Privacy Policy — BloxBoys

This Privacy Policy explains how Bloxboys Studios AB ("BloxBoys", "we", "us") collects and uses personal data when you visit bloxboys.com and its subdomains (the "Site"), play our mini-games under /play, submit to leaderboards, contact us, or purchase merch. We only collect what we need to run the Site and are committed to processing your data lawfully under the EU General Data Protection Regulation (GDPR).

1. Who we are

Bloxboys Studios AB · Org.nr 559531-0649 · VAT SE559531064901 · Sweden.
Contact: business@bloxboys.com

2. What we collect

2.1 When you just browse

Technical data: IP address, browser type, device type, referrer, and pages visited. Used to serve the Site and detect abuse.
Essential cookies: a small number of cookies required for the Site to function (e.g. cart contents on the merch shop).

2.2 When you sign in with Roblox

Roblox sign-in is optional. It is only required to submit a score to the global leaderboard and to display your Roblox avatar, display name and @username next to that score. We use Roblox's official OAuth 2.0 / OpenID Connect flow with PKCE. We never see or store your Roblox password.

BloxBoys Play is an independent third-party website and is not affiliated with, endorsed by, or sponsored by Roblox Corporation. Roblox sign-in is available only to eligible users aged 13 or older, as determined by Roblox's own account and parental-control settings.

Purpose limitation. In line with Roblox's Creator Third-Party App Policy, we use the Roblox identity only to (a) verify who submitted a leaderboard score and (b) display the minimum public identity information needed for that leaderboard entry. We do not build a behavioural profile of you, do not track you across services, and do not use Roblox data for advertising, analytics enrichment or resale.

Requested Roblox scopes: openid and profile only.
Roblox fields we retrieve and store:
- Roblox user ID (numeric) — internal link only.
- Roblox username (@handle) — shown on leaderboards.
- Roblox display name — shown on leaderboards.
- Roblox avatar headshot URL, cached from Roblox's public thumbnails API — shown on leaderboards and in the profile menu.
What we do NOT store or derive: Roblox email address, friends list, inventory, groups, private messages, Roblox access/refresh tokens, play time, XP or level for your Roblox account, daily streaks, games-played counters, cross-game behavioural statistics, activity feeds, or any public profile beyond the leaderboard entry itself. Roblox tokens are used once server-side during sign-in and are then discarded.
Internal account: we create a BloxBoys account tied to your Roblox user ID so that leaderboard entries stay attributed to you across current and future BloxBoys mini-games. This is not a public player profile.
Retention. Your Roblox link (user ID, username, display name, cached avatar URL) is retained while your BloxBoys account is active. When you disconnect Roblox or delete your account, the Roblox link and any associated leaderboard entries are deleted from our database. Cached avatar URLs and display names are periodically refreshed from Roblox's public APIs so they stay in sync.
How to disconnect or delete. Open the profile menu in the top-right of the Site (after signing in) and choose Disconnect Roblox, Delete my scores, or Delete my account. Deletion is immediate and cannot be undone. You can also email business@bloxboys.com and we will action the request.

2.3 When you play a mini-game

Your score, game session length, and game slug are stored so we can display leaderboards.
To prevent spam and cheating we compute a daily-salted, truncated hash of your IP address and store the hash only (never your raw IP). The salt rotates every 24 hours so the hash cannot be linked across days.
Personal bests are stored in your browser via localStorage. They never leave your device.

2.4 When you contact us or buy merch

Contact form / email: we process the name, email address, and message you send us in order to reply.
Merch checkout: orders are handled by Shopify. Payment, shipping and billing data are collected and processed by Shopify (and their payment providers) directly, subject to Shopify's own privacy policy. BloxBoys only sees order details necessary for fulfilment and support.

3. Analytics and advertising

Google Analytics: we use Google Analytics to understand aggregated site usage (pageviews, popular releases, referrer sources). IP addresses are anonymised where the setting is available.
Google AdSense: ads on the Site are served by Google AdSense (publisher ID ca-pub-8673564061594515). AdSense uses cookies and similar technologies to serve ads based on your visits to this and other websites. You can opt out at adssettings.google.com and youradchoices.com.
Third-party embeds (Spotify, YouTube, Shopify) may set their own cookies subject to their own policies when you interact with them.

4. Legal basis

Contract — running your account, delivering merch orders, answering support requests.
Consent — Roblox sign-in, non-essential cookies, marketing emails. You may withdraw consent at any time.
Legitimate interest — protecting the Site from abuse, preventing cheating on leaderboards, basic aggregated analytics.
Legal obligation — accounting records for merch sales.

5. Data retention

Leaderboard entries: kept until you delete them or your account.
Roblox account link: kept while your account is active. Deleted when you disconnect Roblox or delete your account.
OAuth handshake state: automatically deleted after 10 minutes.
IP hashes on scores: rotated every 24 hours via the salt.
Order data: retained as required by Swedish accounting law (7 years).

6. Your rights

Under GDPR you have the right to:

Access, correct, or delete your personal data.
Object to or restrict processing.
Request data portability.
Lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

You can self-serve most of these directly in the profile menu (top-right of the Site) after signing in:

Disconnect Roblox — removes the link between your BloxBoys account and Roblox.
Delete my scores — removes all leaderboard entries tied to your account.
Delete my account — permanently removes your BloxBoys account, Roblox link, profile, and all leaderboard entries.

For any other request, email business@bloxboys.com.

7. Sharing your data

We do not sell your personal data. We share data only with:

Roblox Corporation — only during the OAuth sign-in flow, on your explicit consent.
Shopify — for merch orders and payment processing.
Google — for Analytics and AdSense.
Our hosting and infrastructure providers — bound by data processing agreements.

8. Children

BloxBoys is inspired by Roblox and we know younger players enjoy our music. The Site itself is not directed at children under 13, and Roblox's own age and parental-control settings determine whether a Roblox account can authorise third-party apps. If Roblox blocks the sign-in, you can still play as a guest with a local personal best. Parents or guardians may contact us to review or delete their child's data.

9. Security

OAuth client secrets, service keys and access tokens are stored server-side and are never exposed to the browser. Authorization Code + PKCE, single-use state tokens and CSRF protection are used for Roblox sign-in.

10. Changes

We may update this policy. Material changes will be highlighted on this page. See also our Terms of Service.