Privacy Policy

1. Scope and privacy contact

EXOL is the service name used on exol.win and in the Windows application; it is not, by itself, the legal identity of a company. The person or entity that determines the purposes and means of processing is the data controller under applicable data-protection law. This notice does not assert that EXOL is incorporated in the EU or that merely targeting EU users removes controller obligations.

Send privacy requests through Support in your profile, using a subject such as Privacy request. If you cannot access your account, use the project contacts or official Discord community to ask for a private contact route. Do not post account details, documents, or payment data publicly. The controller's legal identity, address, and any required representative details are not stated on this page and remain information that must be provided by the operator.

2. Data processed by the website and account service

Depending on the features you use, the service processes the following categories:

• Account data: email, username, account identifier, role, creation and update dates, and a password hash. Passwords are hashed rather than stored as readable account passwords.
• Authentication data: session identifiers, access and refresh credentials, their expiry and revocation records, and short-lived desktop sign-in codes. Refresh-token secrets and desktop hand-off codes are stored in hashed form on the server.
• Orders and access: selected product and plan, amount, currency, payment provider and reference, invoice and transaction status, provider callback data, cryptocurrency payment information where relevant, subscriptions, expiry dates, and activation-key redemption records.
• Device data where device binding is used: the supplied hardware identifier, optional device label, associated account or subscription, and last-seen or reset timestamps.
• Support data: ticket subject, category, messages, attached images, author identifiers, status, and dates. Information you include in a support message becomes part of that conversation.
• Technical and security data: network addresses necessary to deliver requests, request paths, times, response or error information, request identifiers, and administrative audit records. The crash endpoint can use the requesting IP address for abuse controls. Infrastructure providers may also process connection metadata.
• If you participate as an authorised reseller: contact and account information, key batches and activations, agreed commercial terms, balances, settlements, and audit history.

3. Desktop files, diagnostics, and external integrations

The application stores settings, open tabs, script contents, and other workspace state locally. Desktop authentication uses the operating system credential store. Local storage does not mean that all application activity stays on your device: authentication, access checks, downloads, updates, and selected integrations make network requests.

Application components can submit diagnostic reports containing error messages, stack or source context, function and line information, application or Roblox versions, lifecycle stage, severity, Roblox place identifier, and additional diagnostic metadata. Such reports are not promised to be anonymous; paths or text can contain information about your environment. Reports are used to investigate crashes and compatibility problems.

While the EXOL module is active in a game, it sends an account-linked online status and the service records the receipt time. Authorised administrators can see currently active accounts and aggregate concurrency charts. Presence does not include script contents, game chat or Roblox account identifiers. Inactive presence records become eligible for cleanup after one day and aggregate counts after seven days; cleanup runs while the service worker is enabled.

If you use the AI assistant, your messages, conversation context, the active editor tab and its code, selected context, and tool results used by the assistant may be sent to the configured AI gateway, currently ClaudeHub at api.claudehub.fun, and the model services it uses. Website-reading tools also request the pages they access. Do not use the assistant for confidential code, passwords, or personal data you are not entitled to disclose. Closing the assistant does not itself delete a provider's existing records.

When you connect GitHub or use external script libraries such as ScriptBlox or RobloxScripts, the relevant provider receives the requests and any credentials or data necessary for the feature. GitHub tokens and workspace preferences may be stored locally by the client. Optional MCP connections and scripts can contact the services you configure or the script author specifies. Discord Rich Presence, when enabled, shares the application's activity status with the local Discord client. A custom font selected in the desktop app may be fetched from Google Fonts.

These integrations are distinct from the website's own account storage. An external service's privacy terms apply to its processing. Review the selected feature and provider before use; use of EXOL does not give every integration permission to process unrelated information.

4. Discord sign-in and account linking

If you choose Discord authentication or account linking, EXOL requests the identify scope and receives your Discord user identifier, username, and avatar information. The linked account record can contain OAuth access and refresh tokens and their expiry. The service may use your Discord identifier and subscription state to check or synchronise an eligible community role through its bot.

You can unlink Discord in your profile. Unlinking removes the website's link and stored OAuth account credentials; Discord can retain data under its own policies, and website unlinking does not by itself erase Discord messages or every historic record. You can also review the app's authorisation in your Discord account.

• Discord Privacy Policy ↗

5. Purposes and legal bases

Where the GDPR applies, processing necessary to create and authenticate your account, fulfil a digital purchase, maintain access, and answer related support requests is based on performing the contract or taking requested steps before a contract (Article 6(1)(b)). Required transaction or accounting records and responses to binding legal requests are processed to comply with applicable legal obligations (Article 6(1)(c)).

Proportionate fraud prevention, access security, incident diagnosis, and establishing or defending claims may rely on legitimate interests (Article 6(1)(f)), subject to balancing your rights. Where an optional integration or device-storage operation requires consent, that consent must be obtained for the particular processing and may be withdrawn without making earlier lawful processing unlawful (Article 6(1)(a)). This policy alone is not that consent.

Account and purchase information is needed for the corresponding function; without it we cannot create the account or supply the purchased access. Optional integrations are not required merely to read the public website. The current website does not integrate advertising trackers or third-party behavioural analytics, and no sale of personal data or use for targeted advertising is described or authorised by this policy.

6. Cookies and local storage

The current website uses the following first-party storage. These lifetimes describe the browser items, not a blanket retention period for all account records:

• token: sign-in cookie, normally up to 7 days. refresh_token: session renewal cookie, normally up to 30 days; credentials may be rotated or revoked earlier.
• discord_oauth_state: short-lived security cookie for Discord authorisation, up to 10 minutes and cleared when the flow completes or is reset.
• exol-locale: your explicit English or Russian choice, up to 1 year. Without a choice, the website uses English.
• exol-theme: your theme choice, up to 1 year in a cookie and also in browser local storage. Local storage remains until cleared or replaced.
• Desktop workspace, editor, integration, and preference storage is separate from browser cookies. The interactive website demo keeps its example workspace in page state; selecting Open or Save uses the local file action you choose.

7. Recipients and payment providers

Account and support information is accessible to authorised administrators or support staff for their work. Hosting, database, storage, and network providers process data needed to run the service. Payment providers, Discord, and optional desktop integrations receive the data needed for the features described above; authorities or professional advisers may receive information where a legal obligation or claim requires it.

Payment forms are handled by the selected provider, currently Platega (platega.io). EXOL sends invoice information and receives payment or transaction notifications. The current EXOL checkout does not include a form for collecting full card details or CVV. A provider may independently request additional payer information under its own rules; do not send such information in a support ticket.

A reseller receives the information you give that reseller for your external purchase. Website staff can associate a redeemed key with the relevant access and commercial records. Do not assume an external seller, AI provider, or community platform is acting only as an EXOL processor; its role and obligations depend on the actual relationship.

• Platega ↗
• GitHub Privacy Statement ↗

8. Processing locations and international transfers

An EU audience does not mean that every server, payment provider, or integration operates in the EU or EEA. The processing locations depend on the actual hosting arrangements and the external feature you choose. This page does not claim EU-only storage or certify a particular provider's transfer safeguards.

Where EXOL makes a transfer subject to the GDPR, the required transfer conditions must be established, for example an applicable adequacy decision or appropriate safeguards with any necessary supplementary measures. Merely using an overseas provider is not a substitute for those conditions. Ask the privacy contact for the actual recipients, countries, and safeguards relevant to your data.

• EDPB information on international data transfers ↗

9. Retention and security

Retention depends on the purpose: operating an active account and access, handling unresolved support requests, reconciling payments, preventing fraud, and meeting applicable recordkeeping or legal-claim requirements. An expired subscription does not automatically delete its account, purchase history, or support correspondence. No single fixed deletion period for all records is represented here.

Expired session records are eligible for routine cleanup; local preferences and files remain on your device until removed or replaced. Transaction, reseller, and administrative audit history can need separate retention and does not necessarily disappear with an account change. You may request erasure or information about the applicable retention criteria; legal obligations and valid claims can require limited continued retention.

The implementation uses password hashing, hashed server-side refresh credentials, access checks, and session revocation. Diagnostic server logging is designed to exclude passwords, cookies, tokens, and SQL parameters. These measures do not make every submitted message or crash report free of personal data, and no system can promise absolute security. Keep credentials out of scripts, AI prompts, and support messages.

10. Your choices and data-protection rights

Where the GDPR applies, you can request access, correction, erasure, restriction, or portability where the legal conditions apply; object to processing based on legitimate interests; and withdraw consent for consent-based processing. You can complain to a competent supervisory authority. These rights are not all unconditional, and a refusal or restriction must have a lawful explanation.

Use the privacy contact above. We may need proportionate information to verify that a request concerns your account; do not send an identity document unsolicited. The usual GDPR response period is one month, with an extension only under the conditions allowed by law. A request is not dependent on keeping a paid subscription.

You can change profile information, sign out, unlink Discord, clear local preferences, or stop using an optional integration. Account or data-deletion requests are handled through support; there is no claim that a self-service account-erasure button currently exists. No solely automated decision producing legal or similarly significant effects, or related profiling, is described as part of the current service.

• Find an EU/EEA data-protection authority ↗

11. Minors and updates to this notice

If local law requires a parent or guardian's involvement for a minor's account, purchase, or consent-based processing, that requirement applies. Contact the privacy route if you believe a child's data has been processed without the permission required by law. Do not submit sensitive information about a child in a public community channel.

This notice may be updated when the product or its processing changes. An updated notice does not itself create consent or a lawful basis for a new use of your data. The stated update date identifies this version. The Terms of Service separately describe digital access, payments, and consumer remedies.