Privacy Policy

Effective Date: January 31, 2026
Last Updated: July 28, 2026

This policy applies to Bloxodes.com, Bloxodes mobile apps, Bloxodes browser extensions, and the APIs and account features that support them (together, the "Bloxodes Services"). Most content can be used without signing in. Roblox sign-in is optional and is used when you want an account, public account identity, or progress that follows you across supported devices.

1. Information We Collect

Roblox account and session information

• When you sign in with Roblox, we receive your Roblox user ID, username, display name, avatar, and profile URL through Roblox's official OAuth service.
• We create a Bloxodes account and session associated with that Roblox identity. Session records can include creation, update, expiration and revocation times, sign-in source, return path, IP address, and user agent.
• We never receive or store your Roblox password.

Progress and preferences

• Codes you mark as used or restore, organized by game.
• Checklist items you complete, organized by checklist.
• Quiz activity, including seen questions, most recent score and total, difficulty breakdown, and last-attempt time.
• Theme and interface preferences.
• When signed out, progress is generally kept on your device. When signed in, supported progress is merged with your account and synchronized through Bloxodes APIs.

Comments and other submissions

• Signed-in comments are associated with your Bloxodes account. Your display name and, where shown, Roblox username and avatar can appear publicly with an approved comment.
• Guest comments require a name, email address, and comment. The name and approved comment are public; the email address is not public and is used for moderation, safety, and handling requests about the comment.
• Comment text is checked using OpenAI's Moderation API before publication. We store the moderation decision and related categories or scores with the comment record.
• Feedback submissions can include your message, optional email, current page URL and path, viewport size, user agent, IP address, submission time, and status.
• If you email us, we receive your email address, message, and any information you choose to include.

Technical, usage, and advertising information

• Requests to Bloxodes can include IP address, browser or app type, operating system, referral information, requested endpoint, timestamps, and security or performance information.
• Website analytics can record page views, approximate location, device and referrer information, performance measurements, and selected interactions such as searches, copied codes, checklist activity, quiz completion, and outbound clicks.
• Website advertising partners can use cookies or similar identifiers for ad delivery, measurement, frequency control, and fraud prevention.
• We do not collect payment information, physical addresses, phone numbers, or government-issued identification.

2. Website, Mobile, and Extension Storage

Website: We use an essential session cookie for sign-in. Theme, consent choices, and signed-out code, checklist, quiz, or tool progress can be kept in cookies or browser local storage. Google Analytics and Mediavine Journey can set non-essential cookies or similar identifiers when permitted by the consent tools active for your region.

Mobile apps:Authentication tokens are stored using the operating system's secure storage where available. Theme and signed-out progress are stored locally on the device. The mobile apps currently contain no Bloxodes advertising or third-party analytics SDKs, but their requests to Bloxodes APIs produce routine server and security logs.

Browser extensions:Authentication tokens and signed-out used-code progress are stored in local extension storage. The Active codes and Player history widget settings are stored through the browser's sync storage so your browser can carry those choices to other signed-in browser installations. Authentication tokens are never placed in browser sync.

Clearing cookies, app data, or local extension storage can sign you out or remove progress that has not been synchronized to an account. Browser vendors and operating systems control their own backup and synchronization services.

3. Browser Extension Data

The current Chrome and Edge extension runs on Roblox game pages. It reads the public Roblox place ID and visible game name and sends those values to a Bloxodes extension API to find codes and player-history data. If the game is not tracked, Bloxodes can use that public place ID and game name to begin verified universe discovery and future tracking.

Chrome version 4.1 and current Edge releases do not send the full page URL, URL query parameters, private-server links, Roblox credentials, unrelated page content, or browsing history. Older installed Chrome releases may send the public game URL as a compatibility fallback; users should update to the current release.

Extension sign-in opens Bloxodes and Roblox's official OAuth flow. The extension receives a Bloxodes app-session token after sign-in and uses it only for account identification and used-code synchronization. Signing out revokes that extension session. The extension currently contains no advertising, analytics, or cross-site tracking code.

Bloxodes's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Extension data is used only to provide and improve the extension's disclosed game-companion features, maintain security, and comply with law.

