Privacy policy

Updated October 16, 2026

Bloxworthy is an independent place to keep a diary of Roblox games, rate and review them, and share lists. This page explains how the account website handles information.

Bloxworthy is operated by Shotai, LLC, Delaware, United States. For privacy questions, contact support@bloxworthy.com.

Signing in

Google or Roblox verifies your identity through our sign-in provider, Supabase. Google can provide your account identifier, verified email and basic profile such as your name and picture. Roblox provides an account identifier and basic public profile. We request identity and profile permissions only; we do not request access to your inbox, Roblox purchases, inventory or game management. We do not receive your Google or Roblox password.

Supabase stores sign-in identities. Our server uses account identifiers and hashed email or Roblox identifiers to keep accounts separate and limit duplicate voting. Sign-in tokens are encrypted on our server. Your sign-in email and linked provider identifiers are not displayed on your Bloxworthy profile.

Your library and public profile

We store your chosen profile, avatar, game activity, ratings, diary, reviews, lists, comments, likes, follows and preferences so the service can work. Your profile and ordinary community activity are public. Private lists are visible only to you; unlisted lists are visible to anyone with their link and are omitted from directories. Turning off member discovery does not make your profile or other public content private. You can keep your shelf private: then only you see the games you’ve played, rated, liked or saved, and your diary. Your written reviews and lists stay as you set them, and your ratings still count toward each game’s score without your name. If you change your username, links to your old one lead to your profile for 30 days; nobody else can take your old usernames, and they stay reserved if you close your account. Profile details you choose to publish can be seen by others.

Security checks and cookies

We use essential cookies for sign-in and for returning securely from a provider. The app’s sign-in session lasts up to 30 days; pending sign-in attempts expire after ten minutes. A random browser security cookie lasts up to 30 days and helps us apply short request limits separately to browsers sharing a network. Cloudflare Turnstile processes browser and network information to check automated traffic. Our server processes your network address for request limits and stores a rotating hash, rather than a raw IP address, in those limit records. Our infrastructure and sign-in providers may keep their own operational logs.

Game searches and requests

Unsuccessful game searches help us find missing games. Only catalog managers can view those signals and submitted requests. Individual automatic search signals expire after 30 days and respect Do Not Track and Global Privacy Control. A first-party cookie limits repeated anonymous search counts. Pending game requests stay in the review queue and may include the game name and Roblox link you submit. Resolved entries are normally removed after 90 days without further support.

Invitations, badges and creator links

A friend invitation can be remembered in a first-party cookie for up to seven days before you join. You can remove the invitation before signing in. When you create a new account, we record the inviter to calculate Party Starter progress. Qualification uses three different game ratings and a meaningful return between 24 hours and seven days after signup. Inviters see counts, not the identities or activity histories of invited members. We do not upload contacts or follow someone automatically.

Creator campaign links measure link visits, new signups and qualifying returns. They do not create affiliate payments. Campaign reports are available only to the site owner and show aggregate counts. Campaign attribution also lasts up to seven days before signup and respects Do Not Track and Global Privacy Control. These links do not use third-party analytics, advertising identifiers or browser fingerprinting.

The first 1,000 real members to rate three different games receive a public numbered Founding Member badge. Numbers are assigned when the third qualifying rating is completed. Demo accounts and held ratings do not count. Badge numbers are permanent and never reused. Account closure removes account-linked invitation records and detaches the reserved number. Non-identifying campaign totals remain, and historical backups have separate retention.

Site analytics

We measure aggregate page views, signup completion, ratings, saves, published reviews and lists, follows, shares, and Roblox link clicks to improve Bloxworthy. We collect broad page groups, source categories, phone or desktop, and load timings—not raw page URLs, search terms, draft text, anonymous identifiers, or session recordings. We honor Do Not Track and Global Privacy Control.

Aggregate daily measurements are kept for 90 days. For signed-in members, temporary account milestones measure signup progress and return visits for up to seven days; those records are deleted after 30 days. Daily member deduplication records are deleted after eight days. Invitation and campaign totals remain as aggregate counters. Reports do not expose member identities. Account closure removes the temporary account-linked records. We do not send this analytics data to advertisers.

Who processes information

Supabase provides our account database and sign-in service. Fly.io hosts our website server. Google or Roblox handles the sign-in method you select. Cloudflare provides DNS, email forwarding and the bot check. OpenAI’s moderation service checks the text and pictures members post for harmful content before they appear; it does not receive your sign-in details. The Canadian Centre for Child Protection’s Project Arachnid Shield service compares new profile pictures with known child sexual abuse images before they are saved. Support and advertising inquiries are forwarded to our team’s Gmail inbox; Google Groups also receives support inquiries from Google’s sign-in screen. We receive the sender address, message and attachments you choose to send, and use them to respond and keep relevant support or business records. We use this information to run the service, protect accounts, prevent score manipulation and handle support or abuse reports. We do not sell sign-in data or use Google user data for advertising. These providers also have their own privacy policies: Supabase, Google, Roblox, Cloudflare, OpenAI, Project Arachnid and Fly.io. These providers may process information in countries other than yours.

Export, correction and closure

You can edit your profile, change notification and comment preferences, and export your library in Settings. You can permanently close your account in Settings → Close account. Closure removes your active library, profile details, ratings, reviews, lists, comments and sessions; removed ratings no longer affect scores.

A minimal closed-account record, reserved username, hashed identities, sign-in-service identity and relevant safety records remain to prevent misuse. A separate encrypted closure record prevents an older database restore from reopening the account. Private backups may still contain older data. Closure does not erase your Google or Roblox account or other people’s independent posts that mention you.

Application moderation events and resolved reports are normally removed after 90 days; unresolved safety matters can remain for review. Account content otherwise remains until you remove it or close the account. Backups and third-party records have separate retention; we do not promise immediate erasure from every copy.

Children

Bloxworthy is intended for people aged 13 or older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact support@bloxworthy.com so we can investigate and remove it as appropriate.

Policy changes

We may update this policy as the service changes. The date on this page identifies the current version. We will provide notice of material changes through the website or another appropriate channel.

Privacy questions

For access, correction, privacy or account questions, contact support@bloxworthy.com. We may need to verify ownership before discussing private account information. Do not send passwords, sign-in codes or security keys.