Privacy Policy

This Privacy Policy explains how Crux Studios ("Company", "we", "us", "our") collects, uses, shares, and protects your personal information when you use Reagent ("Service"), an AI-powered Roblox Studio building tool available at reagent-lab.com.

Crux Studios is based in India. By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

We are committed to being transparent about what data we collect and how we use it. We collect only what we need to deliver and improve the Service.

Account Information

When you create an account, we collect:

• Email address
• Display name
• Profile photo URL (if signing in with Google)
• Authentication provider (Google or email/password)

Data from Google Sign-In

If you sign in with Google, we receive your name, email address, and profile photo from Google. We do not receive or store your Google password. We use Firebase Authentication (a Google service) to manage this process.

User-Provided Data

• API keys — You may provide API keys for Anthropic and/or Google Gemini to use with the Service.
• Chat messages and prompts — The instructions you send to AI agents and the responses received.
• Session data — Session metadata including titles and timestamps.
• Bridge tokens — Tokens used to authenticate the Reagent Connector with your account.

Usage Data

We automatically collect:

• AI model usage and token counts per session.
• Feature usage patterns (which tools are called, frequency of use).
• Subscription status and plan information.

Data from Paddle

When you purchase a subscription, Paddle (our payment processor and Merchant of Record) may share with us: your name, email, country, transaction IDs, subscription status, and plan details. Paddle handles your full payment information (credit card, billing address) directly — we never see or store it.

We use your data for the following purposes:

• Service delivery — To authenticate you, process your requests, and deliver AI-generated output.
• Account management — To manage your subscription, sessions, and settings.
• Communication — To send transactional emails related to your account (such as password resets or important service updates).
• Service improvement — To understand how the Service is used, identify bugs, and improve features. We use aggregated, anonymized usage data for this purpose.
• Security — To detect and prevent fraud, abuse, and unauthorized access.

We do NOT use your data to train AI models. Your prompts, conversations, code, and project data are not used for training, fine-tuning, or improving any AI model. They are processed only to deliver the Service to you.

We do NOT sell your personal data. We never have and never will sell your personal information to third parties.

We share your data only with the third-party services required to operate the Service:

• Firebase (Google Cloud) — Stores your account data, sessions, messages, API keys, and bridge tokens. Data is stored in Google Cloud infrastructure.
• Anthropic — When you use Claude models, your prompts and conversation history are sent to Anthropic's API for processing. Anthropic's data handling is governed by their privacy policy.
• Google (Gemini) — When you use Gemini models, your prompts and conversation history are sent to Google's API. Google's data handling is governed by their privacy policy.
• Paddle — Processes your payments and manages subscriptions. Paddle receives your payment and billing information directly.
• Vercel — Hosts our frontend. Vercel may process standard web request data (IP address, browser info) as part of serving the application.
• Fly.io — Hosts our backend servers in the Mumbai region. Your requests, prompts, and data in transit pass through Fly.io infrastructure.

We do not share your data with any other third parties except as required by law.

If you provide your own API keys for Anthropic or Google Gemini, here is how we handle them:

• Storage — Your API keys are stored in Firebase Firestore, associated with your user account.
• Transmission — When you send a request, your API key is transmitted from our backend server to the respective AI provider (Anthropic or Google) to authenticate the API call. The key is sent over encrypted (HTTPS/TLS) connections.
• Access — Your API keys are accessible only to our backend processing code and are not exposed to other users, logged in plaintext, or used for any purpose other than authenticating AI requests on your behalf.
• Deletion — You can remove your API keys at any time through the Service. They will be deleted from our database promptly.

The Reagent Connector is a desktop application that runs locally on your computer and bridges communication between our cloud backend and your Roblox Studio instance.

• Local execution — The Connector executes tool calls (creating objects, running Lua code, etc.) locally on your machine. These actions happen in your Roblox Studio instance and are not stored on our servers.
• Data in transit — Tool call instructions and their results are transmitted between our backend and the Connector via WebSocket. This data passes through our servers but is not persistently stored beyond what is needed for the active session.
• No project file collection — The Connector does not upload your Roblox project files, assets, or source code to our servers. It only transmits the specific tool call data needed to perform the actions you request.

• Account data — Retained as long as your account is active. Upon account deletion, we delete your personal data within 30 days, except where we are required by law to retain it.
• Chat messages and sessions — Retained as long as your account is active. You can delete individual sessions through the Service at any time.
• API keys — Retained until you remove them or delete your account.
• Usage data — Aggregated usage statistics may be retained indefinitely in anonymized form.
• Payment records — Paddle retains transaction records in accordance with their own retention policies and applicable tax/legal requirements.

We implement reasonable technical and organizational measures to protect your personal data, including:

• All data in transit is encrypted using HTTPS/TLS.
• Firebase Firestore provides encryption at rest and access control through security rules.
• API keys are stored in Firestore with access restricted to authenticated backend processes.
• Bridge token authentication prevents unauthorized access to your Connector.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If we become aware of a data breach that affects your personal information, we will notify you in accordance with applicable law.

Your data may be processed in multiple jurisdictions:

• India — Our backend servers are hosted in Mumbai (Fly.io).
• United States — Firebase (Google Cloud), Vercel, Anthropic, and Paddle infrastructure may process data in the US.
• Other regions — Google and Anthropic may process AI requests in various data center locations.

By using the Service, you consent to the transfer of your data to these jurisdictions. We ensure that all third-party processors maintain adequate data protection measures.

Depending on your location, you may have the following rights regarding your personal data:

For all users

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate personal data.
• Deletion — Request deletion of your account and personal data.
• Data portability — Request a machine-readable export of your data.

GDPR (European Economic Area)

If you are in the EEA, you also have the right to object to or restrict processing, withdraw consent, and lodge a complaint with your local data protection authority. Our legal basis for processing is contract performance (providing the Service) and legitimate interest (improving and securing the Service).

India Digital Personal Data Protection Act (DPDP)

If you are in India, you have the right to access, correct, and erase your personal data, as well as the right to nominate another person to exercise your rights in the event of death or incapacity. You may also file a complaint with the Data Protection Board of India.

To exercise any of these rights, contact us at admin@cruxdev.in. We will respond within 30 days.

Reagent is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly.

Users between 13 and 17 years old may use the Service with the consent and supervision of a parent or legal guardian. Parents or guardians who believe their child's data has been collected without consent should contact us at admin@cruxdev.in.

Reagent uses minimal cookies and tracking:

• Authentication cookies — Firebase Authentication uses cookies/local storage to maintain your login session. These are essential for the Service to function.
• No advertising trackers — We do not use advertising cookies, tracking pixels, or third-party analytics that track you across websites.
• Vercel analytics — Our hosting provider (Vercel) may collect basic web analytics (page views, performance metrics) in aggregated form. This data does not identify individual users.

We do not participate in cross-site tracking or share browsing data with advertisers.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or through the Service.

We encourage you to review this page periodically. Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

In accordance with Indian data protection regulations, we have designated a Grievance Officer to address your concerns regarding data processing:

The Grievance Officer will acknowledge your complaint within 24 hours and resolve it within 30 days of receipt.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: