Privacy Policy

1UP is a marketplace where people back Roblox games and studios raise funding against milestones. We are the data controller for the information described here. 1UP is not affiliated with, endorsed by, or sponsored by Roblox Corporation.

You must be 18 or older to hold a 1UP account. We do not knowingly create accounts for minors, and we remove any we find.

• Account details. Your email address, a hashed password (we never see the plaintext), your display name, and which side of the marketplace your account is on.
• Your confirmations. That you stated you are 18 or older, that you accepted these terms, and when.
• Roblox link. If you connect Roblox, we store your Roblox user ID and username. We never receive your Roblox password.
• Identity verification results. If you run an age or identity check, we store the outcome — whether it passed, an age or adult flag, the issuing country of a document, quality and match scores, screening hit counts, and warning codes.
• Technical records. Server logs and verification event metadata, kept to operate and debug the service.

Identity checks are run by Didit, a third-party verification provider. Depending on the check, Didit may process a selfie, a liveness capture, and images of a government-issued identity document. That processing can involve biometric analysis — estimating age from a face, and comparing a face against a document portrait.

We do not store your face images or your document. Those stay with Didit. 1UP receives and keeps only the derived outcome described above. We deliberately do not store your date of birth, your name as printed on a document, or a document number.

You are never required to run an identity check to browse or to hold an account. It is required before you back a campaign or open a raise, because the platform is 18+ and because money is involved.

• To create and secure your account, and to let you sign back in.
• To enforce the 18+ requirement on both sides of the marketplace.
• To confirm that a person claiming a Roblox studio or game controls that Roblox account.
• To meet identity and anti-money-laundering obligations before value changes hands.
• To send transactional email — verification codes, account notices.
• To keep the service running, investigate abuse, and debug faults.

We use a small number of processors, each for a specific job:

• Supabase — database, authentication, and server functions. Data is hosted in the United States.
• Vercel — application hosting and delivery.
• Didit — identity and age verification, including the biometric processing described above.
• Google — only if you choose to sign in with Google.
• Roblox — only if you choose to connect your Roblox account.
• Resend — delivery of transactional email.

We do not sell your personal data, and we do not share it with advertisers or data brokers.

Our infrastructure is hosted in the United States. If you are in the European Economic Area or the United Kingdom, your data is transferred outside your region and processed there.

Account data is kept while your account exists. Verification outcomes are kept while your account exists, because they are what allows us to prove the 18+ requirement was met. Technical logs are kept for a limited operational period and then discarded.

When you delete your account we remove your profile and its verification outcomes. Records we are legally required to retain are kept for as long as that obligation lasts, and no longer.

Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, object to or restrict how we use it, receive a portable copy, and withdraw consent you previously gave. You can disconnect your Roblox account yourself at any time from your settings.

To exercise any of these, write to privacy@roblxinvest.com. If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

Passwords are hashed and never stored in readable form. Access to your data is enforced at the database level, so one account cannot read another’s records. Credentials for our providers are held server-side and never reach your browser.

No system is perfectly secure. If we discover a breach affecting your data, we will notify you and the relevant authority where the law requires it.

If we change this policy in a way that materially affects you, we will say so in the product rather than quietly updating the date at the top.