donoblox (“we,” “us,” or “our”) operates a Roblox donation platform. This Privacy Policy explains what information we collect when you use the Service, how we use it, and your choices regarding your data. By using donoblox you agree to this policy.

We are committed to collecting only what is necessary to operate the Service and to never selling your personal information to third parties.

Information you provide via Roblox OAuth:

• Roblox user ID (a numeric string assigned by Roblox)
• Roblox username and display name
• Roblox profile picture URL

We do not receive or store your Roblox password. Authentication is handled entirely by Roblox via OAuth 2.0 with the scopes openid, profile, user.inventory-item:read, and game-pass:read. The last two scopes verify game pass purchases and creator ownership.

Information generated by your use of the Service:

• Donation transactions — donor ID, recipient ID, game pass ID, amount, and verification timestamp.
• Chat messages — user ID, message text, and timestamp.
• Session tokens — a randomly generated token stored in Redis on our servers and in your browser's localStorage. Sessions expire after 30 days of inactivity.
• Server logs — IP address, request path, response codes, and timestamps for security and debugging. Log retention is typically 14 days.

Information we do NOT collect:

• Payment or billing information (all Robux transactions occur on Roblox).
• Email addresses.
• Device identifiers beyond what is standard in HTTP request headers.
• Browsing history or cross-site tracking data.

We use the data we collect to:

• Authenticate you and maintain your session.
• Display your profile, donation history, and leaderboard standing.
• Verify that a Roblox game pass was purchased before recording a donation.
• Broadcast real-time donation events and chat messages to other users via WebSocket.
• Send you in-app notifications about donations you have received.
• Detect and prevent abuse, fraud, and violations of our Terms of Service.
• Operate, maintain, and improve the Service.

We do not use your data for advertising, profiling, or any purpose unrelated to operating the Service.

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Public leaderboards and feeds: Your Roblox username, display name, profile picture, and donation amounts are visible to all users of the Service as part of the live feed and leaderboards. This is a core feature of the platform.
• Roblox Corporation:We query Roblox APIs to retrieve your profile information, game pass details, and inventory status. Roblox's own Privacy Policy governs how Roblox handles your data.
• Legal requirements: We may disclose information if required to do so by law or in response to a valid legal request (e.g., a subpoena or court order).
• Safety: We may share information to protect the safety of any person, investigate fraud, or respond to a government request.

• Sessions: Stored for 30 days and automatically expire.
• Roblox OAuth credentials: Stored for up to 90 days and used only for donation ownership verification.
• Donation history: Up to the latest 100 donation events per user are retained.
• Chat messages: Up to the latest 50 chat messages are retained in history.
• Notifications: Up to 50 notifications per user are retained until cleared.
• Server logs: Retained for approximately 14 days for security purposes.

donoblox does not use tracking cookies. We store your session token in your browser's localStorage (under the key donoblox_session) to keep you signed in across page loads. You can remove this at any time by signing out or clearing your browser storage.

We implement reasonable technical measures to protect your information, including server-side session validation, rate limiting, and Redis-based session storage. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

If you discover a security vulnerability in donoblox, please report it responsibly via our Discord server.

donoblox is not directed to children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If you believe a child under 13 has provided us with personal data, please contact us and we will take steps to delete it.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (note: some data may be retained for legal or security reasons).
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us via our Discord server. We will respond within 30 days.

Opting out: You may sign out of the Service at any time. Signing out removes your session token from localStorage. If you wish to have your account data deleted from our servers, please contact us.

The Service may contain links to third-party websites (such as Roblox.com, Discord, and YouTube). This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy, please contact us via our Discord server.