Privacy policy

Who we are

BloxIQ ("we", "us") provides research and analytics tools for creators on the Roblox platform. We are the controller of personal data processed through the BloxIQ website, web app and browser extension. BloxIQ is not affiliated with Roblox Corporation. Contact details for privacy matters are at the end of this policy.

Summary

• We collect what we need to run your account and provide the service, and nothing about your Roblox password or cookies.
• Public game data we collect is about games, not about you.
• Data you import or connect about your own games is private to your account.
• You can export or delete your data at any time.

Data we collect

Account data

• Email address, a hashed password (we never store it in plain text), display name, and whether your email is verified.
• Account role and plan, onboarding answers (role, genres, goals) and preferences (theme, feed frequency, notification settings).
• Session records: a hashed session token, approximate creation and last-seen times, and the browser user-agent, so you can review and sign out of sessions.

Content you create

Watchlists, competitor groups, research notes, saved searches, alerts, ideas and idea versions, optimisation drafts, uploaded images (icons, thumbnails), release and experiment journal entries, AI coach conversations, and support messages.

Usage and technical data

• A usage ledger of metered actions (for example AI requests and exports) so we can enforce plan limits and show your usage.
• Product events (for example "idea generated") to understand which features are used. These are linked to your account and are not sold or used for advertising.
• Security logs (audit entries for sensitive actions, with IP address) and rate-limit counters.

Billing data

If you subscribe, payment is handled by Stripe. We receive and store a customer reference, subscription status, plan and renewal dates. We never receive or store your full card number.

Public game data (not personal data about you)

We collect public information about Roblox experiences (name, description, icon, player counts, visits, favourites, votes, creator name and type) from Roblox's public endpoints, with timestamps. Creator names may identify individual Roblox users; we show only the public name, the verified-badge flag and associated public experiences. We do not build profiles of individual players. See the takedown page to request correction or removal.

Roblox account connection (OAuth)

Connecting your Roblox account is optional. It uses Roblox's official OAuth 2.0 flow with PKCE. We request only the openid and profile scopes, which give us your Roblox user ID, username and display name, so we can associate games you own with your BloxIQ account. If we ever need additional scopes (for example to read owner analytics where Roblox offers them), we will show the scopes on the consent screen and ask you again; we will not expand access silently.

• OAuth tokens are encrypted at rest (AES-GCM) and used only to call Roblox on your behalf for the purposes you approved.
• You can disconnect at any time in Settings. Disconnecting stops syncing immediately and deletes stored tokens.
• We never ask for your Roblox password or .ROBLOSECURITY cookie.

Imported analytics (CSV)

If you import metrics about your own games (for example retention or revenue exported from Roblox's creator dashboard), that data:

• is visible only to your account (and your team workspace, if you choose to share it there);
• is labelled "user-supplied" or "owner data" wherever it appears;
• is never shown on public pages, used in rankings, included in other users' research, or used to train AI models.

You can delete imports at any time.

Browser extension

The BloxIQ Chrome extension:

• reads the URL of supported roblox.com pages to obtain the place ID, and sends that ID to the BloxIQ API to fetch a scorecard;
• stores your settings and an extension session token in extension storage;
• does not request the cookies permission, does not access other websites, does not read page content, messages or anything you type, and does not inject your token into Roblox pages;
• sends anonymous diagnostics (error counts, load times) only if you opt in.

Requests the extension makes count towards your plan limits and are logged like other API requests. Uninstalling the extension removes its local data.

AI features

When you use the AI coach or idea generation, the text you submit, together with an evidence packet of relevant BloxIQ data (for example game statistics you are allowed to see), is sent to our configured AI provider to generate a response. We use providers under terms that do not permit them to train models on this data. We store your conversations so you can return to them; you can delete them at any time. Owner data is included only for your own games and only in your own requests.

Why we use your data (legal bases)

Children

BloxIQ is intended for users aged 13 and over. If you are under the age of digital consent in your country (for example under 13 in the US, or under 13–16 in parts of Europe and the UK depending on local law), you must have permission from a parent or guardian, and some features may be unavailable. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it. We do not use personal data for targeted advertising, and we do not profile players of Roblox games.

Who we share data with

We use service providers (processors) to run BloxIQ, bound by contracts that limit their use of data:

• hosting and database providers;
• Stripe (payments);
• an email delivery provider (account and notification emails);
• an AI model provider (AI features, as above);
• Roblox (only when you connect via OAuth, and only the requests needed for the features you use).

We do not sell personal data. We may disclose data if required by law or to protect the rights and safety of users. Some providers may process data outside the UK/EEA; where they do, we rely on appropriate safeguards such as standard contractual clauses.

How long we keep data

These periods are drafts and will be confirmed before general availability.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. To exercise them:

• Export: download your account data from Settings in the app.
• Deletion: delete your account from Settings, or ask us to.
• Everything else: use the contact form and choose "Privacy / data-subject request".

We will respond within one month and may need to verify your identity. You also have the right to complain to your data protection authority (in the UK, the Information Commissioner's Office).

Security

We use encryption in transit (HTTPS), hashed passwords, encrypted OAuth tokens, scoped access controls, CSRF protection, rate limits and audit logging. No system is perfectly secure; if we become aware of a breach affecting you we will notify you as required by law.

Changes

We will post changes here and update the date above. For material changes we will notify signed-in users in advance.

Contact

Privacy questions and requests: use the contact form.