Security & privacy

What Lurelock does with your data

Short version: by default nothing leaves your machine except what Roblox itself needs; the optional analytics toggle is the only other channel, and it stays off until you flip it.

• Local only. Settings, flags, mods, logs and caches are stored under %LOCALAPPDATA%\Lurelock\.
• Network calls, the honest list: Roblox CDNs (to download and update Roblox), and GitHub (to check for updates and read release notes when you open the changelog). The in-app "analytics" toggle is disabled by default; if you enable it, it sends a small anonymous event log (app version, launches, error reports) to the Lurelock maintainers, never anything personal.
• No accounts, no forced telemetry, no ads. There is no backend to sign in to.

You can audit every network request yourself — it's MIT open source.

Launch lock (password gate)

The Security page lets you require a password before Lurelock will launch Roblox — handy for shared PCs and for keeping the client from being started while you're away.

• Only the hash of the password is stored in Settings.json; the plaintext is never written.
• Opening the settings window (Lurelock.exe -settings) is never blocked by the lock — so you can always go in and remove it.

Verifying your download

Every release note on GitHub lists the SHA256 of the exe asset. Verify after downloading:

certutil -hashfile Lurelock.exe SHA256

It should match the value shown on the release. Signed builds aren't offered (code-signing certs cost money); hash checks + HTTPS do the job.

Threat notes

Because Lurelock is a bootstrapper, it's a juicy target for fake "Bloxstrap/Lurelock installers" that ship malware. Only ever download from lurelock.pages.dev or the official GitHub releases page, and check the hash. More detail: Security page.

Back to wiki index