Privacy Policy

Last updated: May 8, 2026

Introduction

Friend Path Finder ("we," "our," or "the Service") is a free online tool operated by arbastro that allows users to discover the degrees of separation between Roblox player accounts through publicly available friend network data. This Privacy Policy explains how we handle information when you use our Service at friendpath.arbastro.com.

Information We Collect

We are committed to minimal data collection. Here is what we do and do not collect:

Personal information we do NOT collect or store:

Personal identification information (name, email address, physical address, IP address, etc.)
Roblox account credentials or passwords
Any information that identifies the person performing a search

Search metadata that is transmitted:

When you perform a scan, the Roblox usernames searched and the path results (degrees of separation) are transmitted to a private logging channel via Discord webhooks for operational monitoring purposes. These notifications contain the Roblox usernames searched but do not contain any information identifying the person who performed the search.

Information stored locally on your device:

Scan count: We use your browser's localStorage to track how many scans you have performed. This is used solely to determine when to display an advertisement before a scan. This data never leaves your device.
Search history: Recent searches are stored in your browser's localStorage for your convenience. This data is stored entirely on your device and is not transmitted to our servers.
Share link tracking: We track which share links you have visited in localStorage to manage the advertising gate for shared links.

Roblox Data

When you initiate a scan, the Roblox usernames you enter are sent from your browser to our server, which then queries the official Roblox public APIs (friends.roblox.com, users.roblox.com, thumbnails.roblox.com) to retrieve publicly available friend list data, profile information, and avatar thumbnails. Roblox data is queried in real-time and not permanently stored on our servers. However, basic search metadata (usernames searched and path results) may be temporarily logged for operational purposes via Discord webhooks, as described above.

All friend data displayed is publicly available through Roblox's official APIs. We do not access any private or restricted Roblox account data. Some accounts may have friend list restrictions due to regional privacy regulations (such as the UK Age Appropriate Design Code), in which case we are unable to retrieve their friend data.

Advertising

After your first free scan, we display rewarded video advertisements provided by AppLixir (applixir.com), a third-party advertising platform. When an advertisement is displayed:

AppLixir and its advertising partners (including Google Ad Manager) may use cookies, device identifiers, and similar tracking technologies to serve and measure advertisements.
These third parties may collect information about your browsing activity across websites to deliver personalized advertisements.
A consent dialog will be presented by the ad platform before personalized ads are served, in compliance with applicable data protection regulations.
You may decline personalized advertising through the consent dialog. However, declining may prevent the advertisement from loading, which is required to use the scan feature.

We also use a service worker file (sw.js) provided by Monetag for push notification-based advertising capabilities.

Cookies & Tracking Technologies

Our Service primarily uses localStorage (browser-side storage) rather than cookies. However, third-party services embedded in our site (advertising networks, Google Translate) may set cookies on your device. Please note that under some regulations, such as the ePrivacy Directive, localStorage is treated similarly to cookies. These third-party cookies are governed by the respective third party's privacy policies:

arbastro Account Integration

Friend Path Finder offers an optional sign-in using your arbastro account. Signing in is not required to use the core scan feature. If you choose to sign in:

Authentication is performed by Supabase Auth on behalf of arbastro. A session token is stored in your browser's localStorage under the key arbastro-fp-session. This token is sent only to arbastro.com to verify your account and Suite subscription status.
We may receive your username, avatar URL, and Suite subscription status from arbastro.com/api/auth/me. This information is used to render your account chip in the header and to determine whether to skip the advertisement gate.
The full arbastro account record (email, linked Discord/Roblox accounts, billing details, etc.) is stored and managed by arbastro and is governed by the arbastro Privacy Policy. Friend Path Finder does not separately store these details.
Signing out, or deleting your arbastro account, removes the session from this device and revokes any associated benefits on Friend Path Finder.

Public APIs

Friend Path Finder exposes two HTTP APIs documented at /docs. When you call these endpoints, we process the following data:

Scan API: Requires an API key issued through your arbastro account. We log the API key ID, the Roblox usernames or IDs you submit, response status, the path length returned, and the timestamp. This information is used for billing, abuse detection, and operational debugging. It is associated with your arbastro account.
Famous Users API: Public and unauthenticated. We may log aggregate request counts (e.g., requests per IP per minute) for rate limiting and abuse prevention. We do not associate these logs with an arbastro account.
Network metadata: Like any HTTP service, our infrastructure may temporarily process standard request metadata (IP address, user agent, timestamp) for security, rate limiting, and incident response. This metadata is not used to build profiles of individual users.
API key handling: API keys are stored as one-way SHA-256 hashes; we cannot recover the plaintext after creation. You can revoke a key at any time from your arbastro account, and revocation takes effect immediately.

Discord Webhooks

When a scan is completed or an advertisement is viewed, our server sends a notification to a private Discord channel via webhook for operational monitoring. These notifications contain the Roblox usernames searched and the scan result (degrees of separation). No personal information about the person performing the search is included in these notifications — they contain only publicly available Roblox data (usernames and friend path results).

Children's Privacy

Friend Path Finder is a tool designed for the Roblox community, which includes users of all ages. We do not knowingly collect personal information from children under 13 years of age. Because we do not collect or store personal data, there is no personal information to be disclosed, sold, or otherwise shared. If you are a parent or guardian and believe your child has provided personal information to us, please contact us and we will take steps to address the concern.

Data Security

Since we do not collect or store personal data on our servers, there is minimal risk of data breach affecting your personal information. All communication between your browser and our server is encrypted via HTTPS. Locally stored data (localStorage) is accessible only to our domain and can be cleared at any time by clearing your browser data.

Your Rights

You have the right to:

Clear all locally stored data at any time by clearing your browser's localStorage for our domain
Use browser settings or extensions to block third-party cookies and tracking
Decline consent for personalized advertising when prompted
Sign out of your arbastro account from the header at any time, which removes the session token from this device
Revoke API keys at any time from your arbastro account dashboard
Delete your arbastro account, which removes API keys, billing records, and linked-account data held by arbastro (see the arbastro Privacy Policy for the full deletion flow)
Request information about how your data is handled by contacting us

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will update the "Last updated" date at the top of this page when changes are made. Your continued use of the Service after any modifications constitutes your acceptance of the updated Privacy Policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, you can reach us through: