Privacy policy

Updated September 23, 2026

Bloxworthy is an independent place to keep a diary of Roblox games, rate and review them, and share lists. This page explains how the account website handles information.

Bloxworthy is operated by Shotai, LLC, Delaware, United States. For privacy questions, contact support@bloxworthy.com.

Signing in

Google or Roblox verifies your identity through our sign-in provider, Supabase. Google can provide your account identifier, verified email and basic profile such as your name and picture. Roblox provides an account identifier and basic public profile. We request identity and profile permissions only; we do not request access to your inbox, Roblox purchases, inventory or game management. We do not receive your Google or Roblox password.

Supabase stores sign-in identities. Our server uses account identifiers and hashed email or Roblox identifiers to keep accounts separate and limit duplicate voting. Sign-in tokens are encrypted on our server. Your sign-in email and linked provider identifiers are not displayed on your Bloxworthy profile.

Your library and public profile

We store your chosen profile, avatar, game activity, ratings, diary, reviews, lists, comments, likes, follows and preferences so the service can work. Your profile and ordinary community activity are public. Private lists are visible only to you; unlisted lists are visible to anyone with their link and are omitted from directories. Turning off member discovery does not make your profile or other public content private. Profile details you choose to publish can be seen by others.

Security checks and cookies

We use essential cookies for sign-in and for returning securely from a provider. The app’s sign-in session lasts up to 30 days; pending sign-in attempts expire after ten minutes. A random browser security cookie lasts up to 30 days and helps us apply short request limits separately to browsers sharing a network. Cloudflare Turnstile processes browser and network information to check automated traffic. Our server processes your network address for request limits and stores a rotating hash, rather than a raw IP address, in those limit records. Our infrastructure and sign-in providers may keep their own operational logs.

Game searches and requests

Unsuccessful game searches help us find missing games. Only catalog managers can view those signals and submitted requests. Individual automatic search signals expire after 30 days and respect Do Not Track and Global Privacy Control. A first-party cookie limits repeated anonymous search counts. Pending game requests stay in the review queue and may include the game name and Roblox link you submit. Resolved entries are normally removed after 90 days without further support.

Who processes information

Supabase provides our account database and sign-in service. Fly.io hosts our website server. Google or Roblox handles the sign-in method you select. Cloudflare provides DNS, email forwarding and the bot check. Support and advertising inquiries are forwarded to our team’s Gmail inbox; Google Groups also receives support inquiries from Google’s sign-in screen. We receive the sender address, message and attachments you choose to send, and use them to respond and keep relevant support or business records. We use this information to run the service, protect accounts, prevent score manipulation and handle support or abuse reports. We do not sell sign-in data or use Google user data for advertising. These providers also have their own privacy policies: Supabase, Google, Roblox, Cloudflare and Fly.io. These providers may process information in countries other than yours.

Export, correction and closure

You can edit your profile, change notification and comment preferences, and export your library in Settings. You can permanently close your account in Settings → Close account. Closure removes your active library, profile details, ratings, reviews, lists, comments and sessions; removed ratings no longer affect scores.

A minimal closed-account record, reserved username, hashed identities, sign-in-service identity and relevant safety records remain to prevent misuse. A separate encrypted closure record prevents an older database restore from reopening the account. Private backups may still contain older data. Closure does not erase your Google or Roblox account or other people’s independent posts that mention you.

Application moderation events and resolved reports are normally removed after 90 days; unresolved safety matters can remain for review. Account content otherwise remains until you remove it or close the account. Backups and third-party records have separate retention; we do not promise immediate erasure from every copy.

Children

Bloxworthy is intended for people aged 13 or older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact support@bloxworthy.com so we can investigate and remove it as appropriate.

Policy changes

We may update this policy as the service changes. The date on this page identifies the current version. We will provide notice of material changes through the website or another appropriate channel.

Privacy questions

For access, correction, privacy or account questions, contact support@bloxworthy.com. We may need to verify ownership before discussing private account information. Do not send passwords, sign-in codes or security keys.