Safety
Is RoCode safe?
The short answer
Yes, within clear limits. RoCode never asks for your Roblox password and never uploads your place file. Its Studio plugin connects only to RoCode's own server at relay.rocode.app, has no code to publish your place or spend Robux, and every batch of changes is an undo point in Studio. Payment runs in Paddle's checkout, and any payment can be refunded in full within 14 days.
Checked 29 October 2026 against RoCode's docs, privacy policy and the current Studio plugin.
RoCode changes the place you have open in Roblox Studio, so it is fair to ask what it can reach. This page puts the answers in one place: what Studio asks when you install the plugin, what the plugin can and cannot do, where your data goes, how you pay, and how to disconnect or remove it. The docs have every detail.
| Your Roblox password | Never asked for. You sign in to RoCode with an email code, Google, Discord or Roblox, and RoCode has no passwords of its own. Sign in with Roblox goes through Roblox's own sign-in page. |
|---|---|
| Your place file | Never uploaded, and there is no background sync. The plugin sends back only the results of the steps a run asks for, which can include full script text. |
| Where the plugin connects | Only to RoCode's server at relay.rocode.app, over an encrypted connection. Studio itself contacts Roblox to load the Creator Store models RoCode places. |
| Publishing and Robux | The plugin has no code to publish or save your place, upload assets or spend Robux. You publish from Studio. |
| Taking changes back | Each batch of changes is an undo point in Studio (Ctrl+Z). Deletes go to a RoCodeTrash folder in ServerStorage (plugin 3.8.5 or newer). |
| A look-only mode | Ask mode answers questions about your game with reading tools only, and RoCode's server refuses any tool that would change your place. |
| Payments | Paddle runs checkout as the merchant of record and is the seller on your receipt. RoCode does not store card details. |
| Refunds | In full within 14 days of any payment, including renewals and credit packs. |
| Who runs it | A sole trader in the United Kingdom, trading as RoCode (see the Terms). Email support@rocode.app. |
| Age | 13 or older. Under 18, you need a parent or guardian's permission, and the cardholder's before you buy. |
Install
What Studio asks when you install the plugin
The plugin is free on the Roblox Creator Store (opens in a new tab). When you press Set up in the RoCode panel, Studio asks you to allow two things. You can change both later for RoCode AI in Plugins > Manage Plugins.
| Permission | What it allows | If you say no |
|---|---|---|
| HTTP requests to relay.rocode.app | The plugin's connection to RoCode's server, the only host it talks to. The steps of each run arrive through it, and their results go back. | Nothing can connect. Allow it for RoCode AI in Plugins > Manage Plugins. |
| Script Injection | Lets RoCode create and edit Scripts, LocalScripts and ModuleScripts in your place. | RoCode will not start a Build run (plugin 3.9.2 or newer). Ask mode still works. Turn it on for RoCode AI in Plugins > Manage Plugins. |
The script that comes and goes in ServerStorage. Every 30 seconds the plugin adds a script named RoCodePermissionCheck to ServerStorage and removes it straight away. Studio only refuses Script Injection at the moment a script is put into the place, so this is how the plugin checks that it may still create and edit scripts. The script holds a single comment and never runs.
Connecting your account. With plugin 3.9.13 or newer, Studio connects by itself when it is signed in to the same Roblox account you use on RoCode: while it pairs, the plugin sends the Roblox user id and name Studio is signed in with, and Studio looks up that name from Roblox. Otherwise the plugin shows a one-time 8-character code that expires after 15 minutes, and Studio asks you to confirm the account.
Your game and data
What RoCode can reach, and where it goes
It can
- Read any object or script in the place open in the one connected Studio window, when a step of a run asks. Each run also starts with your camera position and up to 8 selected objects.
- Create, edit and delete objects and scripts in that place in Build mode. It deletes only what it made in that chat or what you ask it to remove.
- Press Play for a short playtest in Build mode (plugin 3.9 or newer). A playtest runs your place's scripts like any Play test.
- Take screenshots of what a Build run built, in edit mode, to check how it looks (plugin 3.9.14 or newer). RoCode does not store them.
- Place free Creator Store models it finds by searching with your words, or a model, decal or mesh from an asset ID you give. It removes any scripts inside a model.
It cannot
- Read your Roblox password or upload your place file.
- Publish or save your place, upload assets or spend Robux.
- Change your experience's settings on Roblox's website, or turn on Studio Access to API Services for you.
- Reach any server except relay.rocode.app from the plugin's own code.
- Change anything in Ask mode, which uses reading tools only and never runs a playtest.
Where your requests go. What a run reads goes through OpenRouter to a company hosting the model that runs your request: the one you picked, its backup, or, for a message with images, a model that reads them. RoCode has no models of its own.
What is stored. Your chats, so you can pick up later, stay until you delete them. Run records (tool names, object paths, error messages and partial replies) stay until you delete your account. If you add your own OpenRouter key on a paid plan, it is encrypted with AES-256-GCM before it is stored. The Privacy Policy lists every service that processes your data.
