Privacy Policy

1. Information we collect

Account data: your email address, username, display name, date of birth, and password (stored only as a secure hash). If you sign up with Discord, Roblox, or Google you don't need a password unless you add one later. We ask for your date of birth at sign-up (however you sign up) to make sure you are at least 13 and to decide whether you can see 18+ content. It is never shown on your profile or to other users.

Connected accounts: if you sign in with Discord, Roblox, or Google, or link one of them in Settings, we store which service it is, the ID that service uses for your account, your username and email address there (when it shares them), and when you linked it and last used it to sign in. See “Signing in with Discord, Roblox, or Google” below.

Profile and content data: your bio, avatar, banner, links, location, and the posts, comments, likes, follows, saved posts, direct messages, job listings, and advertisements you create, including any images or videos you upload. When you tag someone with @username or use a #hashtag, we also record who was tagged and which hashtags a post uses.

Settings: your privacy, content, and notification choices, including who can reply to your posts and who can mention you.

Business data: if you use Business features, the team members you verify (and the PayPal subscription paying for each seat), your advertising campaigns and their performance (impressions, clicks, spend), your advertising credit, and your credit purchases.

Verification review: when you buy a plan or receive a team seat, we record when your checkmark's review ends and, if an admin approved it early, which admin did so.

Billing data: when you subscribe or buy ad credit, PayPal handles your payment details. We receive PayPal subscription, order, and payer identifiers, the plan or amount, status, and renewal date — not your card number or PayPal login. If you use a discount code, we record which code you used and when, so each code can be used once per account.

Safety and moderation data: reports you submit or that concern your content or account, including a copy of what was reported at the time (so a report can still be reviewed after the content is deleted); the results of automated and human moderation (including content classifications and any account measures); and your account standing.

Technical data: basic logs and cookies needed to keep you signed in and to keep the service secure.

2. How we use your data

To provide and operate Bloxbook, including your feed, profile, messaging, notifications, job listings, and advertising.

To let you sign up and sign in with Discord, Roblox, or Google, and to keep those accounts linked to yours until you unlink them.

To link @mentions to the people tagged and notify them (as their settings allow), and to show posts on hashtag pages and in trending hashtags.

To process subscriptions, apply and revoke verification badges, and manage team verification and ad credit.

To keep the platform safe — detecting, reviewing, and acting on harmful or illegal content and abuse, including through automated moderation (see below).

To check your age: your date of birth is used to enforce our minimum age of 13 and to restrict 18+ content to adults. We do not use it for advertising, and we do not use it to sort users into age groups.

To comply with legal obligations and to communicate important account or service updates.

3. Automated content moderation and AI

Our community includes younger players, so we lean on automated tools to keep it safe. When you post or reply, the text may be sent to our AI provider xAI (the “Grok” model), which sorts it into safe, mature/18+, harmful, or illegal.

When something is reported, we also send xAI what is needed to judge it: the reported text and any attached image; for a reported direct message, that message and up to eight messages before it in the same conversation; for a reported account, its profile details, profile and banner images, and recent posts. Direct messages that nobody reports are never sent to xAI.

To judge a report fairly, we also send a few facts from our own records about the account behind the reported item: whether it is an official Bloxbook or staff account, what kind of checkmark it has, when it was created, how many followers and posts it has, its standing, and how many earlier reports about it were acted on or dismissed. We don't send email addresses, passwords, or payment details.

Off the back of that, the system can act on its own: label something 18+, remove it, block it from posting, or permanently ban the account behind it when the content is clearly illegal. When the review is less certain, the report is left for a person to decide, and reports about accounts are only acted on automatically for a clear ban.

Why we're allowed to do this: it's necessary to run the service for you, and it serves our legitimate interests and legal duty to keep the platform safe and lawful. Where a decision has a legal or similarly significant effect, we rely on it being necessary for our contract and/or other lawful grounds, and we keep safeguards in place.

Your say in it: if an automated decision meaningfully affects you, you can ask for a human to review it, tell us your side, and contest the result — just email support@bloxbook.lol. We keep records of moderation decisions so we can handle appeals and stop repeat abuse.

Anything we send to xAI is used to get that classification back — nothing more. We don't use it to build ad profiles of you.

4. Signing in with Discord, Roblox, or Google

You can choose to create an account or sign in with Discord, Roblox, or Google instead of a password. When you do, you are sent to that service, which asks you to approve Bloxbook. It then tells us who you are there. That service also learns that you are using Bloxbook. You are never asked for that service's password on Bloxbook, and we never receive it.

What each service shares: Discord shares your user ID, username, display name, email address (and whether Discord has verified it), and profile picture. Google shares your account ID, name, email address (and whether it is verified), and profile picture. Roblox shares your user ID, username, display name, and avatar headshot; it doesn't share an email address, so you type one in.

How we use it: the service's ID is how we recognise you the next time you sign in. Your name and username are used to suggest a display name and username when you sign up. The email address is offered as your account email (you can change it), and if it matches an existing Bloxbook account we offer to link that account instead. We never link accounts automatically just because the emails match: you have to sign in to the existing account with its password once. Your profile picture is only used if you tick the box to use it, and it keeps loading from that service's servers.

