Privacy

Your data stays yours.

Blox Academy is a tool for building games, not an advertising business. Here's exactly what we collect, why, and what you can do about it.

Last updated October 29, 2026

No ads or trackersNo analytics, ad networks or tracking cookies. One cookie keeps you signed in.
Never soldYour projects and ideas belong to you. We don't sell or share them for advertising.
Encrypted and hashedPasswords are Argon2id hashes. Keys and two-factor secrets are encrypted.
Delete anytimeOne button on your account page erases your account and everything in it.

On this page

  1. Who we are
  2. What we collect
  3. How we use it
  4. Who else is involved
  5. Cookies and local storage
  6. How long we keep it
  7. How we protect it
  8. Your choices and rights
  9. Children
  10. Where your data is stored
  11. Changes to this policy
  12. Contact us

Who we are

Blox Academy is run by [Your legal business name], [Your mailing address]. When this policy says “we” or “us”, that's who it means. For anything about your data, email [[email protected]].

What we collect

Your account
Your email address and your password, which we store only as an Argon2id hash, so we can't read it. Whether you've confirmed your email.
Two-factor sign-in
If you turn it on: the secret your authenticator app uses (encrypted) and your recovery codes (stored only as hashes).
Sign-in sessions
A random session token (we keep only a hash of it), when it started, and your browser's name and version. They help us keep your account secure.
Your work
Projects, saved ideas, your watchlist, playtest notes, patch notes, settings and anything else you type into the dashboard.
Your Roblox details
If you use Countdown Thumbnails or Live Ops: your Roblox Open Cloud API key (encrypted), your game's universe ID, and the thumbnail images you make.
Live Ops records
A log of every Live Ops action (who did it, when, and what changed, including a player's saved data before an edit), notes your team writes about players, your scheduled events and campaign links, and a few hours' cache of your game's Roblox statistics. If you turn on notifications to groups, the tracker also keeps each player's Roblox ID, encrypted, until you turn it off.
Your game's players
Only if you add the analytics script to your game. For each player: a code made from their Roblox user ID with a key only our server has (we never store the ID itself), their country, whether they have Premium, how old their account is, when they play, what they buy, and the events your scripts send. Plus script errors and each server's players, frame rate and memory. You choose to collect this as the game's creator, so mention it in your game's own privacy notice. Deleting the project deletes it.
Alerts and teams
Your alert rules and the alerts we sent you, your Discord webhook links (encrypted), the email addresses of teammates you invite, and a feed of changes to shared projects.
Search keywords
The phrases you research or track, and your game's search rank for them each day.
Billing
Your Stripe customer and subscription IDs, your plan status and renewal date. Card details go straight to Stripe. We never see or store them.
Messages
What you send us when you email us.
Your IP address
Used for a few minutes, in memory, for rate limits that stop password guessing and scraping. Our server doesn't keep logs of the pages you visit. You can explore Games without an account; we don't track visitors.

We don't use analytics, advertising or tracking cookies, and we don't build a profile of you.

How we use it

  • To run Blox Academy for you: showing your projects and ideas, building your starter kit, switching your countdown thumbnails.
  • To keep your account safe: signing you in, two-factor checks, rate limits and spotting abuse.
  • To bill you: starting your trial, charging your subscription through Stripe, and sending receipts.
  • To email you about your account: confirming your email, password resets, and important notices about billing, security or these policies. We won't send marketing emails unless you ask for them.
  • To help when you contact us, and to meet our legal obligations, like keeping tax records.

If you're in the EU, the UK or a similar place, our legal bases are: running our contract with you (the service and billing), our legitimate interest in keeping accounts secure, legal obligations (tax records), and your consent where we ask for it.

Who else is involved

We never sell your personal information, and we don't share it for advertising. We only use these services, and only for what's listed:

Stripe
Processes payments and manages your subscription. Stripe's own privacy policy covers your card details.
Our hosting provider
[your hosting provider] runs our server and stores your data in [the country your server is in].
Our email provider
Sends account emails, like confirmation and password-reset links.
Have I Been Pwned
When you choose a password, we send the first 5 characters of a SHA-1 hash of it to check it against known data breaches. Your password and its full hash never leave our server.
Roblox
Our server reads Roblox's public charts, game pages and search. If you add your API key, our server acts on your game for you, only when you or an event you scheduled asks: thumbnails, live settings, prices, broadcasts, notifications, saved player data and bans. In the dashboard, your browser loads game images straight from Roblox.
Discord
Only if you connect a channel. We post your alerts, Morning Brief or patch notes to that channel's webhook, and Discord's privacy policy covers them from there.
Google Fonts
The dashboard loads its typeface from Google, which receives your IP address and browser details when it does.
Claude (Anthropic)
Only if you connect it. When you add your connector link to Claude, Claude can read and update your Blox Academy projects through it, under your own Claude account and Anthropic's terms. You can turn the link off at any time.

We may also share information if the law requires it, to protect someone's safety, or as part of selling the business, in which case this policy would still apply to your data.

Cookies and local storage

We use one cookie, and only to keep you signed in. It can't be read by scripts on the page, it isn't sent to other sites, and it ends when you sign out or after 30 days. The dashboard also remembers a few preferences in your browser, like the last tab you opened. They stay on your device.

Because we don't use any optional cookies, there's nothing to accept or decline.

How long we keep it

We keep your information while you have an account.

  • Delete your account from your account page and we erase your projects, saved ideas, watchlist, settings, keys, countdown images, alerts, your games' analytics, search ranks and sessions right away. Copies in our backups are overwritten within 30 days.
  • Billing records are kept by Stripe, and by us where tax law requires it.
  • Sign-in links expire on their own: password resets after an hour, email confirmations after 48 hours.

How we protect it

  • Passwords are hashed with Argon2id. Two-factor sign-in works with any authenticator app.
  • Your Roblox API key, Discord webhooks and two-factor secret are encrypted. Session, connector, invite, analytics and recovery codes are stored only as hashes.
  • Everything travels over HTTPS, and our pages use strict security headers that block other sites from framing them or running scripts in them.
  • Changing your password signs you out everywhere else.

No system is perfectly secure. If we ever learn of a breach that affects your data, we'll tell you and the authorities as the law requires.

Your choices and rights

You can always:

  • See and edit your projects and settings in the dashboard.
  • Delete your account and everything in it from your account page.
  • Get a copy of your data. Email us and we'll send it in a common file format within 30 days.
  • Ask us to correct, restrict or stop using your information, or withdraw a consent you gave.

Depending on where you live (for example the EU, the UK, Canada or California), you may have more rights, and you can complain to your data protection authority. We'll never treat you differently for using them. Email [[email protected]] and we'll answer within 30 days.

Children

Blox Academy is for adults. You need to be at least 18, or the age of majority where you live, to create an account. Younger creators can use it through a parent's or guardian's account, with their permission. We don't knowingly collect information from children under 13. If we learn we have, we'll delete it. Contact us if you think that's happened.

Where your data is stored

Your data is stored on our server in [the country your server is in]. Some of the services above may process it in other countries. When they do, we rely on safeguards the law recognizes, such as standard contractual clauses.

Changes to this policy

If we change this policy, we'll post the new version here and update the date at the top. If a change matters, we'll email you before it takes effect.

Contact us

Questions or requests about your privacy: [[email protected]]
[Your legal business name], [Your mailing address]