Playtests and data stores. If you turned on Studio Access to API Services, Studio uses the same data stores as the live game, so Roblox recommends doing that only in a separate test copy of your place.
Your control
How to disconnect, remove RoCode or delete your data
- Undo a change. Press Ctrl+Z (Cmd+Z on Mac) in Studio. Each press steps back one batch, and a run is usually several batches. Deleted objects wait in ServerStorage > RoCodeTrash, which keeps the deletes of the 30 most recent runs.
- Disconnect every Studio. Press Disconnect Studio in the chat. It signs out every Studio connected to your account.
- Sign out one Studio. Sign out in the RoCode panel deletes the connection key saved in that Studio. It does not revoke the key itself, so use Disconnect Studio for that.
- Stop the plugin connecting. Once paired, the plugin reconnects in any place you open on that computer. Disable or remove RoCode AI in Plugins > Manage Plugins. On a shared computer, disable it when you are done.
- Remove your own key. If you added an OpenRouter key on a paid plan, you can remove it at any time.
- Delete your account. From your account page. It cancels your subscription right away, then deletes your profile, chats, messages, keys and run records. Billing records needed for refunds and chargebacks are kept, along with per-run usage records under your old account ID and usage analytics with your account ID removed.
Payments
Paying, and getting your money back
The Starter plan is free with no card: 1 credit a day, refilled at 00:00 UTC. When you pay for a plan or a credit pack, you enter your card in Paddle's own checkout, not on a RoCode form. Paddle is the merchant of record: it takes the payment, handles sales tax or VAT, issues the invoice and is the seller on your receipt. RoCode does not store card details.
Any payment, including renewals and credit packs, can be refunded in full within 14 days, for any reason. Ask at paddle.net or by replying to your Paddle receipt. Cancel from your account page and you keep your plan to the end of the paid period. See plans and prices.
Check for yourself
What you can check outside this site
- The Creator Store listing. The plugin is listed as RoCode AI and is free. On 29 October 2026, 78% of its 300 votes were positive (234 up, 66 down), and it was last updated on 27 October 2026. See the listing (opens in a new tab).
- Studio's own prompts. Studio, not RoCode, shows the permission prompts above, and Plugins > Manage Plugins shows what RoCode AI is allowed to do.
- Older posts. Forum posts and listings from before October 2026 describe an earlier RoCode. What changed lists the differences, and What RoCode can't do answers the common complaints.
- The right RoCode. RoCode (rocode.app) is not Roo Code, the VS Code extension, and not RoCodes.gg or rocode.org. It is an independent product, not made by Roblox.
Questions about safety? Ask in the RoCode Discord (opens in a new tab) or email support@rocode.app.
FAQ
Questions
Is RoCode safe to use?
Yes, within clear limits. RoCode never asks for your Roblox password and never uploads your place file. Its Studio plugin connects only to RoCode's own server at relay.rocode.app, has no code to publish your place or spend Robux, and every batch of changes is an undo point in Studio. Payment runs in Paddle's checkout, and any payment can be refunded in full within 14 days.
Does RoCode need my Roblox password?
No. RoCode never asks for your Roblox password and has no passwords of its own. You sign in with an email code, Google, Discord or Roblox, and Sign in with Roblox goes through Roblox's own sign-in page. Never paste your Roblox password or cookie into any site, plugin or chat.
Can RoCode publish my game or spend my Robux?
No. The plugin has no code to publish or save your place, upload assets or spend Robux, and it cannot change your experience's settings on Roblox's website. You publish from Studio yourself.
Why does a script called RoCodePermissionCheck keep appearing in ServerStorage?
Every 30 seconds the plugin adds a one-line script there and removes it straight away. Studio only refuses Script Injection when a script is put into the place, so this is how the plugin checks that it may still create and edit scripts. The script holds only a comment and never runs anything.
Can I undo what RoCode changed?
Yes. Each batch of changes is an undo point in Studio, so Ctrl+Z (Cmd+Z on Mac) steps back one batch at a time while Studio is open. With plugin 3.8.5 or newer, deleted objects go to a RoCodeTrash folder in ServerStorage instead of being destroyed.
How do I disconnect or remove RoCode?
Disconnect Studio in the chat signs out every Studio connected to your account. To stop the plugin connecting at all, disable or remove RoCode AI in Plugins > Manage Plugins in Studio. Deleting your account from your account page cancels your subscription and deletes your profile, chats, messages, keys and run records.
Is RoCode made by Roblox?
No. RoCode is an independent product. Its free plugin is on the Roblox Creator Store, but RoCode is not affiliated with, endorsed by or sponsored by Roblox Corporation.
Sources
RoCode's docs, privacy policy, terms, RoCode facts and pricing page, and the RoCode AI listing on the Roblox Creator Store, checked 29 October 2026. RoCode wrote this page about its own product.
Try RoCode on a copy of your place.
Free every day, no card required. Start in Ask mode to look around your game before you let Build change it.
No card required. Get the Studio plugin (opens in a new tab)