Who we are
Oracis Engineering LLC (“we”, “us”) makes Vicious Seas, an original pirate role-playing game on Roblox, and runs the website viciousseas.com. This policy covers both. For anything in it, write to support@viciousseas.com.
The short version
- The public website has no advertising, no analytics, no tracking and no cookies. It has no public accounts and nothing for visitors to fill in.
- The game runs on Roblox. Roblox runs player accounts, sign-in, chat, chat filtering and payments. We never receive a player’s real name, email address, birthday, password or payment details.
- The game never asks players for personal information. It saves game progress against the player’s Roblox user id, inside Roblox.
- We do not sell personal information, and we do not share it for advertising.
- You can ask us to see or delete information about you or your child by emailing support@viciousseas.com.
The website
Visiting the site
Our website is hosted by Railway. Like any web host, Railway receives the technical details every browser sends with a request: your IP address, the page or file asked for, the time, and your browser’s user-agent string. Railway keeps these in its request logs, which we use only to run the site, find faults and keep it secure. Our own server code writes no record of visitors.
Every page, script, font and image on the site is served from our own domain. The site loads nothing from other companies: no advertising networks, no analytics or measurement tools, no social media widgets, no embedded videos, no externally hosted fonts. Our security settings tell browsers to refuse scripts, fonts and connections from anywhere else.
When we publish a change to the site, our deploy tells search engines (Bing and Yandex, through the IndexNow protocol) which page addresses changed, so they can read them again. That message lists only our own page addresses and carries nothing about any visitor.
Our domain name’s DNS and our email forwarding are run by Cloudflare.
Team sign-in
The site has a sign-in area for members of our own team. It is not open to the public, and there is no public sign-up. Team sign-in uses Supabase, our authentication and database provider. For team members, Supabase holds their email address, a securely hashed password, and sign-in records (such as times and IP addresses) that it keeps to protect accounts. Signing in stores a session token in the browser’s local storage; see our Cookie Notice. Account emails for team members, such as invitations and password resets, are sent through an email delivery provider.
Emailing us
If you email support@viciousseas.com, we receive your email address, your message and anything you attach. Email to our domain is forwarded by Cloudflare to the mailbox our team reads. We use it only to answer you and to keep a record of what was asked and answered.
The game on Roblox
Vicious Seas is played on Roblox, and your Roblox account is governed by the Roblox Privacy and Cookie Policy. Roblox, not us, handles account creation, age checks, sign-in, chat and its filtering, friends, voice features, parental controls and every purchase made with Robux.
What the game stores
- Game progress. Your captain’s level, stats, items, gold, quests, ships, settings and similar game state are saved in Roblox DataStores, Roblox’s storage for games, under your Roblox user id, so your progress is there when you return. Records of trades between players are kept the same way, so a trade completes for both sides or for neither.
- Leaderboards. Public boards in the game show a player’s Roblox name next to their score or best time. Roblox’s player list can also show each captain’s level.
- Friend invites. When a friend joins through a player’s invite, Roblox tells the game who sent the invite, and both captains earn a title (a name only). If the inviter is not playing at that moment, the game keeps a short note under the inviter’s Roblox user id, holding only the time, until the inviter next plays; it is then deleted. The friend’s id is never stored with it.
- Screenshots to share. After a captain’s first boss win in a session, the game may take a screenshot on the player’s own device and offer Roblox’s own share sheet. The picture stays on the device unless the player chooses to share it; the game never uploads or keeps it.
- Surveys and problem reports. The game sometimes offers an optional survey, and players can report a problem or send an idea. These answers are stored under a scrambled code made from the user id, never the user id itself. Anything typed is passed through Roblox’s text filter first; if the filter cannot check it, the text is thrown away.
- “Report a problem”. A report stores the short note the player typed and the game context: their level (in bands of ten), the place and game version, and the kind of device. Only the game’s creator sees it. It is never shown to other players and never used for advertising. We cannot reply to a report, so the form asks players not to type a real name, age, school, phone number, email or social account. Reports are deleted once the issue is fixed, and always within 90 days. If the creator finds a report useful, the creator may reward the player’s captain with in-game gold for it; that reward is recorded under the same scrambled code, and is removed once the gold is paid.
