Privacy Policy

Who this policy applies to

The Service involves two groups of people, and our role differs for each:

• Account holders (developers) — the people who create a BloxTools account and use the dashboard. For their account data, we act as a controller.
• Players — the end users of a developer's Roblox experience, whose reports and errors are sent to us through that developer's installation of BloxTools. For this data, the developer is the controller and BloxTools acts as a processor, handling the data on the developer's instructions.

If you are a player and have a question about data collected from a specific experience, the developer of that experience is your first point of contact; we will support them in responding.

Information we collect

Account data (developers). When you create an account, we collect your name, email address, and an authentication credential. Authentication and credential storage are handled by our authentication provider, Supabase; we never receive or store your plaintext password. If you subscribe to a paid plan, our payment processor collects and processes your billing details — we receive limited information such as a subscription status, plan, and the last four digits of a card, but not your full card number.

Data submitted through the SDK (players). When a developer installs BloxTools in their experience, our SDK transmits report and telemetry data to us. Depending on how the developer configures it, this may include: the report category and message text; the reporting player's Roblox user ID, username, and display name; the place ID and place version; device and platform details; performance and diagnostic metrics; recent client log lines; and error and crash messages with stack traces. Timestamps and server/session identifiers are attached to this data.

Automatically collected data. Like most online services, we collect standard server logs — including IP address, request timestamps, user-agent, and request metadata — to operate, secure, and troubleshoot the Service.

Cookies. We use strictly necessary cookies to keep you signed in and to protect the Service. We do not use advertising cookies or third-party analytics that track you across other sites. See "Cookies" below.

Communications. If you email us or contact support, we keep those messages and the information you choose to include in them.

How we use information, and our legal bases

We use personal data for the following purposes:

• To provide the Service — creating your account, ingesting, de-duplicating, storing, and displaying reports, errors, issues, and analytics. Legal basis: performance of a contract.
• To deliver the alerts and integrations you configure, such as a Discord webhook. Legal basis: performance of a contract.
• To secure the Service, prevent fraud and abuse, maintain reliability, and debug problems. Legal basis: our legitimate interests.
• To communicate with account holders about their account, service changes, and support. Legal basis: performance of a contract and legitimate interests.
• To process payments and manage subscriptions. Legal basis: performance of a contract.
• To comply with legal obligations and enforce our Terms. Legal basis: legal obligation and legitimate interests.

Where we act as a processor for player data, we process it only to provide the Service to the developer and on their documented instructions. We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use it to build advertising profiles.

Cookies

We use only cookies that are essential to the Service — principally the session cookies set by our authentication provider to keep you signed in, and cookies used to protect against abuse. Because these cookies are strictly necessary to deliver a service you have requested, they do not require consent. We do not set marketing or cross-site tracking cookies. You can block cookies in your browser, but the dashboard will not function correctly without the session cookie.

How we share information

We do not sell personal data. We share it only in these circumstances:

• Service providers (subprocessors). We use a small number of vendors to run the Service, each bound by contract to protect the data and use it only to provide services to us. Our current subprocessors are: Supabase (database, authentication, and file storage), our cloud hosting provider, and, once paid plans are available, our payment processor.
• Integrations you enable. If a developer enables a Discord webhook, alert summaries are delivered to the Discord channel they configure. Data sent to a third-party integration is then governed by that third party's terms and privacy policy.
• Legal and safety. We may disclose data if required by law, to respond to lawful requests, or to protect the rights, safety, and property of BloxTools, our users, or the public.
• Business transfers. If the Service is transferred to another owner (for example, through a sale of assets), data may be transferred as part of that transaction, subject to this policy.

International data transfers

BloxTools is operated from the United States, and our subprocessors may process data in the United States and other countries. If you are located in the European Economic Area, the United Kingdom, or another region with data-transfer restrictions, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses — for transfers of personal data out of your region. You may contact us for more information about these safeguards.

How long we keep data

Report, error, and analytics data is retained according to the developer's plan — for example, the free plan retains data for a limited rolling window, after which older data is deleted. Account data is retained for as long as your account is active. Server logs are kept for a limited period for security and debugging. When you delete your account, your games and all associated reports, errors, issues, and analytics are permanently deleted, except where we are required to retain certain records to comply with law, resolve disputes, or enforce our agreements. Account holders can delete their account at any time from Settings.

Security

We protect data using industry-standard measures. Data is encrypted in transit using TLS. Passwords are hashed by our authentication provider. Access to production systems and data is restricted to those who need it and is protected by authentication controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and any regulators as required by applicable law.

Children and Roblox players

The Roblox platform is used by people of all ages, including children under 13. We take this seriously.

• The developer who installs BloxTools decides what data their experience sends and is the controller of that player data. BloxTools processes it on the developer's behalf.
• Developers are responsible for complying with the laws that apply to them — including the Roblox Terms of Use, the Children's Online Privacy Protection Act (COPPA), the EU and UK GDPR (including provisions on children's data), and any other applicable law — and for obtaining any consent required before sending player data to BloxTools.
• We ask developers to send only the player data they need and never to send special categories of data. We do not knowingly use player data to build advertising or tracking profiles, and we do not knowingly collect personal data directly from children through our own website or dashboard.
• If you believe a child's personal data has been sent to us and should be removed, contact us or the developer of the experience, and we will work to delete it.

Your privacy rights

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access, correction, and deletion of the personal data we hold about you.
• Portability — receiving a copy of certain data in a usable format.
• Restriction and objection to certain processing, and the right to withdraw consent where we rely on it.
• Non-discrimination for exercising your rights, and the right to appeal a decision where applicable law provides one.
• The right to lodge a complaint with your local data protection authority.

Account holders can view and edit their profile and delete their account directly in Settings. For any other request, contact us at privacy@bloxtools.io. We may need to verify your identity before acting. If your request concerns player data that a developer sent to us, we will refer you to, or coordinate with, that developer as the controller.

California residents. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, and we do not use or disclose sensitive personal information beyond the purposes permitted by that law. You may exercise your rights to know, delete, and correct as described above.

Data processing for developers

Where BloxTools processes player data on your behalf as a developer, that processing is also governed by our Terms of Service, which include our commitments as a processor. If your organization requires a separate Data Processing Addendum, contact us at privacy@bloxtools.io.

Relationship to Roblox

BloxTools is an independent tool and is not affiliated with, endorsed by, or sponsored by Roblox Corporation. Your use of the Roblox platform is governed by Roblox's own terms and privacy policy, which we do not control.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above, and for material changes we will provide additional notice where required. Your continued use of the Service after an update takes effect means you accept the revised policy.

Contact us

For any privacy question or request, contact us at privacy@bloxtools.io. BloxTools is operated by an individual sole proprietor based in Illinois, United States.