Privacy policy

Last updated 11 October 2026

This policy explains what the XSF website (xsfshooter.vercel.app) and the XSF framework collect, why, and what you can do about it. XSF is made by Beirut Sites. If anything here is unclear, email XSF@beirutsites.com.

The short version

• We keep your email, or your Roblox or Discord account if you sign in with one, so you can sign in and get your license.
• We count page visits without keeping your IP address.
• Games using XSF tell us which Roblox game they are, so we can check the license.
• Games using XSF save players' XSF settings against their Roblox user ID, so settings follow them between games.
• We do not sell data, show ads, or use tracking cookies.

What we collect

Your account

When you sign in we store your email address, your account status, your license key, when you joined and last signed in, how many times you signed in and downloaded XSF, the website that sent you to us (if any), and the country your request came from (worked out by our host from your connection, not a precise location). Sign in codes are stored only as a one way hash and expire after 10 minutes.

Signing in with Roblox or Discord

If you sign in with Roblox or link your Roblox account, Roblox tells us your Roblox user ID, username, display name and the link to your profile picture. We only ask Roblox for the openid and profile permissions. We don't get your password, email, friends, inventory, Robux or anything else, and we can't post or act for you. The access token Roblox gives us is used once to read who you are and then handed back to Roblox, so we don't keep it.

If you sign in with Discord, Discord tells us your Discord user ID, username, display name, avatar and verified email. We use the email to find or make your XSF account and the ID to give you the Verified role in our server.

You can unlink either account at any time from your account page, and we delete what we stored from it.

Visits to the website

When you view a page we record the page, the date, your country, your device type (desktop, mobile or tablet), the site that linked you here and any campaign tags in the link. To count unique visitors we make a one way hash of your IP address and browser that changes every day. We never store your IP address itself.

Security

To stop abuse, such as someone requesting thousands of sign in codes, we keep short lived counters keyed by a hash of your IP address or email. They expire on their own.

Games that use XSF

When a game with XSF starts, it checks its license with our server. That check sends the license key, the Roblox place ID and game (universe) ID, and whether it is running in Studio. We look up the game's public name from Roblox and store the game, which places it runs in, and when we first and last saw it. This lets you see and manage your games on your account page.

If a game is public on Roblox and has had players, it is listed on our Games page with its public name, icon, visit count and XSF version, all of which Roblox already shows to anyone. Nothing about you or your account is shown there. You can hide any of your games from that page at any time on your account page.

Player settings

When a player changes their XSF settings in a game, the game's server sends them to us with the player's Roblox user ID. Settings are things like key binds, sensitivity, field of view, effect toggles, and weapon loadouts and presets. We store them so the same player gets the same settings in every XSF game. We do not receive usernames, chat, or anything else about the player. If the game has HTTP requests turned off, settings are saved inside that game instead and never reach us.

Update checks

Game servers ask our site which XSF version is newest. That request carries nothing about you or your players.

Emails and support

If you email us or open a ticket in our Discord, we keep that conversation so we can help you. Ticket transcripts are kept in a staff only channel.

Cookies

We use one cookie, xsf_s, to keep you signed in for up to 30 days. It is needed for the account page to work and is not used for tracking or advertising. There are no third party cookies. The site also remembers small preferences in your browser's local storage.

Who else handles the data

• Vercel hosts the website and its servers.
• MongoDB Atlas hosts the database.
• An email relay run by Beirut Sites sends sign in codes and account emails.
• Roblox, when we look up a game's public name, and when you sign in with Roblox.
• Google Fonts serves the fonts on the website, so your browser contacts Google to load them.
• Discord, if you sign in with Discord or join our server. Discord's own privacy policy applies there.

We do not sell or rent any of it, and we only share it with these services as needed to run XSF, or if the law requires it.

How long we keep it

• Accounts and their games: until you ask us to delete them.
• Player settings: as long as they are in use. We may clear settings nobody has used for a long time.
• Visit counts: kept as statistics.
• Sign in codes: 10 minutes. Abuse counters: up to an hour.

Your choices

Email XSF@beirutsites.com from the address on your account and we will send you a copy of your data, correct it, or delete your account. Deleting your account also revokes its license, so games using that license stop working. Players who want their saved settings removed can send us their Roblox user ID.

Children

The website and accounts are meant for developers aged 13 and over, in line with Roblox's own rules for creators. Inside games, XSF only stores a player's Roblox user ID and their settings, as described above.

Changes

If we change this policy we will update the date at the top. Big changes will also be announced in our Discord.