- No passwordsYou sign in with a passphrase on your public Roblox profile. We never see your Roblox password.
- Two sign-in cookiesOne keeps you signed in, one protects your sign-in. No advertising or analytics cookies.
- We don't sell dataYour information is never sold or shared for advertising.
- Blockchains are publicAddresses and transaction IDs you use are permanently visible on public ledgers.
1Who we are
This policy describes how BloxyShop ("we", "us") handles personal information when you use our website (bloxy.shop) and services, including the marketplace, swap desk, crypto deposits and withdrawals, and in-game item service. BloxyShop is the controller of the information described here. For the rules of using BloxyShop, see our Terms of Service.
2Information we collect
Public Roblox profile information
When you sign in, we look up the Roblox username you enter and store your Roblox user ID, username, display name and avatar image link. To verify a login, we read the public About section of your Roblox profile to check for the passphrase we gave you; we don't store your About text.
Security information
When you sign in we record your IP address and browser user agent with your session. We use them, together with short-lived request counters, to keep your account secure, rate-limit abuse, and investigate fraud.
Transaction records
To run your account and meet our record-keeping obligations, we keep a record of what you do with your balance and items:
- your balance history (every credit and debit, with its reason) and your swap credit history for each game;
- the deposit addresses assigned to your account (one per coin), and for each crypto deposit: coin, network, amount, the receiving address, the transaction ID (txid), confirmations, the exchange rate used and the amount credited;
- crypto withdrawals: the destination address you enter, amounts, rate, fee, status and txid;
- marketplace listings, purchases and sales, and swap desk trades, including item details, prices and values;
- item deposits and withdrawals, including deposit codes, the items declared and received, and the Roblox username you ask us to deliver to.
Shopping activity and personalization
While you are signed in, we record which marketplace items you see and open, time spent viewing an item, 3D preview clicks, game and filter choices, cart changes, and checkout starts. We also record completed purchases and swaps for future item recommendations. These records are linked to your account and stay on BloxyShop; they are not sent to an advertising or analytics provider.
Activity records contain item references and limited shopping details, not your raw search text, passwords, cookies, wallet addresses, IP address or browser fingerprint. Browser Do Not Track and Global Privacy Control signals stop browsing activity collection. You can turn off activity personalization below to stop recommendation activity collection and delete its existing records for your account. This does not delete the transaction records needed to operate your balance and inventory.
Messages you send us
If you contact support, we keep what you send us (for example a transaction ID or screenshots) so we can help you and keep a record of the outcome.
3What we don't collect
We do not ask for or store your Roblox password, security cookie or 2-step verification codes, your email address, your real name, payment card or bank details, or your crypto wallet's private keys or seed phrase. Anyone asking you for these on BloxyShop's behalf is not us.
5How we use information
- to sign you in and keep your session secure;
- to run your balance and swap credit, assign your deposit addresses, process deposits and withdrawals, and settle purchases, sales and swaps;
- to deliver and receive in-game items through our bots;
- to show you which listings you own and identify official BloxyShop stock; public market listings do not display player seller identities;
- to understand shopping interests and prepare future item recommendations, unless you turn off activity personalization;
- to prevent fraud, abuse, money laundering and multi-accounting, and to enforce our Terms;
- to answer support requests; and
- to meet legal, accounting and tax obligations.
Where laws such as the GDPR apply, we rely on performing our contract with you, our legitimate interests in running a safe service, and compliance with legal obligations.
6Blockchain data is public
Cryptocurrency transactions are recorded on public blockchains. Anyone can see the addresses, amounts and transaction IDs involved, and nobody — including BloxyShop — can change or delete them.
Your deposit addresses belong to BloxyShop's wallet. We only link an address or transaction to your BloxyShop account in our own records. To detect incoming deposits, our servers ask public blockchain data services about the deposit addresses we have assigned; we don't send them your account details. Because blockchains are public, anyone who knows one of your deposit addresses can see the transfers made to it.
8How long we keep it
- Sign-in passphrases are held briefly in memory and discarded when used or after 15 minutes.
- Sessions (with their IP address and user agent) are deleted when you log out or when they expire after 7 days.
- Recommendation activity is retained for up to 90 days and pruned regularly. Turning off activity personalization deletes these records for your account; account and transaction records are kept separately.
- Account and transaction records are kept while your account is open and afterwards for as long as needed to resolve disputes, prevent fraud and meet legal, tax and anti-money-laundering obligations.
- Support messages are kept as long as needed to handle your request and keep a record of the outcome.
9Security
Staff access also requires a separate staff password. We store only a salted password hash and a short-lived unlock record tied to the staff member's signed-in session, never the staff password itself.
We protect your information with measures including hashed session tokens, HttpOnly cookies, a strict content security policy, rate limiting and access controls on staff tools. Deposit addresses are derived from public keys only. Payouts are signed by a separate, isolated signing service with its own spending limits; withdrawals are reviewed by staff or sent automatically within those limits. No system is perfectly secure, so please keep your Roblox account protected with 2-step verification.
10Your rights
Depending on where you live, you may have the right to access the information we hold about you, correct it, delete it, restrict or object to how we use it, and receive a copy in a portable format. You can also complain to your local data protection authority.
- Your username, display name and avatar come from Roblox and update when you next sign in.
- We can delete your account on request once your balance and items have been withdrawn (swap credit has no cash value and is not paid out). We may need to keep transaction records where the law requires it.
- To confirm a request comes from you, we may ask you to add a phrase to your Roblox About section, just like signing in.
We don't sell personal information, so there is nothing to opt out of in that respect.
11Children
BloxyShop is intended for adults. Users under the age of majority may only use it with a parent or guardian's consent and supervision, as set out in our Terms. We don't knowingly collect information from children under 13. If you believe a child under 13 has used BloxyShop, please contact us and we will close the account and delete what we can.
12Changes to this policy
We may update this policy as BloxyShop changes. We'll update the date at the top and, for significant changes, let you know on the site.
13Contact
For privacy questions or requests, reach us through BloxyShop support and include your Roblox username.