- Game analytics. The game sends events to Roblox’s own analytics service, such as reaching a step of the tutorial, earning or spending gold, or a game error happening. These events contain game identifiers only, never names or chat. We read them as totals in Roblox’s creator dashboard to find out where the game is too hard, too easy or broken.
- Error reports. When a script fails, the game records the error with player names removed so we can fix it. Our server logs inside Roblox may show a Roblox user id when a save problem happens, so we can repair that player’s progress.
What the game does not do
The game never asks for a real name, email address, phone number, home address, school, photo or any other personal information. It sends nothing to servers outside Roblox. Text that a player types for other players to see goes through Roblox’s text filtering before anyone else sees it.
Children
Vicious Seas is made to be enjoyed by players of all ages on Roblox, including children under 13. We designed it so that we do not collect personal information from children ourselves.
- Under the US Children’s Online Privacy Protection Act (COPPA), Roblox is the operator that handles a child’s account and obtains any parental consent it requires. Outside Roblox’s own systems, we collect no personal information from children: the game stores only game progress against a Roblox user id, which is the information a game needs to save a player’s progress.
- In the UK, the European Economic Area and other places with special rules for children’s data, we apply the same approach: no profiling, no advertising, no location data, and the least information needed for the game to work.
- The website is not aimed at children and collects nothing from visitors beyond the technical request details our host receives.
Parents and carers: to have your child’s game progress deleted, email support@viciousseas.com with your child’s Roblox username. We may ask for details that show the account is your child’s before we act. Deleting progress cannot be undone. You can also manage your child’s account, chat and spending in Roblox’s parental controls, and our Parents’ Guide explains how the game keeps players safe.
If you believe we have received personal information from a child in a way this policy does not describe, contact us and we will delete it.
How we use information
We use the information described above only to:
- run the website and the game, and save players’ progress;
- keep both secure, and prevent cheating, abuse and fraud;
- answer messages and support requests;
- understand, in totals, how the game is played so we can fix problems and improve it;
- meet our legal obligations.
We do not sell personal information, share it for cross-context behavioural advertising, build advertising profiles, or make automated decisions about anyone that have legal or similarly significant effects. Where a law asks for a legal basis, we rely on what is needed to provide the game and site you asked for, our legitimate interest in keeping them working and safe, and our legal obligations.
How long we keep it
- Game progress is kept while the game runs, so a returning player keeps their captain, unless we are asked to delete it.
- Problem reports are kept until the issue is fixed and never longer than 90 days, then deleted. A gold reward waiting for a captain is deleted the moment it is paid.
- Hosting and sign-in logs are kept by Railway and Supabase for the periods their services set, and are used only for operating and securing the site.
- Emails are kept as long as we need them to answer and to keep a record of what was agreed, then deleted.
- Team accounts are kept while the person is on the team.
- Analytics are held by Roblox under its own retention rules; we see them only as totals.
Your choices and rights
Depending on where you live, you may have the right to ask us for a copy of the personal information we hold about you, to correct it, to delete it, to object to or restrict how we use it, or to receive it in a portable form. California residents have the right to know, delete and correct, and the right not to be treated differently for using these rights; we do not sell or share personal information as California law defines those terms.
To make a request, email support@viciousseas.com. For game progress, include the Roblox username. We may need to confirm that the account is yours, or your child’s, before we act. We will answer within the time the law that applies to you requires. You can also complain to your local data protection authority.
Roblox also passes data-erasure requests it receives about a player to the games that player has used. Our saved records carry the player’s Roblox user id for this purpose, and we act on those requests.
Security
The site is served only over HTTPS with strict browser security settings. The team area is protected by sign-in and by database access rules that let only team members read team records. In the game, the server checks every important action, such as damage, rewards, purchases and trades, rather than trusting a player’s device. No system is perfectly secure, but we work to protect the information we hold and to fix problems quickly.
International visitors
The site and the game are available around the world. Our providers, including Roblox, may process information in the United States and in other countries where they operate, which may have different data protection rules from yours. Where the law requires it, we rely on our providers’ recognised safeguards for those transfers.
Changes to this policy
If what the site or the game does with information changes, we will update this policy and the date at the top of this page. If a change is significant, we will say so on this site before it takes effect.
Contact
Oracis Engineering LLC
Email: support@viciousseas.com