Privacy Policy
The short version. This website sets no cookies, runs no analytics, and has no advertising or tracking on it. It asks for exactly one piece of personal data — an email address, and only if you pay for a key with cryptocurrency. Everything else on this page is us being specific about the handful of requests your browser makes and who sees them.
1. Who we are
Catalyst is a native Lua script editor and session manager for Roblox. This policy covers usecatalyst.dev and the Catalyst desktop application.
| Controller | Catalyst |
|---|---|
| Based in | New York, United States |
| Contact | support@usecatalyst.dev |
| Community | Catalyst Discord |
Write to support@usecatalyst.dev about anything on this page. It is the fastest route and it reaches a person.
2. What we collect, and why
Nothing on this list is optional flourish. If a row could be removed without breaking something, it would have been.
| What | Why | How long |
|---|---|---|
| Your IP address, seen by our hosting provider on every request | Serving the page, and rate-limiting the support chat so one visitor cannot exhaust it for everyone | Held by the rate limiter for a rolling window of minutes; not written to any database by us |
| Support chat messages you type into the chat bubble | Generating a reply. The last twelve turns are sent to our AI provider with each message | Stored in your own browser for the tab session and erased when you close it. We do not log the content |
| A support rating (helped / did not help, or bad / good / great) and the number of turns in that chat | Telling whether the assistant is any use | Written to our provider's log with no identifier attached to it |
| Your email address, only if you buy a key with cryptocurrency and tick the box on that form | Sending you the key and the receipt. That is its only use | Deleted once the key has been delivered |
| Your theme preference | Remembering light or dark mode between visits | Stored on your device only, until you clear your browser data. It is never sent to us |
We do not collect your name, your Roblox account, your location, your device fingerprint, or a browsing history. There is no analytics package, no advertising network, no social plug-in, no session recorder and no tracking pixel anywhere on this site.
3. Our lawful basis
- Legitimate interests — serving the site, keeping it up, and stopping abuse of the support chat. This is a narrow interest and it is balanced against you: the data involved is an IP address, used briefly, never profiled.
- Performance of a contract — issuing and delivering a key you have paid for, and honouring a refund.
- Consent — the email address on the cryptocurrency payment form. You give it by ticking the box; you can withdraw it at any time by writing to us, though we cannot deliver a key without it.
4. Who else sees your data
These are the only third parties involved, and each one is here because something on the site would not work without it.
| Service | What it receives | When |
|---|---|---|
| Cloudflare — hosting and the support API | Your IP address, browser user-agent, and the page you asked for | Every page view |
| Groq (United States) — the language model behind the support chat | The text of your chat messages. Not your IP, not an account, not a name | Only when you send a message in the chat bubble |
Our licence server at auth.usecatalyst.dev |
Your IP address, when the page checks whether downloads are live | On the download page, and when you press a download button |
| GitHub — where the installers and version files live | Your IP address and user-agent | When the page reads the current version number, and when you download a build |
| CoinGecko — exchange rates on the crypto payment screen | Your IP address | Only if you open the cryptocurrency payment option |
Web fonts are served from this domain rather than from a font CDN, so no font provider ever sees that you visited. We sell nothing to anyone, we run no advertising here, and we share personal data with no one beyond the list above except where the law obliges us to.
The free-key page is separate. Getting a free key means
completing an advertisement flow on a page hosted at
auth.usecatalyst.dev. That advertising is supplied by a third
party which sets its own storage and may build a profile on you. That is
outside this policy and outside our control; the notice on that page governs
it. If you would rather not be advertised at, the paid tiers have no ads.
5. Where your data is processed
We operate from the United States, and Groq and GitHub process data there too. Cloudflare serves the site from whichever data centre is nearest to you, so the page itself is usually served locally to you.
If you are in the UK or the EEA, using Catalyst means your data is handled in the United States, which does not have an equivalent data protection regime of its own. Where a transfer needs a legal mechanism we rely on the providers' Standard Contractual Clauses and, where the provider is certified, the EU–US and UK–US Data Privacy Framework. You keep the rights in section 7 either way.
6. How long we keep things
The retention column in section 2 is the whole answer. In practice this site stores almost nothing: there is no user database, no account system, and no mailing list. A chat transcript lives in your own browser tab and dies with it.
7. Your rights
Depending on where you live you have some or all of the following rights over your personal data: to access it, to have it corrected, to have it erased, to restrict or object to our using it, to take it elsewhere, and to withdraw consent you have given.
If you are in California, Colorado, Connecticut, Virginia or another US state with its own privacy law, you have the right to know what is collected about you, to have it deleted, and to opt out of its sale or sharing. We do not sell or share personal data, and we do not use it for targeted advertising or for any kind of profiling. Most of those state laws only bind businesses above a size or data-volume threshold that we are well below, but the rights above are honoured regardless of whether we are technically required to.
Exercise any of them by emailing support@usecatalyst.dev. We will answer within one month, free of charge. We may ask you for enough detail to find the data — usually the email address you paid with — because for most visitors we hold nothing that identifies you at all, and that is not us being obstructive.
If you think we have handled your data badly, tell us first. You also have the right to complain to the data protection authority where you live.
8. Age restriction
Catalyst is for adults. You must be 18 or older to download it, use it, or use this site. It is not directed at children, it is not marketed to them, and no part of it is designed to appeal to them.
We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us data, write to support@usecatalyst.dev and we will delete it and end the licence.
9. The desktop application
The app is licensed to a device rather than to an account, so when you activate a key it sends that key and a device identifier derived from your hardware to our licence server. That pairing is what stops one key being shared across a hundred machines. You can see both values in the app's Settings screen.
The scripts you write and save stay on your own machine. They are not uploaded, read, or backed up by us.
10. Security
The site is served over HTTPS only. API keys for the services above are held server-side and never reach your browser. No system is perfect, and we will tell affected users without undue delay if a breach ever puts their data at risk.
11. Changes to this policy
When this changes, the date at the top changes with it. If a change is significant — a new third party, a new category of data — we will say so in the Discord rather than quietly editing the page.
12. Contact
Email support@usecatalyst.dev. For anything that is not about your data, the Discord is faster.