Privacy Policy

Effective October 16, 2026

Sodapop is an independent AI creation service for Roblox. This policy explains how we handle information when you use our website and Studio plugin. The service operator is Mosaic Platforms, operating Sodapop. Privacy and support contact: mosaicplaformsllc@gmail.com.

Mailing address: 1201 South High Street, Suite C PMB 1015, Columbus, OH 43206, United States. This is a mailing address, not a walk-in support location.

Information we process

• Account information: Roblox user ID and username obtained through Roblox sign-in, account sessions, and your credit balance and transaction history. Authentication happens on Roblox; we do not receive your Roblox password.
• Your requests and results: prompts, revisions, generated models and scripts, saved versions, generation status, token usage, and error information.
• Studio content: object names, hierarchy, properties, geometry and rig information you share, and script source read with your permission. Reviewed errors you share or paste may contain object names, usernames, or other project information. A code proposal may retain the source used for its generation and review.
• Connection information: Studio pairing/session identifiers, plugin version, place information, permission settings, and asset-upload status. Temporary OAuth tokens enable the permissions you authorize.
• Payments: Stripe customer and transaction references, subscription status, credit grants, and refund or dispute information. Stripe collects payment details in its checkout; Sodapop does not store full card numbers or security codes.
• Technical and support information: requests to our servers may include an IP address and browser details. We process operational/security logs and information you send when contacting support.
• Service activity: we record signed-in account events such as sign-in, trial-credit grants, generation submissions and outcomes, Studio import confirmations, checkout starts and confirmed purchases. This first-party activity record contains event types, account/job identifiers and timestamps, not prompt or script content, IP addresses, card details or authentication tokens. It is not an advertising tracker.

How we use information

We use this information to sign you in, maintain saved work, generate and revise content, connect Studio, deliver changes you approve, process payments and credits, troubleshoot problems, prevent abuse, and meet legal obligations. We do not sell personal information or use Roblox user data to train AI models. Your work is not automatically published in our public showcase.

We also use service activity to understand where creators stop during signup, generation, Studio import or purchase, and to improve that workflow. We retain these activity events for about 90 days and remove older events during routine cleanup; credit, trial eligibility, saved-work and billing records are separate and may be retained longer as described below.

Community publishing

Community publishing is optional. Submitting a creation for review shares its selected generated files and script source, public title and description, Roblox username, attribution and optional demo link with moderators. Approval makes those materials public and downloadable. Your original prompt, shared Studio context, diagnostics and billing data are not included automatically. Check the generated files themselves for private information before submitting. Reports and moderation notes are stored for review; reporter identities are not displayed publicly. Withdrawing a listing stops new access through the library but cannot remove copies others already obtained. Discord is a separate third-party community service; joining it is optional and its own policies apply.

AI processing and service providers

When you request AI generation or repair, we send the prompt and relevant selected context, which can include shared script source and reviewed errors, to OpenAI. A generation may include a bounded automatic syntax-repair request. Do not include passwords, API keys, private player records, or information you lack permission to share. Our requests use OpenAI's store: false setting to disable normal response storage. Background generation temporarily stores response data for roughly ten minutes to support processing and status checks, including collecting a result after a connection drops. This is not a promise of zero retention. OpenAI may retain data for safety, legal, and operational purposes under its applicable policies. See OpenAI's API data controls.

DigitalOcean hosts our application and stored work. Roblox handles authorization and receives assets when you request an upload; the Studio plugin receives approved proposals. Stripe processes payments and receives account/payment references needed to reconcile them. These providers process information under their applicable terms and privacy policies. Information may be processed in the United States and other countries where providers operate.

We may disclose information when required by law or reasonably needed to protect users, investigate abuse, or secure the service. Authorized operators may access relevant records to provide support and maintain the service.

Roblox permissions and your controls

Sign-in requests openid and profile. Asset uploading separately requests asset:read and asset:write for the account you authorize. Studio script-reading permission is controlled separately through the plugin. You can turn off script reads, disconnect the plugin, sign out, or revoke Sodapop's access in Roblox's account settings. These actions stop the corresponding access but do not by themselves delete saved work or cancel a subscription.

Cookies and browser storage

We use first-party cookies for sign-in and authorization security. Browser storage remembers your selected version and temporarily carries a draft from the homepage to the workspace. Blocking these features can prevent sign-in or disrupt the workflow. The application does not currently include advertising trackers. Roblox and Stripe apply their own cookie policies on their services.

Retention and deletion

Saved prompts, generated files, proposal context, and credit records remain stored so you can reopen work and use the service; they are not automatically removed when you start a new request. New website sign-in sessions last up to 30 days in the same browser unless you sign out or the session is revoked. Clearing or blocking cookies can require you to sign in again sooner. Upload authorization held by the running service is separate and short-lived. Expired session records may remain until cleanup, and account, operational, and billing records may be retained where needed for security, legal obligations, or dispute resolution.

Contact us to request access, correction, export, or deletion of your information. Include your Roblox username and the request, but never your password or authentication tokens. We may verify ownership before acting. We will handle requests within applicable legal deadlines and explain any required retention. Copies in backups may persist until those backups are rotated. Removing Sodapop data does not automatically remove assets already uploaded to Roblox or files saved in your Studio place.

Age and privacy rights

Sodapop is not intended for children under 13. Users must also meet the minimum age required in their location; minors need a parent or guardian's permission. Contact us if you believe a child has provided information improperly. Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, or obtain a copy of personal information, and to complain to your local privacy regulator. Contact us to exercise applicable rights.

Security and changes

We use HTTPS, account access checks, and restricted server access. No service can guarantee perfect security. This policy may change as the service develops; the effective date will change, and we will provide additional notice of material changes when required.