4. How We Use Information

• Provide accounts, authentication, comments, feedback, preferences, and cross-device progress.
• Identify Roblox games and provide codes, historical player counts, tools, and other requested content.
• Moderate submissions, prevent abuse, enforce rate limits, and protect users and the Bloxodes Services.
• Measure website usage, diagnose errors, maintain performance, and improve content and features.
• Display and measure website advertising where permitted.
• Respond to support, privacy, deletion, legal, and safety requests.

Depending on where you live, we rely on consent, performance of our agreement with you, our legitimate interests in operating and securing the Bloxodes Services, and compliance with legal obligations.

5. Analytics and Advertising

The website uses Google Analytics 4 and self-hosted Umami to understand usage and performance. We use this information in aggregate and do not intentionally send your Bloxodes account ID, Roblox user ID, comment email, or feedback email to these analytics services.

The website uses Mediavine Journey and related advertising services. Advertising providers may use cookies and similar technologies to deliver and measure ads and prevent fraud. The extension and mobile apps do not currently contain Bloxodes ads.

Use the controls shown by our consent partner, our cookie settings page, and your browser or device settings to manage available choices. You can also review Mediavine's privacy policy and industry opt-out choices at YourAdChoices.

6. When We Share Information

We do not sell account records, comments, feedback submissions, or synced progress. We disclose data only as needed to:

• Roblox for OAuth authentication and Roblox profile or game information.
• OpenAI for automated moderation of submitted comment text.
• Google Analytics for website measurement.
• Mediavine Journey and its advertising partners for website advertising and measurement.
• Our self-hosted Umami and Supabase services for analytics, database, storage, and account operations.
• Hosting, CDN, security, and network providers, including infrastructure used to deliver and protect the Services.
• Authorities or other parties when required by law or reasonably necessary to protect rights, safety, and security.

Some U.S. privacy laws define certain personalized advertising disclosures as "sharing" even when no money changes hands. Where required, the active consent and advertising controls provide the available opt-out choices.

7. Retention

• Account and synchronized progress are kept while your account remains active or until deletion is completed.
• Session tokens expire or are revoked; security records can be retained longer when needed to investigate abuse.
• Comments and moderation records are kept while published or while needed for moderation, disputes, and safety.
• Feedback and support messages are kept until resolved and then only as long as reasonably necessary.
• Analytics, advertising, and infrastructure records follow the configured schedules of the relevant systems and providers.

We may retain limited records where required by law, to resolve disputes, prevent abuse, or document a completed privacy request. Local data remains until you clear it, uninstall the app or extension, or the browser or operating system removes it.

8. Your Choices and Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or receive a copy of personal data; object to or opt out of certain processing; withdraw consent; or appeal a decision. We may need to verify your Roblox-linked identity, comment email, or other relevant information before completing a request.

• Signed-in users can edit or delete their own comments through the website.
• Guest-comment removal requests can be sent from the email address used for that comment.
• Account and associated-data deletion can be initiated through our account deletion page.
• Local progress can be removed by clearing website, app, or extension storage.
• Website analytics and advertising choices can be managed through the controls available for your region.

We will not discriminate against you for exercising a privacy right. If applicable law provides a right to complain to a data protection authority, you may also contact the authority where you live.

9. Children's Privacy

The Bloxodes Services are intended for people aged 13 and older. If you are under the age of majority where you live, use the Services only with permission from a parent or guardian. We do not knowingly collect personal information from children under 13. A parent or guardian who believes a child submitted personal information can contact us for removal.

10. Security and International Processing

We use access controls, HTTPS, restricted server-side credentials, expiring or revocable sessions, and platform-provided secure storage where available. No system is completely secure, so we cannot guarantee absolute security.

Bloxodes and its providers may process information in countries other than your own. Where required, providers use recognized transfer mechanisms and safeguards for international processing.

11. Changes and Contact

We may update this policy when the Bloxodes Services, providers, or legal requirements change. Material changes will be communicated through an appropriate in-product or website notice where required.

Email: [email protected]
Privacy and deletion requests: Account deletion and data requests
Website: https://bloxodes.com