What Bloxstack collects, why, who else sees it, and how to get it deleted. Short version: less than you would expect, and none of it is sold.
This policy explains how Bloxstack ("Bloxstack", "we", "us") handles personal data on bloxstack.app. It forms part of our Terms of Service.
A2Z Labs Inc., a Delaware C corporation, operates Bloxstack and is the controller of the data described here. For anything in this document, including a request to access or delete your data, write to [email protected].
We do not sell your personal data, we do not share it with advertisers, and we run no advertising or analytics trackers on the site.
1.1This policy covers the Bloxstack website and the services we operate on it, for members and for signed-out visitors.
1.2It does not cover Roblox. Your Roblox account is governed by Roblox’s Privacy Policy, and Roblox decides what it does and does not tell us about you. It also does not cover a third-party site you reach from a link on Bloxstack, including a link another member posts.
2.1Everything we hold about you falls into one of these rows.
| Data | Where it comes from |
|---|---|
| Roblox user id, username, display name, avatar image | Roblox, at sign-in, from the `openid profile` scope you approve. The user id is the permanent anchor of your account; the rest refreshes when you sign in again. |
| Roblox access and refresh tokens | Roblox, at sign-in. Held encrypted so we can refresh your linked identity. See §11. |
| Your profile | You. Handle, display name, headline, bio, crafts, rates, availability, showcase, banner, theme, and layout choices. |
| What you publish | You. Listings, briefs, applications, forum posts, comments, reviews, and endorsements. |
| Private messages | You and the members you talk to. Messaging is an adult-only surface; conversations are stored so both sides can read them. |
| Deal records | You and the other member. What was agreed, what was delivered, and the state of the engagement. |
| Sessions | Automatically, when you sign in: a session record with its IP address, browser user agent, and timestamps. You can see and revoke your active sessions in Settings. |
| Abuse and rate-limit counters | Automatically. Keyed by a keyed hash of the IP address rather than the address itself, so the counter works without our storing a readable IP for it. |
| Payment records | Stripe, when you buy or sell. Customer, checkout, subscription, and connected-account identifiers, plus what was bought and its state. We never receive or store your card number. |
| Recovery email address | You, and only if you choose to add one in Settings. A Roblox sign-in gives us no email, so an account created that way starts with a placeholder address that cannot receive mail. |
| Email address, for the founding cohort | You, if you sign in at /waitlist with an emailed link. Or Google, if you sign in with Google, in which case Google also tells us your name, your profile picture, and that the address is verified. See §3.5. |
| Your waitlist record | Your email address, the name you gave, when you joined, whether your account has claimed the spot, and whether you have unsubscribed. It includes people who joined the earlier Bloxstack waitlist before this version of the site existed. |
| Announcement mail records | Automatically, one row per announcement we send you, so the same message is never sent twice. It records the address it went to, whether it was delivered, and any error. |
| Notification preferences | You. Which notifications you want, and whether you want them by email. |
| Invite attribution | A first-party cookie set when you arrive through another member’s invite link, so their invite count is correct after you sign up. |
| Reports, appeals, and support messages | You, or the member reporting something, along with our moderation notes about the outcome. |
| Server logs | Automatically. Ordinary web-server and application logs used to keep the site running and to investigate faults and abuse. |
3.1We use Roblox as an OpenID Connect sign-in provider. When you approve Bloxstack on Roblox, we ask for two scopes and no others: `openid`, which tells us your account identifier, and `profile`, which gives us your username, display name, and avatar image.
3.2We never receive your Roblox password. We do not receive your Roblox email address, your age, your date of birth, your age bracket, your friends or followers, your inventory, your Robux balance, your presence, your private messages, or anything about the games you play.
3.3We do not write anything to your Roblox account, we cannot act on Roblox on your behalf, and we do not use the connection to read anything beyond the four fields above.
3.4You can disconnect Bloxstack from your Roblox account at any time from Roblox’s own authorised-applications settings. Doing so stops the connection; it does not by itself delete your Bloxstack account, which you can ask us to do under §10.
3.5Roblox is not the only door, and the exception is where an email address enters the picture. The founding-cohort page at /waitlist also accepts an emailed sign-in link, which gives us the address you type and nothing else, or a Google sign-in, in which case Google tells us your email address, your name, your profile picture, and that Google has verified the address. We ask Google for nothing beyond that, and we never receive your Google password. That address is what we use to match you to your waitlist spot and to send you the announcements described in §4.
4.1We use the data in §2 for these purposes and no others.
4.2Where the GDPR or a similar law applies to you, our legal bases are: performance of our contract with you (running your account, deals, and purchases); our legitimate interests (security, abuse prevention, keeping invite attribution honest, and improving the product); compliance with a legal obligation (tax, accounting, and lawful requests); and your consent, where we ask for it, which today means optional email notifications and the founding-cohort announcements and nothing else. Where we rely on legitimate interests, you may object under §10, and you can withdraw consent to the announcements from any one of them without contacting us at all.
7.1Bloxstack is operated from servers in Canada, and the providers in §6 operate in Canada, the United States, and the European Union. Using the Service therefore involves transferring your data across borders.
