI/ML models, and are not transferred to third-party AI services for model training. Macro Assistant AI features operate separately and do not receive your Google OAuth tokens or synced YouTube library data.

• Disconnect anytime: Use Disconnect in the music player to clear stored tokens on your device.
• Direct API calls: After you connect, the desktop app talks directly to Google/YouTube APIs using your token. KlesLwR servers are not a middleman for your library data.

9. Macro Assistant & Discord Rich Presence

• Macro Assistant: AI chat inside the visual macro editor. Messages you send may be processed by KlesLwR's API or a third-party AI provider depending on your settings. Interaction outcomes may be logged locally and uploaded as described in Section 1.
• Discord Rich Presence (optional): If enabled in Settings, Discord may show that you are using KlesLwR, your current Roblox game, or now-playing music. You can turn each toggle off independently.

10. Your Rights

You have the right to request a summary of the data we have stored for your account or request its deletion by contacting us through our Discord support channel. You can disable music listening sharing, Discord Rich Presence, and connected YouTube accounts at any time in the desktop app.

11. Changes to This Policy

We may update our Privacy Policy from time to time. We will notify users of any changes by updating the "Last Updated" date at the top of this page.