What we don't do: we don't post anything to these services, and we don't read your friends, servers, games, contacts, or messages there. The temporary access the service gives us is used once to read the details above. It is not stored.

While you finish signing up or linking, the details above are kept for up to 20 minutes in a signed cookie on your device (see our Cookie Policy). They are only saved to your account once you finish.

You can see and unlink your connected accounts in Settings → Your account. Unlinking removes the link from Bloxbook straight away. To also withdraw the approval you gave on the other service, use that service's settings: in Discord, User Settings → Authorized Apps; in Google, your Google Account → Security → Your connections to third-party apps & services; in Roblox, Settings → App Permissions. To make sure you can still sign in, you can't unlink your last connected account until you set a password.

5. Mentions and hashtags

When you tag someone with @username in a post or reply, it becomes a link to their profile and we notify them, but only if their settings allow you to mention them (Settings → Privacy and safety → Who can mention you). Otherwise the @username stays plain text and they are not told. People also choose whether mentions show up in their notifications.

Hashtags make a post appear on that hashtag's page. Hashtag pages only show posts the viewer is allowed to see (for example, posts from protected accounts are only shown to their followers). Trending hashtags are counted only from public posts that aren't marked 18+.

6. Legal bases

Where the GDPR or UK GDPR applies, we process data to perform our contract with you (providing the service), for our legitimate interests (security, moderation, and improvement of the service), to comply with legal obligations, and with your consent where required (for example, optional preferences).

7. Sharing your data

We share data with service providers who help us run Bloxbook, including PayPal (payments), xAI (automated content classification), KLIPY (GIF search, see below), and our hosting and database providers. These providers process data on our behalf or as independent controllers under appropriate agreements.

If you choose to sign in with Discord, Roblox, or Google, that service learns that you use Bloxbook and when you sign in with it. Each of them handles that under its own privacy policy, as an independent controller.

We do not sell your personal data. We may disclose data where required by law, to enforce our Terms, or to protect the rights, property, or safety of Bloxbook, our users, or the public — including reporting illegal content to the relevant authorities.

8. GIFs (KLIPY)

GIF search is provided by KLIPY. When you open the GIF picker, your browser or the app connects to KLIPY directly (not through our servers) and sends what you type in the search box, your device's language region, a content filter level, and a random-looking ID that we derive from your account so KLIPY can tell repeat searches apart. That ID isn't your username, email, or Bloxbook user ID, and KLIPY can't use it to find out who you are. When you send a GIF, we tell KLIPY which one was shared, and GIFs in posts, replies, and messages load straight from KLIPY's servers, which see your IP address like any website you visit. KLIPY handles this data under its own privacy policy.

We save the GIF's links, size, and title with your post, reply, or message. The title is screened like the rest of the text in posts and replies. If the item is reported, a still frame of the GIF (a link to KLIPY's copy) is kept with the report and sent for review.

9. Data retention

We keep your data for as long as your account is active. When you delete your account, we remove or anonymize your personal data within a reasonable period, except where we must retain limited records for legal, accounting, safety, or abuse-prevention purposes (for example, records of serious violations or of banned accounts to prevent evasion, and reports with the copy of what was reported).

Direct messages you delete are removed for everyone in the conversation straight away, along with their attachments, unless a report about them is already open or closed, in which case we keep the copy captured with the report.

A connected Discord, Roblox, or Google account is removed when you unlink it or delete your Bloxbook account. Records of who was tagged in a post or reply, and of a post's hashtags, are deleted with the post or reply.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, or export your data, to object to or restrict certain processing, to withdraw consent, and not to be subject to solely automated decisions with significant effects without safeguards. You can exercise most of these in Settings or by contacting us. “Download your data” (Settings → Your account) includes your settings and your connected accounts.

You may also lodge a complaint with your local data protection authority.

11. Security

We use industry-standard measures including encryption in transit, hashed passwords, and signed HTTP-only session cookies. Sign-in with Discord, Roblox, or Google is protected against forged or intercepted sign-ins with a one-time security value and, for Roblox and Google, a proof key (PKCE). No system is perfectly secure, but we work to protect your data and respond promptly to incidents.

12. Children

Bloxbook is not directed to children under 13, and we do not knowingly collect their data. We ask for a date of birth at sign-up, including when you sign up with Discord, Roblox, or Google, and do not let anyone who enters a date under 13 create an account; we remember that choice in a short-lived cookie on that device so it cannot be immediately retried with a different date. Content flagged as 18+ is only shown to users whose date of birth shows they are 18 or older, and only if they opt in. If you believe a child under 13 has provided us data, contact us and we will remove it.

13. International transfers

Your data may be processed in countries other than your own, including by our service providers such as PayPal, xAI, and KLIPY, and, if you sign in with them, Discord, Roblox, and Google. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

14. Changes

We may update this policy and will post the new version here with an updated date. Material changes will be communicated through the platform or by email.