1. The short version
We collect as little as we can. There are no analytics trackers and we never sell or rent your data. The editor and the loader need no account. An account is only required to share code or use the editor's sandbox, and all it stores is your email address.
2. Visiting the site
Browsing mango.onl sets no cookies unless you sign in, in which case one cookie keeps you signed in for 30 days. It holds nothing but a signed reference to your account and is cleared when you sign out. We keep an anonymous page-view count. Your IP address is used briefly for rate limiting and may show up in standard server logs. Fonts load from Google Fonts, so Google sees your IP when a page loads.
3. Running our scripts
When a script loads, it sends a one-time token, your executor's hardware ID (HWID), your Roblox username, and your executor's name so we can verify the request. A successful load only adds to an anonymous counter. It isn't logged.
4. Failed checks
If a load is rejected or blocked, an integrity check fails, or a PIN is rejected, we log the time, IP address, HWID, Roblox username, executor name, the reason, and the error ID shown in your console. That's how we look up problems you report to us and rule out bad executors.
5. The PIN page
To keep the loader free, it may send you to mango.onl/pin for a short one-time PIN. The PIN itself is random and tied to your HWID only long enough to let you load. We briefly note your IP when issuing a PIN to prevent abuse.
6. Ads
The PIN page may show ads from third-party ad networks. Those networks may set their own cookies and collect data such as your IP and device info under their own privacy policies, which we don't control.
7. Accounts and email
If you create an account we store your email address, when you signed up, and when you last signed in. That's the whole record — no name, no password, no profile. The address is used to send you sign-in codes, to attribute the code you share, and to count your storage against your limit.
Sign-in codes are sent through Brevo, our email provider, which processes your address to deliver the message. Codes expire in minutes and are deleted once used. The sign-in page uses Cloudflare Turnstile to check you're human; Cloudflare receives your IP and basic browser information for that check.
8. Code you share
When you create a share link we store the files, their names, any title you give it, and the account that made it, plus a view count. Links are unlisted — not indexed and not guessable — but anyone you give the link to can read it, so treat a share as public. Don't put secrets, keys, or tokens in shared code.
Shares expire automatically (30 days by default) and are then deleted. You can delete any of yours at any time from your account page, which removes it immediately and breaks the link. Deleting your account deletes everything you have shared along with it.
9. The editor itself
Files you open in the editor stay in your browser. Opening a folder, typing, formatting, and all the analysis run locally on your own machine — none of that code is sent to us, and there is no AI service behind any of it. The only time code leaves your browser is when you deliberately create a share link. Open tabs are remembered locally in your browser's own storage so you don't lose work; clearing site data removes them.
For autocomplete and deprecation warnings, your browser downloads Roblox's public API description directly from Roblox (clientsettingscdn.roblox.com and setup-aws.rbxcdn.com), or from a public copy on GitHub if Roblox's is unreachable. Those requests carry no code and no account details, but Roblox or GitHub sees your IP address as with any download. The result is cached in your browser.
Your layout choices (which panel is open, panel width, folder layout, and whether type hints are on) are saved in your browser's local storage, not with us. The UI preview and DataStore size check work on the code in your browser and send nothing anywhere.
The tools at /tools work the same way: the API reference downloads Roblox's public API description straight from Roblox (or GitHub) into your browser, and the CFrame and tween tools make no requests at all. The API changelog is the one exception, and it involves no data about you: our server downloads public API descriptions from the Roblox Client Tracker on GitHub and compares them.
The DataStore and HttpService sandbox is a local simulation. The stores, keys and mock responses you create in it are saved only in your browser's storage, never sent to us or to Roblox, and no real web requests are made from it.
10. The Roblox downloader
At mango.onl/rdd your browser downloads Roblox's own files straight from Roblox's servers and assembles them on your device. The files never pass through mango.onl, and we don't record which version you download. To look up version numbers and executor compatibility, your browser also contacts Roblox and WEAO (weao.xyz), who see your IP address under their own policies. Our server separately asks Roblox for the current version numbers and keeps a list of them; that list contains no information about you. We count page views anonymously, as on the rest of the site.
11. How we use it
Only to run the service: delivering sign-in codes, attributing and metering shared code, preventing abuse, enforcing rate limits and blocks, and troubleshooting errors. We don't use your data for advertising or profiling ourselves; only the third-party ad networks above do their own thing. We will never email you anything but a sign-in code you asked for.
12. How long we keep it
The failure log holds at most the latest 2,000 entries and may be purged sooner. PIN codes and their unlocks expire in minutes, and rate-limit counters expire within minutes too. Sign-in codes expire in 20 minutes. Shared code expires after 30 days by default. Account records stay until you delete the account. A block on an HWID, username, or email stays until it's lifted.
13. Who else sees it
Nobody, except the providers needed to run the service — the hosting and network providers that carry traffic to our server (such as Cloudflare), Cloudflare Turnstile for the human check, and Brevo for sending sign-in codes — or when the law requires it. Anyone you give a share link to can read that share. The downloads described in sections 9 and 10 go from your browser straight to Roblox, WEAO and GitHub; we don't send them anything about you.
14. Your choices
You can delete any share, or your whole account and everything in it, from your account page — no need to ask us. To have log entries tied to your HWID or username deleted, or to appeal a block, contact us in our Discord. mango.onl isn't intended for children under 13. We'll update this page and its date if anything changes. See also our Terms of Service.