What we know about you

What we store

Studcheck exists to answer one question: which Roblox account belongs to which Telegram user. That link is essentially all we hold. Here is every field.

Two of those deserve expanding. We never ask for your password or your cookie, and no legitimate service will — anything that does is stealing the account. And if you use Sign in with Roblox, we exchange the token for your profile and discard it in the same request. We never store it and never ask Roblox for a refresh token, so our access ends the moment you finish verifying.

While a verification is in progress we hold a signed, fifteen-minute token that ties the login request to your Telegram account, so nobody else can complete it. If a community you're joining uses gating, we record which groups you're waiting on so we can let you in the moment you verify.

If a moderator acts on you

Moderation decisions are stored against your Roblox account rather than your Telegram one — that is what stops a new Telegram account undoing them.

• If you are banned from a community: your Roblox ID, the reason given, which moderator issued it, and when
• Whether that ban covers one group or every group its owner runs

A ban is removed when a moderator lifts it. Unlinking your account does not clear it, or bans would be trivial to escape.

If you run a community

Adding the bot to a group you created means we also store things about the group, not just its members.

• The group's ID, name, member count, and that you created it
• The rules you set: minimum account age, alt policy, and so on
• Your plan, when it expires, any licence key you redeemed, and a record of each payment in Stars (amount, date and Telegram's payment reference), kept so refunds can be made
• For a card payment, Stripe's reference for it. Your card details and email stay with Stripe
• Any webhook URL you configured

Removing the bot from a group stops it being counted. Send /communities privately to see and clear what is held.

Who can see your link

It only works in one direction. Nobody can use Studcheck to find your Telegram account from your Roblox name: the website and the API only say whether a Roblox player has verified.

In groups you join, members can reply to your messages with /whois to see your Roblox account, and in groups that turn it on, your Roblox username can appear as a title beside your name.

If a group you verify in is on a paid plan, its owner can download a list of who verified there, or have each new verification sent to their own server. It includes your Telegram ID and @handle, your Roblox ID and username, and when and how you verified. Once sent, that copy is the community's responsibility.

None of this reveals anything that isn't already public on your Roblox profile. But it does connect two identities that were previously separate. If you'd rather that connection didn't exist, don't verify — or unlink afterwards.

Where it lives

On servers in London, run by Fly.io. Cloudflare sits in front and sees your IP address when you load this site, as any CDN would.

Card payments are handled by Stripe, and payments in Stars by Telegram. We never see a card number.

Fly.io, Cloudflare and Stripe are American companies, so some of this data can leave the UK. Each is bound by the safeguards UK law requires for that.

We use the public APIs of Roblox and Telegram, each of which has its own privacy policy covering your use of their platform.

We use no analytics, no advertising and no third-party trackers on this site. Even the fonts come from our own server rather than Google's.

How long we keep it

• Your link, language choice and API key: until you send /unlink
• A sign-in in progress: 15 minutes
• Groups waiting for you to verify: until you verify or leave. A join request is forgotten after 30 days
• Bans: until a moderator lifts them
• Group records: while the bot is in the group, then until the owner clears them with /communities
• Plans: while they last. Payment records: as long as tax law requires, usually six years
• Server logs, which can include your Telegram ID: 7 days, at Fly.io

Deleting it

Send /unlink to the bot on Telegram. Your link, language choice and API key are gone straight away: no waiting period, no confirmation step, no email.

A custom title already set in a group stays until an admin changes it. We can delete our record but we can't reach into someone else's community.

Your rights

Under UK GDPR you can ask for a copy of what we hold, ask us to correct or delete it, or object to how we use it. /unlink handles deletion instantly; for anything else, email us. If you think we've handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk.

Why the law lets us use it:

• Verifying you and showing your link: legitimate interests. Communities need to know who they are letting in, and you choose to verify. You can object at any time, and /unlink ends it at once
• Bans: the legitimate interests of the community that issued them, since a ban has to hold
• Plans and payments: to give you what you paid for (a contract), and to keep the records tax law requires (a legal obligation)
• Server logs: legitimate interests, to keep the service running and secure

Young people

Studcheck isn't for anyone under 13, and they can't verify: Roblox doesn't let accounts under 13 sign in to other apps. Telegram itself requires users in the EU, the UK and Australia to be at least 18.

Many people who verify are teenagers, so everyone gets the same protection: we keep as little as we can, nobody can find your Telegram account from your Roblox name, and you can delete it all yourself at any time. If you believe a child under 13 has verified, email us and we'll delete the record.

Changes and contact

If we start storing something new, this page changes and so does the date at the top. Substantial changes get announced through the bots.

Questions about any of this: studcheck@sundappleapp.com