Privacy Policy

This Privacy Policy explains how the Grow a Garden 2 website ("we", "us", the "Site") handles information when you choose to use the optional "Sign in with Roblox" feature and related account features. The Site is a fan-made toolkit and is not affiliated with, endorsed by, or sponsored by Roblox Corporation.

What we collect

The Site works fully without signing in. Signing in is entirely optional. If you choose to sign in with Roblox, we request only the identity scopes openid and profile, and we receive the following from Roblox's OpenID Connect service:

• Your Roblox user ID (a stable numeric identifier)
• Your Roblox display name and username
• Your Roblox avatar headshot image URL
• Your public Roblox profile link and account creation date

If you choose to use account features, we may also store an email address, a mobile phone number, and/or a linked Discord account that you provide, plus activity you generate on the Site (for example, referral link activity and in-Site rewards progress). We do not request or receive your Roblox password, email address, payment details, friends, messages, or any ability to act on your account.

If you use the Site's community features, we also store the content and activity you create: posts and comments you write, who you follow, posts you like, and gold-carrot tips you send or receive. We record basic engagement on this content (likes, comments, view counts, and tip totals) and a pseudonymous record of which posts you interacted with, which we use to operate and rank the feed (see Community features & user content and Analytics below).

How we use it

We use the information above to:

• Display your signed-in state (your name and avatar) on the Site;
• Operate account features such as Early Access referrals and in-Site rewards;
• Confirm that a contact you add belongs to you (via a one-time code);
• Communicate with you about your account, rewards, and early access; and
• With your separate opt-in consent, send you marketing communications — news, updates, and promotional offers about Grow a Garden 2 and our related games and experiences (see Marketing communications below).

How it is stored

For the sign-in feature itself, we do not operate a traditional login database. After you sign in, we keep your user ID, display name, and avatar URL inside a single signed, HttpOnly session cookie stored in your own browser. The access and refresh tokens issued by Roblox are used once to read your profile and are then discarded — they are never stored. The session cookie expires automatically after 7 days, or immediately when you sign out. Any email address and phone number you add are stored encrypted at rest (AES-256-GCM); we never store the one-time verification codes themselves.

Optional contact details & connected accounts

Signed-in users may optionally add a contact email address and/or mobile phone number, and may optionally connect a Discord account.

• Email & phone are stored encrypted at rest (AES-256-GCM). Adding a contact sends a one-time code to confirm it's yours; this confirmation message is transactional and is separate from any marketing opt-in.
• Discord: if you connect Discord we request only the identify scope and store your Discord user ID and display name. We never receive your Discord password, email, servers, or messages.

Community features & user content

Signed-in users can post short text updates, comment and reply, like, follow other gardeners, and send gold-carrot tips. Please keep in mind:

• It's public. Your posts, comments, the display name and avatar from your Roblox profile, your follower/following counts, and the tips on a post are visible to anyone — including signed-out visitors and search engines where applicable. Don't share anything you wouldn't want to be public.
• Gold carrots are a free in-Site feature. They have no monetary value, cannot be purchased or cashed out, and tipping simply moves them between accounts within the Site.
• Engagement is recorded. We keep the like, comment, view, and tip tallies on each post, and a pseudonymous log of which posts an account interacted with, so we can show counts, rank the feed, and build a personalized "for you" feed in the future. This log is keyed to a one-way pseudonym, not to your raw identity.
• Moderation. Content is screened by automated filters and may be reviewed; we may remove content or restrict accounts that break our Terms.
• Deletion. You can delete your own posts and comments at any time, and deleting your account removes your posts, comments, follows, and likes (see Data retention & deletion).

Marketing communications

We will only send you marketing messages if you give a separate, explicit opt-in that is distinct from confirming your contact details. Marketing consent is never a condition of signing in, verifying a contact, or using any part of the Site.

• What we send: news, updates, launch reminders, events, and promotional offers about Grow a Garden 2 and our related games and experiences.
• Channels: email and/or SMS (each opted into separately), and Discord where you've connected it.
• SMS: message frequency varies and message & data rates may apply. Reply STOP to unsubscribe at any time, or HELP for help.
• Email: every marketing email includes a one-click unsubscribe link and our postal mailing address.
• Withdraw anytime: you can opt out using the controls above, or by removing the email/phone from your Profile page, which also revokes that channel's marketing consent.

We use your Roblox profile details and the contact information you provide to decide what to send and to personalize these messages. We do not sell or rent the contact information you provide, or use it to build advertising profiles of you, and we do not share it with advertising partners. (Separately, the third-party ad networks that show ads on the Site set their own cookies; see Advertising & cookies below.)

Service providers

To deliver messages we share the minimum necessary data with trusted processors acting on our behalf: Twilio (verification codes and SMS), SendGrid (email delivery), and Cloudflare (hosting and security). We use Discord's official OAuth for account linking. They process this data solely to provide their service, under their own privacy terms.

Sharing

We do not sell or rent your information, and we do not use it to build profiles of you or to train AI models. Apart from Roblox's OAuth endpoints during sign-in, the only parties we share data with are the service providers described above, and only to deliver the features you request — or where required by law.

