“No analytics or tracking by default.”
The repository also calls Luczystrap offline-first and says network calls are limited. This is the developer’s published intent, not a field-by-field privacy disclosure.
Privacy map · versioned evidence
Know where your data can go.
Luczystrap is designed as a local-first Windows bootstrapper, but “local-first” is not the same as “no network traffic.” This page maps local storage, optional integrations, historical endpoints, and what remains unverified in release 1.4.9.
Direct answer: historical code shows analytics disabled by default, while core operations and optional features can still contact external services. Because the current application source and a clean 1.4.9 traffic capture are not public, I do not claim zero telemetry, zero collection, or complete offline operation.
Privacy manifest5 surfaces
LUCZYSTRAP
ON WINDOWS
ON WINDOWS
ROBLOX
GITHUB
& CDN
& CDN
DISCORD
IPINFO
ROVALRA
ROVALRA
Diagram, not a packet capture. Destinations shown are established from documentation or historical public code. Exact 1.4.9 traffic remains an open verification task.
01 / Reading the claim
Three statements. Three evidence levels.
A privacy promise, a historical implementation, and current binary behavior are different facts. Combining them would produce a confident answer the evidence cannot support.
Analytics defaulted to false.
The same settings model enabled activity tracking and Discord Rich Presence by default, while optional server data features called ipinfo.io and RoValra. “Analytics off” did not mean “all network features off.”
Exact behavior is not reproducible.
The current app source is absent. There is no public endpoint inventory, event schema, retention schedule, clean traffic capture, or source-to-binary build proof for 1.4.9.
02 / Interactive data map
Select a feature. Follow its data.
Each route separates what may stay on your PC, what may leave it, the best available control, and the version of the evidence. Choose a feature to inspect its privacy surface.
Feature or operation
Core launch and update checks
Luczystrap keeps settings, state, logs and downloaded components on Windows. Installing or updating Roblox and checking Luczystrap releases requires network services even when analytics is disabled.
On this PCSettings, state, logs, cache, mods, Roblox installation data
External routeRoblox services/CDN and GitHub release infrastructure
03 / Evidence ledger
Known history. Open present.
This is a disclosure page, not a substitute for a formal legal privacy policy. It names confirmed historical behavior and keeps current unknowns visible until they are answered with reproducible evidence.
Established from public evidence
Verifiable- Local data exists. Documentation names portable and installed config paths plus a local logs path.
- Analytics default was false in 1.3. The Settings model exposes
EnableAnalytics = false. - Network-dependent core work exists. Roblox installation/update and GitHub release checking require remote services.
- Optional integrations expanded the data surface. Historical code used Discord RPC, ipinfo.io and RoValra.
- Account Switcher handled a session secret. It validated and stored
.ROBLOSECURITYin historical 1.3 code. - 1.4.9 is not source-verifiable. The application folder contains only an “open sourcing is closed for now” marker.
Not established for release 1.4.9
Needs answer- Current endpoint and field inventory. No clean install/launch/play/update traffic capture has been published.
- Analytics mechanics. No event schema, destination, consent screen, retention period, or deletion method is documented.
- Discord webhook purpose. One automated report flagged an embedded webhook token; purpose, trigger and payload are unconfirmed.
- Current account handling. Storage format, cookie use and log redaction have not been demonstrated for 1.4.9.
- Retention and deletion. There is no owner-published schedule for logs, diagnostic bundles, server data or remotely received data.
- Plugin isolation. The SDK does not document a permission model or sandbox boundary.
04 / Data and controls
What changes when a feature is on.
The matrix is deliberately versioned. “Historical” means the route was found in tag 1.3; it does not silently claim that closed-source 1.4.9 behaves identically.
| Feature | Data or context | Destination / storage | Best control | Evidence |
|---|---|---|---|---|
| Settings, mods and logs | Configuration, feature state, diagnostic messages and local assets | Documented portable folder, AppData config and LocalAppData logs | Keep diagnostic bundles private; remove local data only when no longer needed | README |
| Analytics | Exact events and identifiers are not documented | Current destination unknown | Leave analytics disabled; verify after every update | 1.3 default only |
| Discord Rich Presence | Experience, creator, server type, session time, images; optional account and join context | Discord desktop RPC / Discord | Disable Rich Presence, account display and join buttons | 1.3 source |
| Server location | Roblox server IP address; city, region and country response | ipinfo.io and local runtime cache | Leave server details/location off | 1.3 source |
| Server uptime | Place ID and server/job ID; first-seen estimate | RoValra endpoints and local runtime cache | Leave server uptime off | 1.3 source |
| Historical Account Switcher | Session cookie, user ID, username, display name, avatar URL | Local settings protected with Windows DPAPI; Roblox APIs for validation | Do not paste the cookie; use Roblox’s official web Account Switcher | Sensitive · 1.3 |
| Plugins and custom integrations | Whatever executable third-party code can access with the process permissions | Plugin-defined local or remote destination | Install only inspected code; remove anything you cannot verify | No sandbox proven |
Privacy control is feature-specific. Disabling analytics does not disable updates, Roblox traffic, a user-enabled integration, or network access performed by third-party plugin code.
