Single database
Accounts, scripts, keys and load logs live in one Cloudflare D1 database bound to this project. No third-party analytics scripts are loaded on the site.
LUAWARDEN · LEGAL
Privacy Policy
What LuaWarden stores, what it logs, and what it never touches.
1. What we store
• Your account: email address and a salted password hash. Passwords are never stored or readable in plain text.
• Your workspace: the scripts you upload, the obfuscated builds generated from them, the whitelist keys you create and their HWID bindings.
• Optional Discord link: if you use the Discord bot, we store your Discord user ID and username so panels and whitelists can be linked to your account.
2. What we log
Script loads are recorded: which key was used, whether it was valid, the Hardware ID that claimed it, and the time. These logs exist for your dashboard analytics and for enforcing HWID bans. We do not build advertising profiles.
3. What we never do
We do not sell, share or monetize your data, and we do not read the contents of your scripts beyond what the obfuscation and delivery pipeline itself requires. Your source stays yours.
4. Deleting your data
Deleting a script or key from the dashboard removes it permanently. To delete your entire account and every record tied to it, contact the operator through the Discord bot account link and the workspace is wiped on request.
5. Third parties
LuaWarden is hosted on Cloudflare. If you link a Discord account, Discord is involved in that connection by definition, and only your Discord ID and username cross over. Nothing else leaves the platform.
STORAGE
Storage and access
Where the data lives and who can reach it.
Server-side auth
Sessions are signed, expiring credentials. API keys are shown once and stored server-side; regenerating one instantly retires the old value.
Keys are the boundary
Protected payloads are only delivered to requests carrying a valid, unexpired, non-banned key that matches the expected HWID. Everything else gets rejected.
No tracking
No cookies are set for advertising, no pixel tags, no cross-site tracking. The dashboard needs a session, the loader needs a key, and that is the whole surface.