Last updated: October 14, 2026
Picoo is operated by Loop Mobile FZCO, based in Dubai, United Arab Emirates. We are the data controller for personal information processed through the Picoo plugin and picoo.io. Contact us at help@picoo.io for any privacy questions.
Account data: Email address, name (optional), password (hashed).
Plugin session data: When you connect the Picoo plugin in Roblox Studio, we receive your Studio user ID (so we can scope assets to your account), the messages you send to the AI copilot, the structured operations the AI performs in your place (script edits, instance creates, asset inserts), and a snapshot of your current Workspace hierarchy that the AI uses for context. We never read or store games you have published, only the local place you have open.
Roblox account link (optional): If you link your Roblox account in Settings, we keep its user ID, username and display name, whether it is in the Picoo community, and its Roblox sign-in tokens, encrypted. Disconnecting it there deletes all of this.
Billing data: Handled by Dodo Payments, our merchant of record. We store your Dodo Payments customer and subscription IDs — no card numbers are stored on our servers.
Usage data: Pages visited, features used, for improving the Service.
We use collected data to: run the AI copilot inside your Studio (your messages and hierarchy snapshots are sent to Anthropic for inference), send transactional emails (welcome, subscription confirmation), respond to support requests, analyze usage to improve features, and measure visits and ad conversions (see §5). We do not sell your data or train models on it.
Data is stored on Supabase (PostgreSQL) with servers in the EU/US. Conversation history is retained until you delete the conversation or your account. Generated 3D models are uploaded to Picoo’s Roblox group, not to your Roblox inventory. Account data is retained until you delete your account.
We use: Supabase (database & auth), Anthropic (Claude — AI inference), OpenAI (embeddings of your messages, used to route requests and search), Cohere (search re-ranking), Langfuse (monitoring of AI requests), Replicate (3D model and image generation), Roblox Open Cloud (uploading generated 3D models and UI art to Picoo’s Roblox group), Dodo Payments (payments, merchant of record), Resend (email), Upstash (rate limiting), Google (Google Analytics and Google Ads measurement), Vercel (hosting and site analytics). Each has its own privacy policy.
Your sign-in session is kept in your browser’s local storage, not in a cookie. We set one first-party cookie, picoo_attr, on your first visit. It records how you reached picoo.io (referring site, campaign tags and landing page), lasts one year, and is saved to your account when you sign up. A record of your first referring page is also kept in local storage and reported when you finish onboarding. Every page also loads Google Analytics and Google Ads tags, which set their own cookies to measure visits and ad conversions.
You have the right to: access your data, correct inaccurate data, request deletion of your account and data, and export your data. Contact help@picoo.io to exercise these rights.
If you are located in the EEA, the UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent UK/Swiss laws. The lawful bases on which we process your data are:
In addition to the rights in §6, GDPR gives you the right to: restrict processing, object to processing, data portability, withdraw consent at any time, and lodge a complaint with your local supervisory authority.
International transfers: Your data may be processed in the EU, US, and other regions where our subprocessors (Supabase, Anthropic, OpenAI, Cohere, Langfuse, Replicate, Roblox, Dodo Payments, Resend, Upstash, Google, Vercel) operate. Where data is transferred outside the EEA, we rely on the Standard Contractual Clauses (SCCs) approved by the European Commission and/or each subprocessor’s own GDPR-compliant transfer mechanisms.
Data Protection Contact: Email help@picoo.io with subject line “GDPR Request” and we will respond within 30 days.
The Service is intended for users 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us data, contact us immediately.
We may update this policy. We will notify you via email of material changes. Continued use of the Service after changes constitutes acceptance.
Questions about privacy? Email us at help@picoo.io