05 / Minimum-sharing setup
Start with the smallest surface.
There is no verified “privacy mode” switch that controls every data path. Minimize exposure by enabling one capability at a time and treating integrations, account tools, plugins and diagnostic bundles as separate decisions.
Do not block all traffic blindly. Roblox installation, updates and play need network access. The goal is to remove optional routes while preserving the operation you intentionally requested.
Use the core launcher only
Begin without plugins, custom integrations, Account Switcher or server enrichment.
Leave analytics disabled
Confirm the setting after installation and after upgrades; a historical default is not permanent proof.
Disable activity and Discord fields you do not need
Turn off Rich Presence, account display, join buttons, server details and uptime independently.
Do not enter .ROBLOSECURITY
The core launcher does not require your Roblox session cookie. Prefer Roblox’s official switcher.
Treat plugins as programs
Inspect author, source, release and network behavior before loading executable code.
Verify the current build, not only tag 1.3
A clean Windows capture across install, idle, update, launch and play is still required for the 1.4.9 endpoint inventory.
06 / FAQ
Privacy answers without absolutes.
Every answer names the version boundary. That is more useful than repeating “private,” “offline,” or “safe” without defining the data, destination and control.
A complete current answer is not yet verifiable. Historical 1.3 code stored settings, logs and optional account data locally and made feature-dependent requests to Roblox, GitHub, ipinfo.io, RoValra and Discord-related components. The current 1.4.9 application source and a clean network capture are not public, so this page does not promise zero collection.
No complete offline guarantee can be supported. The README describes Luczystrap as offline-first and offline-friendly, but installation, Roblox updates, version checks and some integrations depend on network services. Offline-first is a design goal, not proof of zero network traffic.
The public 1.3 Settings model set EnableAnalytics to false by default, and the current README says no analytics or tracking by default. The event schema, destination, retention, consent flow and exact 1.4.9 behavior are not publicly documented, so disabled-by-default is the strongest supportable statement.
Historical public code contains requests to Roblox services and CDN, GitHub, ipinfo.io for server location, RoValra for server uptime and Discord Rich Presence components. The exact 1.4.9 endpoint list still requires a clean network capture; see the integration evidence map for feature-level detail.
The core launcher does not need it. Historical 1.3 Account Switcher code optionally requested the cookie, validated it with Roblox, encrypted the saved value with Windows DPAPI for the current user and logged a short plaintext preview when applying it. Current 1.4.9 behavior is not verifiable, so I recommend that you do not paste a session cookie into the app.
Historical code could publish the experience, creator, server type, session timing, images and optional account identity or join buttons through Discord Rich Presence. Disable Rich Presence and account display if you do not want gameplay context shown to Discord contacts.
A plugin is executable code running with the permissions of its host process. The public SDK does not establish a permission sandbox. Review the exact plugin source and release before installing it, and assume it may access files or the network until proven otherwise.
Use the core launcher only; leave analytics, activity tracking, Discord Rich Presence, account display, server details, server uptime, Account Switcher, plugins and custom integrations off unless you need them. Keep the network access needed for the chosen operation, then verify the current build with a clean traffic capture.
07 / Evidence
Sources you can inspect.
Official documentation and public code establish product claims and historical implementation. Automated binary analysis is labeled separately and never treated as proof of collection.
Official repository · currentREADME privacy, offline and storage claims
↗Official release · Nov 5, 20251.4.9 binary, remote-data and updater context
↗Public source · tag 1.3Analytics, activity, Discord and server-feature defaults
↗Public source · tag 1.3ipinfo.io and RoValra request fields
↗Public source · tag 1.3Historical Discord Rich Presence implementation
↗Public source · tag 1.3Historical cookie validation, DPAPI storage and logging
↗GitHub issue · Nov 24, 2025RoValra developer identifies Luczystrap API use
↗Repository state · currentCurrent application source closure marker
↗Automated analysis · same 1.4.9 SHA-256Webhook signal requiring maintainer explanation
↗Luczystrap transparency hubCurrent source and reproducibility boundary
→Luczystrap integration hubDiscord, location and uptime controls
→Luczystrap account guidanceAccount switching and session-cookie boundary
→Checked August 5, 2026. “Current” refers to the latest published Luczystrap release found during review: 1.4.9, published November 5, 2025. This page describes technical evidence and user controls; it is not a contractual privacy notice and does not invent a controller, retention period, or deletion right that the project owner has not yet published.