Privacy Policy

• Summary
• Stored on your device
• If you make an account
• Who else sees it
• What our servers see
• Advertising
• Children
• Your choices
• Contact

1. The short version

SecretBlox (secretblox.com) is a free companion site for Roblox experiences: codes, item values, trade calculators and live player-count charts. It is operated byStrapp, LLC, reachable at support@secretblox.com. This policy explains what happens to data when you use the site.

• Accounts are optional. Every code list, value list, trade calculator and player-count chart works fully without one. If you never sign in, we hold nothing about you at all.
• If you do make one, it is small. An email address and a password (stored only as a one-way hash), or a Roblox sign-in, or both. Plus the games you have opened and the trade verdicts you have cast. That is the whole list — section 3 spells it out.
• Calculators run in your browser. Building a trade and reading its verdict sends us nothing — the maths happens on the page. The one exception is tapping a Win / Fair / Loss button: that sends the items in that trade so the verdict can be counted. Signed out, the verdict is not stored anywhere; signed in, it is (section 3).
• Signed out, personalisation is local. Your theme choice and the games you recently opened stay in your own browser's localStorage and are never uploaded. Trade verdicts are remembered locally too — and, as above, tapping one also sends that trade's items to us, though signed out nothing about it is kept.
• Account data never reaches an advertiser. Not your email, not your Roblox identity, not your saved games or items, not your logged trades, not your votes — and nothing derived from them influences which ad you see. See section 6.
• Advertising never sees your account. Ads are served by Google, which may personalise them from what it knows about your browser — but nothing about you reaches it from us, and in the EEA, UK and Switzerland we ask your consent first.
• You can delete everything yourself, from a button on your own account page, and it really is deleted.
• You must be 13 or older to have an account. Reading the site has no age requirement.
• We do not sell or share personal information.
• The data we publish is about games, not people. Player counts and visit totals come from Roblox's own public game endpoints.

2. What is stored on your device

SecretBlox uses your browser's localStorage — not cookies — for a small amount of personalisation. Signed out, these entries never leave your device, are not readable by us, and are not linked to any identifier. Signed in, two of them — the recently viewed list and your saved items — are uploaded to your account so they can follow you to another device (section 3); the rest still stay put:

• Theme. Whether you chose the light or dark palette, so the site does not flash the wrong one on your next visit.
• Recently viewed and saved games. The game pages you opened, so the homepage can offer a "Jump back in" shortcut, and any game you chose to keep with its "Save game" button. This entry syncs to an account.
• Saved items. The items you hearted on a pet, fruit, skin or item list, a values page or a calculator. Signed in, this entry syncs to an account too, and the account's list becomes the one your device shows.
• Saved filter sets. Value-list filters you chose to keep for next time.
• Your trade votes. Your last forty win / fair / loss picks per game, kept so the page can show you what you picked. Casting one also sends that trade to us — see section 1.

You can erase all of it at any time by clearing site data for secretblox.com in your browser settings. Nothing breaks; the site simply forgets your preferences.

SecretBlox does not set any first-party advertising, analytics or tracking cookie, and does not use device fingerprinting. If you sign in we set a session cookie, which is what keeps you signed in and nothing else — it is described in section 3.

3. If you make an account

An account is optional and it is late in the journey on purpose: nothing on SecretBlox requires one. It exists so your saved games, saved items and logged trades follow you between devices, and so your W/F/L trade verdicts count towards the community values we publish.

What we store

This is the complete list of what an account stores about you. The only other thing in that database is the short-lived, hashed abuse counters described in section 5 — they name no account and no address.

• Email address — if you sign up with one. We use it only for account messages you ask for: confirming it works, resetting your password, confirming a change of address. An account created through Roblox has no email address at all until you choose to add one.
• A password hash — if you sign up with an email. We never store the password itself and cannot recover or read it.
• A display name — whatever you type, or the display name Roblox gives us.
• Your Roblox user id, username and avatar image URL — only if you attach a Roblox account. The avatar is displayed straight from Roblox's own servers; we do not copy the image.
• Your saved games — the SecretBlox game hubs you have opened, and whether you chose to keep each one, so the "Jump back in" strip works on a new device.
• Your saved items — for each game, which of its items you hearted, and when. These are game items, not anything about you.
• Your logged trades — a trade you told the calculator you made: which game, the items on each side, when, and your own win / fair / loss call on it if you gave one. Only you can see this list.
• Your trade verdicts — for each trade you vote on: which game, the items on each side of that trade, and whether you said win, fair or loss. The item lists are game items, not anything about you.
• A single yes/no flag recording that you passed the age screen. See section 7.
• Sign-in housekeeping — session records, which carry no IP address and no browser details; the access token Roblox issues if you link an account, which is stored encrypted; and, while a password reset you asked for is in flight, the short-lived record behind the reset link (section 10). These keep you signed in and let us recognise you on your next visit.