7.2Where a transfer is subject to the GDPR or United Kingdom data protection law, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where applicable) or on an adequacy decision, as offered by the provider concerned.
8.1Your account, profile, and published content are kept while your account exists.
| Data | Retention |
|---|---|
| Account, profile, posts, listings, messages | Until you delete them, or until your account is deleted. Erased from live systems within 30 days. |
| Sessions | Until they expire or you revoke them. |
| Waitlist record and announcement-mail rows | Kept while the founding cohort is live. Deleting your account releases the claim on your waitlist spot but does not erase the waitlist row, because the row predates the account. Say so in your request and we will take the address off the list entirely. |
| Rate-limit counters | Minutes to hours. They expire on their own. |
| Payment and transaction records | Kept for as long as tax and accounting law requires, typically seven years, even after account deletion. Stripe keeps its own records under its own policy. |
| Moderation records | Kept while needed to enforce a suspension or ban and to handle an appeal or a legal claim. |
| Server logs | Rotated on a short cycle in the ordinary course. |
8.2Encrypted backups may still contain deleted data until they rotate out in the ordinary course. We do not use a backup to restore something you asked us to delete.
9.1Bloxstack is a professional network for people who make things, and it is not directed to children under 13. You must be at least 13 to hold an account.
9.2If we learn that an account belongs to someone under 13, we delete the account and the data attached to it. A parent or guardian who believes a child under 13 has given us data should write to [email protected] and we will act on it promptly.
9.3Roblox does not tell third-party applications how old a user is, and we deliberately do not ask for that signal. Nowhere in the Service do we ask you for your date of birth. We hold no birthdate, no age, and no age bracket for you, which is why the rest of this section is written the way it is.
9.4Because we hold no age data, we cannot verify age, and we do not pretend to. The Terms restrict private messaging, hiring, selling, advertising, and anything involving money to members who are 18 or older, but today that is a rule enforced by moderators acting on reports, not an automated gate. There is one exception: Stripe runs a real identity and age check on anyone who receives money. If a parent has been told that Bloxstack technically separates adults from minors, this clause is the correction.
9.5If a member tells us they are under 18, or we otherwise learn it, we act on it by hand under the Terms: closing adult surfaces to that account and removing an adult who has sought private contact with a minor. When an age-verification provider is connected and the automatic band becomes active, we will update this policy before it takes effect, and the effective date at the top will tell you it changed.
9.6Because public pages are public, the safest posture for a younger member is the ordinary one: publish your work, never your contact details.
10.1Depending on where you live, you have some or all of these rights: to know what we hold about you and get a copy; to correct it; to have it deleted; to restrict or object to how we use it; to receive it in a portable format; and to withdraw a consent you gave us. Exercising a right never costs you anything and never worsens the service you get.
10.2Some of this is self-service today: your profile is editable in Settings, you can revoke sessions there, you can turn off email notifications there, and you can delete individual posts and listings yourself.
10.3A one-click account deletion is not built yet, and we would rather say so than let you find out. Until it ships, email [email protected] or ask through the support desk and a person will erase your account and the content attached to it within 30 days, keeping only what §8 says we must. The same address handles access, correction, portability, and objection requests, on the same timeline.
10.4We verify a request by requiring it to come from your signed-in account or from the recovery address on file. The alternative, handing your data to whoever asks, is worse than the friction.
10.5If you are in the European Economic Area or the United Kingdom you may complain to your local supervisory authority. If you are in California you may exercise your rights through an authorised agent. We would rather hear from you first, and usually resolve it faster.
11.1The site is served over HTTPS only. Session cookies are HTTP-only, and sensitive actions require a recent sign-in before they will run.
11.2The Roblox tokens we hold are encrypted before they are written, with the key held outside the database, so a database copy alone does not yield a usable token. We do not store passwords for the Service at all, because there are none.
11.3You can add two-factor authentication and review your active sessions in Settings. Because a Bloxstack profile is reached through the account that signs into it, securing that account (your Roblox account, or the Google account or mailbox you used at /waitlist) is the most important thing you can do for your Bloxstack account.
11.4Uploaded files live in private storage and are reachable only through short-lived signed links. No storage bucket is publicly listable.
11.5No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify you and the relevant authorities as the law requires. If you find a vulnerability, report it to [email protected] rather than exploiting it, and we will not pursue you for a good-faith report.
12.1Ordering on Bloxstack is automated and, at the moment, plain: search results are ranked by how well the text of your profile matches the query, then by recency; directories and listings are ordered by recency or by the sort you pick. Endorsements and delivery record are shown on a profile, but they do not currently move you up a results page. Ordering affects visibility, not rights, and it is not a decision with a legal or similarly significant effect on you.
12.2Enforcement decisions that do affect your account (removal, suspension, termination) are made or confirmed by a person, and are appealable under the Terms.
13.1We update this policy when what we do changes. The effective date at the top always tells you which version is current.
13.2If a change materially affects how we use data we already hold, we will give notice before it takes effect, and will ask for consent where the law requires it.
14.1Privacy questions, data requests, and anything else in this document: [email protected].
14.2Account problems, reports, and appeals are handled faster through the support desk, by the same people.