Is a private player-to-developer feedback system ToS-compliant?

Help and Feedback Game Design Support
1
  1. What do you want to achieve?

I need to confirm whether a private player-to-developer feedback system
is compliant with Roblox Terms of Service before launching it in my game.

  1. What is the issue?

The Roblox ToS mentions “Communication Features” (Party Chat, Direct Chat,
Voice Chat) that require age checks. My system (called the “Willow Post”)
is a private feedback channel where:

  • Only the developer and the player who submitted can see messages
  • Players cannot see each other’s feedback (completely private)
  • Text is filtered via TextService:FilterStringAsync() +
    GetNonChatStringForBroadcastAsync()
  • Messages are rate-limited (1 per 5 min, max 10 active, ban for abuse)
  • Purpose: one-way player feedback/suggestions to the developer

I’m unclear whether this counts as a “Communication Feature” requiring
age-gating, or if it’s outside that scope since it’s not player-to-player
communication.

  1. What solutions have you thought of so far?
  • Reviewed ToS Section 10.a on Communication Features
  • Reviewed Chat System Guidelines on Creator Hub
  • Implemented heavy text filtering (broadcast-safe + poison char removal)
  • Added rate limiting and abuse penalties

But I haven’t found explicit guidance on private developer feedback systems,
so I need official clarification before shipping.

Specific Questions

  1. Does a private player-to-developer messaging system (where only devs
    and the author see messages) violate ToS?
  2. Is age-gating required for feedback systems, or only for
    player-to-player communication?
  3. What additional safety measures would be recommended?

Any guidance appreciated!

2 Likes
2

u’ve done more than most devs already.

​ToS Compliance: as long as it’s 1-on-1 feedback and not a social/chat channel, it doesn’t fall under “communication features” that require strict age-gating. u are safe. ​The Real Risk (PII): filtering profanity with FilterStringAsync is standard, but the bigger risk is PII (Personally Identifiable Information). kids will try to send their phone numbers or home addresses. u need an automated check (regex) to catch digits/email formats, or u’ll get flagged by safety bots for storing PII in your DataStore. ​Safety Tip: add a clear UI disclaimer: “Do not share personal info.” and implement a “Clear Data” button on your backend so you can instantly wipe a player’s history if they report themselves or abuse the system. :placard:

4 Likes
3

Okay thank you so much! I’ll implement that. I tend to get paranoid when it comes to stuff like PII, so I really appreciate the heads up. I should have thought about that kind of attack. Anyways, thank you @wiwkww92l2si2kwiwkwk ! Still looking out for more answers though.

3 Likes