What we deliberately do not store

• Your date of birth. The age screen uses it once, in memory, and discards it. Only the yes/no flag survives.
• Your Roblox password. We never see it. Roblox handles sign-in and only tells us who you are.
• Your Roblox friends, inventory, presence, or what you are playing. We ask Roblox for your user id, username and avatar, and nothing else.
• Your real name, address, phone number, or payment details. We have no use for any of them and never ask.
• Anything you type into a calculator. Casting a verdict sends the items in that trade; browsing the calculator sends nothing.

If you turn on code alerts

The codes pages offer an optional code alert — a browser push notification when a new code lands. It needs no account, and it is deliberately kept separate from one. If you turn it on, your browser hands us a push endpoint (a per-browser address the push service gives us) and two keys, and we store just those, with the game you asked about. There is no field for a user id and none is stored, so an alert subscription is not linked to you even if you also have an account. We use it only to send the code notification, and it is deleted the moment you turn alerts off. If code alerts are not switched on for a deployment, none of this happens at all.

Cookies used for sign-in

Signing in sets a session cookie so you stay signed in between pages. It is a strictly necessary cookie: it carries no advertising or analytics identifier, is not readable by page scripts, is limited to this site, and is cleared when you sign out. The sign-up screen also briefly sets a short-lived cookie confirming you answered the age question; it expires within half an hour and contains no date and no age.

Deleting your account

Your account page has a Delete account button. Using it removes your account record, your sign-in methods, your sessions, your saved games, your saved items, your logged trades and your trade verdicts, straight away. One guard: if it has been more than a day since you signed in — or your account has no password — we ask you to confirm your password or sign in again first, so a stale session on a borrowed device cannot erase your account. It is not a flag or an archive — the rows are gone, and there is no undo. Vote totals already aggregated onto a values page are anonymous counts, never linked to you: the most recent days are re-counted after a deletion, so your newest votes drop out of the published totals too, and older days stay as counts that cannot be traced back to you. If you would rather ask a person, write to support@secretblox.com and we will do it for you.

4. Who else sees your account data

Only the providers we need to run the service. Each one sees the minimum required to do its job, processes it on our instructions, and may not use it for its own purposes.

• Cloudflare — hosts the site and stores our databases, including account records. Everything described in section 3 lives on Cloudflare's infrastructure.
• Cloudflare Web Analytics — where a deployment enables it, a privacy-first, cookieless page-view counter. It sets no cookie and no identifier, cannot build a cross-site profile, and receives no account data — only aggregate page-view signals. It is measurement, not advertising, and it is the only analytics we use. Where the token that switches it on is not set, no analytics script is loaded at all.
• Resend — sends our account emails, and only those: the message confirming your address, the password-reset link, and the confirmation when you change your email. Each one exists because you asked for it. Resend receives the recipient address and the contents of that message. Nothing else about you is sent to it, and it is not used for newsletters or marketing because we do not send any.
• Roblox — only if you choose to sign in with Roblox. In that case Roblox tells us your user id, username and avatar URL. We do not send Roblox anything about your activity on SecretBlox.

Nobody else. In particular, no advertising or analytics provider receives account data of any kind — see section 6.

5. What our servers receive

SecretBlox runs on Cloudflare Workers. Like every website, our infrastructure automatically receives standard request information when a page is served: your IP address, the page requested, the time, your browser's user-agent string, and the referring page if any. This is used only to deliver the page, keep the service available, and defend against abuse and denial-of-service attacks. We do not use it to build a profile of you, and we do not attempt to identify you from it.

