Who is responsible

This site is run by an independent security auditor operating under the name LaaTortueJaune. For anything in this notice, including exercising your rights, reach me through the Discord contact given on the request page.

What is collected, and only when you send it

Browsing this site collects nothing. There is no analytics script, no advertising, and no tracking cookie. The only data collected is what you type into the audit request form:

• the Roblox place link you submit;
• your Discord username;
• your email address, if you choose to give one — it is optional;
• the message you write;
• the two-letter country your request came from, derived from your IP by Cloudflare. Your IP address itself is not stored.

The one cookie

If you switch language, a cookie named lang remembers your choice so the site stops guessing on your next visit. It holds two letters, en or fr, and nothing else. It identifies nothing about you and is read by no one but this site. It exists only because you asked for a language, which is why it needs no consent banner.

Following your request

The reference shown when you send a request lets you look up one thing on the follow-up page: the stage it has reached. That page never returns the link, the message, or any contact detail, so a reference in the wrong hands reveals a single word attached to nobody. Keep it anyway — and note that you do not need it to reach me.

Why, and on what basis

To answer your request and, if we work together, to run the audit and reach you about it. The legal basis is the steps taken at your request prior to entering a contract. That is the only use — your data is never sold, never shared with a third party for their own purposes, and never used to contact you about anything you did not ask about.

Where it is stored

In a Cloudflare D1 database provisioned in Western Europe, so the data stays in the EU. The administration page that displays it is behind Cloudflare Access and reachable only by me, after authentication.

One copy leaves that database: when a request arrives, Discord notifies me so it does not sit unread. That notification repeats the link, your Discord username and your message, which means this content passes through Discord, a company based in the United States — the same route our conversation would take anyway, since I reply to you there. Your email address is never included in it and never leaves the European database.

How long it is kept

Requests that do not lead to an audit are deleted within 12 months. Requests that do are kept for the duration of the engagement and for 3 years after it ends, which covers the ordinary limitation period for a commercial dispute. You can ask for erasure sooner at any time.

Your rights

Under the GDPR you can ask to access your data, correct it, have it erased, or object to its use. Ask me and I will act on it — erasure is a permanent delete, not a flag. If you believe I have handled your data improperly, you can lodge a complaint with the data protection authority of the country where you live or work.

Anti-bot check

The form is protected by Cloudflare Turnstile, which confirms a human sent it. Turnstile does not profile you and does not track you across sites.

Audit reports

Reports are delivered to the client and are not published. The work section of this site names audited games only where the developer agreed in writing to be named, and the vulnerability count shown there is an aggregate total that is never attached to a named game.

Request an audit