If you take part in Early Access referrals, your public Roblox profile (user ID, name, username, avatar) and your referral counts are processed to operate the public leaderboard and to rank participants, including by our own ranking service. This is used solely to rank and reward participants — it is never sold and never used to advertise to you.

Data retention & deletion

We keep your information only as long as needed to provide these features. You are in control:

• Sign out at any time to delete the session cookie from your browser;
• Delete any of your own posts or comments directly from the feed;
• Remove any email, phone, or Discord connection from your Profile page, which deletes that data and revokes the related marketing consent;
• Deleting your account also removes your posts, comments, follows, and likes (pseudonymized engagement logs age out automatically);
• Request deletion of all data associated with your Roblox account by emailing privacy@gag.gg — we will delete it promptly and within the timeframe required by applicable law.

You can also revoke this app's access entirely from your Roblox account settings under Account → Security → Authorized Apps.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to opt out of marketing, and to withdraw consent at any time. To exercise any of these, use the controls above or contact us at privacy@gag.gg. We will not discriminate against you for exercising your rights.

Analytics

The Site uses Cloudflare Web Analytics (cookieless aggregate traffic measurement that does not identify individual users) and Google Analytics 4, which uses cookies and similar identifiers to measure aggregate usage and improve the Site. Analytics data is not linked to your Roblox identity. Where required, you can manage non-essential cookies through our consent controls (see Advertising & cookies).

To operate and improve the community feed, we also keep an internal engagement signal log of feed interactions (post views, likes, comments, and tips) keyed to a one-way pseudonym of your account rather than your raw identity, retained for a limited period. We use it to rank content and to build a personalized feed; it is not sold and is not used to build cross-site advertising profiles.

Advertising & cookies

The Site is supported by advertising. Some or all of the advertising on the Site is managed by our advertising partner Playwire LLC, and we may also display ads from other third-party ad networks (such as Google AdSense) and our own promotional or affiliate banners.

Playwire. All or partial advertising on this Website is managed by Playwire LLC. If Playwire publisher advertising services are used, Playwire LLC may collect and use certain aggregated and anonymized data for advertising purposes. To learn more about the types of data collected, how data is used, and your choices as a user, please visit Playwire's Privacy Policy.

For users in the EEA, the UK, and Switzerland: where publisher advertising services are provided by Playwire LLC, you are presented with messaging from our Consent Management Platform (CMP) about your privacy choices regarding digital advertising, applicable vendors, and cookie usage. You can revisit or withdraw those choices at any time using the on-site consent controls.

Cookies, web beacons & similar technologies. Third-party vendors and ad networks that serve ads on the Site — including our managed partner and its demand partners — may place and read cookies on your browser, and may use web beacons, pixels, scripts, software development kits, and similar technologies to collect information as a result of ad serving on the Site. Information collected this way may include your IP address, device and browser type, operating system, language preferences, pages visited, referral URLs, approximate (non-precise) location derived from your IP address, and interactions with ads. This data is used to serve, measure, cap the frequency of, and improve the relevance of ads, and to detect invalid traffic.

• Third-party ad vendors, including Google, use cookies and similar identifiers to serve and measure ads based on your visits to this and other sites. You can read about how Google uses information from sites or apps that use its services at policies.google.com/technologies/partner-sites. Google's use of advertising cookies is described at policies.google.com/technologies/ads, and you can manage personalized advertising at adssettings.google.com.
• Interest-based advertising. Some ads on the Site may be personalized based on your interests (sometimes shown with an "AdChoices" icon). You can learn more about interest-based advertising and opt out of participating companies at youradchoices.com and optout.aboutads.info (or youronlinechoices.eu in the EU). Opting out does not remove ads — you will simply see non-personalized ads. General information about cookies and how to manage them is available at allaboutcookies.org.
• In the EEA, the UK, and other regions where required, we ask for your consent before non-essential advertising cookies are set, using our on-site consent banner. You can change or withdraw your choices at any time from that banner.
• Our own banners are labeled "Sponsored" and may be affiliate links: if you click through and make a purchase, we may earn a commission at no additional cost to you. These banners do not collect personal information from you on our Site.
• Clicking any ad takes you to a third-party website governed by its own privacy policy and terms, which we do not control.

Children's privacy

Roblox requires an account that is 13 years or older to authorize OAuth 2.0 apps, and our account and contact features are intended for users who are 13 or older. We do not knowingly collect personal information from, or send marketing to, anyone under 13 (or the minimum age of digital consent in your country, which may be higher). If you believe a child has provided us information, contact privacy@gag.gg and we will delete it.

Changes

We may change or update this Privacy Policy at any time, at our sole discretion and without prior notice. Any changes are effective immediately when posted to the Site; the "Last updated" date above reflects the current version. Please review this policy periodically, as your continued use of the Site after changes are posted constitutes acceptance of the updated policy.

Contact

Questions or privacy requests? Email us at privacy@gag.gg.