We keep operational logs for a short period for security and debugging, then they age out. We do not maintain a database of visitors. Signing in does not change that: session records carry no IP address and no user-agent string, so nothing here ties a person to the addresses they connected from.

If you send us a copyright (DMCA) notice

The copyright / DMCA form is open to anyone and is separate from accounts. When you submit a notice we store what the law requires an effective notice to contain: your name, your email address, the web addresses you are complaining about, your description of the work, and the name you type as your electronic signature. We use it only to evaluate and act on your notice and to reply to you.

Unlike account data, a copyright notice is a legal record. It is not deleted on a schedule, and is kept for as long as we may need it to show why material was removed or left up. If you send a counter-notice, the DMCA process requires us to forward it — including the contact details it contains — to the person who filed the original notice, so the two of you can take it from there. A separate per-connection limit on how many notices can be filed in an hour — the same limiter that slows repeated sign-in, sign-up and password-reset attempts — is stored only as a short-lived hashed counter, never as your address.

We run two separate databases, and they are kept apart deliberately. The first holds public information about Roblox experiences — names, player counts, visit totals, favourites, codes and item values — plus the code-alert subscriptions (section 3) and copyright notices described on this page, neither of which carries a user id or is linked to an account. The second holds the account records described in section 3, together with the short-lived hashed abuse counters above, and nothing else. The system that gathers game statistics has no access to the second, and no game record is ever linked to a person.

6. Advertising

SecretBlox is free and is paid for by display advertising. Ad slots are reserved in the page layout and clearly labelled.

Our advertising partner is Google AdSense. What Google does with the data it collects through its own ad tags is governed by Google'sprivacy notice for partner sites, which we do not control and cannot vary.

Google may set or read cookies and similar identifiers in your browser in order to choose an advertisement, limit how often you are shown the same one, and detect fraud. Depending on where you are and what you have agreed to, the advertisements you see may bepersonalized — chosen using information Google already holds about your browser from its own services and from other sites. That information comes from Google, never from us.

In the EEA, the United Kingdom and Switzerland you are asked for consent through a Google-certified consent management platform before any non-essential advertising cookie is set. You can refuse, and you can change your mind later from the same prompt. Refusing does not take anything away from you: you will still see advertisements, chosen from the content of the page instead of from any profile.

Anywhere in the world, you can review or switch off personalised advertising for your Google account at Google My Ad Center.

Accounts and advertising are completely separate

This is a hard rule in our code, not an intention. Nothing about your account ever reaches an advertiser. Concretely:

• Your email address, Roblox user id, Roblox username, avatar, saved games, saved items, logged trades and trade verdicts are never sent to an ad network, an analytics provider, or any measurement service.
• Whether you are signed in, and who you are, has no effect on which advertisement is requested or shown. Two people reading the same page get ads chosen the same way, whether or not either of them has an account.
• We do not build a profile of you, we do not combine anything from your Roblox identity with advertising data, and we do not let any advertising partner do so either.
• We never sell your personal information, and we do not share it for cross-context behavioural advertising.
• Pages served to a signed-in reader are marked private so they are never stored in a shared cache.

No data obtained from Roblox is ever shared with an advertising partner.Roblox's policy for third-party applications requires exactly this separation — it prohibits sharing a Roblox user's identifying information with third parties, and prohibits combining data obtained from Roblox with data obtained anywhere else. Our agreement with Roblox depends on keeping that line, so it is written into the code that handles every request rather than left to good intentions: the component that loads the ad tag takes exactly one input, our publisher id, which is the same constant for every visitor. A future feature cannot cross the line by accident.

Ad providers still need limited technical information to deliver and measure an ad — for example your approximate region and device type derived from your IP address, and a frequency-capping signal so you are not shown the same ad repeatedly. This is true even when advertising is not personalised.

7. Children's privacy (COPPA)

Reading SecretBlox has no age requirement. Nothing about browsing the site collects personal information from anyone: no registration is needed, and there are no profiles, messaging, uploads or comments.

You must be 13 or older to create an account, and there are two doors, each with its own check:

• Signing in with Roblox. Roblox does not allow accounts under 13 to authorise a third-party application at all, so this check is performed by Roblox itself, using information it holds and we never see. We do not add a second question on top of it, because that would mean collecting a birth date we have no need for.
• