🔒 Privacy & Security

AssetFlow is designed to respect your privacy and keep your data secure. The application processes everything locally on your machine.

Data Storage

What We Store Locally

What We DON’T Store

• We never send your cookies or API keys to any external server
• We never share your asset data
• We never transmit your Roblox credentials over the network (except directly to Roblox’s official APIs)

Network Communication

AssetFlow makes network requests to:

• Roblox API endpoints (for scanning, ownership checking, and uploading)
• Discord API (for OAuth2 login and Rich Presence)
• AssetFlow authentication backend — for verifying your Discord role and subscription tier
• Whop (when upgrading your subscription via the upgrade button)
• GitHub (for checking update availability)
• PostHog (optional analytics for improving the application)

Your sensitive credentials (cookies and API keys) are stored locally in encrypted format and never transmitted to any server except Roblox’s official APIs.

Cookie Security

Your .ROBLOSECURITY cookie:

• Is stored in Electron’s safe storage (encrypted at rest)
• Is only sent to Roblox’s official API endpoints
• Is never sent to any other server
• Can be removed at any time from the Accounts page

Never share your .ROBLOSECURITY cookie. It gives full access to your Roblox account. AssetFlow only uses it locally for authentication.

API Key Security

Your Open Cloud API key:

• Is stored in Electron’s safe storage (encrypted at rest)
• Is only used to authenticate requests to Roblox’s Open Cloud APIs
• Is never logged, cached, or transmitted elsewhere

Discord Integration

Discord is required to use AssetFlow.

• Your Discord User ID, username, and avatar URL are stored locally and sent to the AssetFlow authentication server
• Your Discord role is fetched from the AssetFlow backend every 20 seconds to determine your subscription tier
• The app uses Discord OAuth2 via an authentication backend at 212.227.182.165:8002
• No Discord messages are read or sent by AssetFlow

Authentication Flow

1. The app opens a Discord OAuth2 authorization page
2. After authorization, a callback is sent to the AssetFlow backend
3. The backend returns your Discord profile and role
4. Your profile is stored locally for session persistence
5. Your role is periodically polled to detect subscription changes

Updates

AssetFlow checks for updates by querying the GitHub releases page. This check:

• Sends your current app version
• Does not send any personal information
• Can be disabled if you prefer to update manually

Resetting Your Data

To clear all locally stored data:

1. Go to Settings
2. Click Reset Mappings to clear asset ID mappings
3. Click Clear History to remove reupload session logs
4. Remove individual accounts from the Accounts page

For a full factory reset, uninstall AssetFlow and delete the %appdata%/AssetFlow folder.