AlyssaElixir

We dug into the leaked build of Lunar for Roblox. By default, Lunar tracks at least 64 different kinds of actions that occur in the app. Every 15 seconds, they send every interaction to their servers. This includes: • Every game you join and how long you played • Every game you favorite, like, or dislike • Every game you toggle notifications for • Every group you join/leave • Every macro you create/modify/activate • Every screenshot/clip you create, delete, favorite, or copy • Every community forum post/reply you make According to Roblox's own policy about User Privacy and Third-Party Integrations, "Creators may not send individual user data to social platforms, chat applications, advertising networks, vendors, or partners for their own business purposes. Creators also may not sell, rent, lease, or syndicate this data." Through Overwolf, it's disclosed that over a thousand external ad vendors can access user data for purposes including: • Personalized advertising (789 vendors) • Personalized content (275 vendors) • Advertising and content measurement, and audience research (672 vendors) • Store and/or access information on a device (1005 vendors) Lunar lets you turn off its own analytics and "ad optimization," both on by default. But the third-party services built into the app are harder to control. Sentry, which reports crashes and performance data, has no setting to turn it off. Overwolf's ad controls limit ad targeting, but the ads themselves can't be turned off. On Windows, Overwolf reads the cookies saved by Opera and Opera GX (if installed) and copies them into Overwolf's built-in ad browser, skipping major sites like Google, Facebook, Steam, and Amazon. This likely lets ad networks shown in the app recognize you from your normal browsing. It also checks for antivirus software and appears to skip this step if it finds one, and the code that starts it doesn't check for consent. Overwolf also runs its own anonymous analytics, which apps can turn off with one call. Lunar never does this or offers it as a setting. Lunar currently contains code, connected to the Overwolf ad system, that turns an email address into unsalted hashes (MD5, SHA-1, and SHA-256). These hashes are commonly used to recognize the same person across different apps and websites. Nothing in this version runs that code, and Lunar has no way to get your email, so no email data is collected today, but a future update could switch it on, as it's mentioned in their privacy policy. Also, Lunar has internal kill switches that could prevent certain users from (within the app) purchasing avatar items, purchasing private servers, using macros, multi-instance launching, using per-game outfits, and viewing ads.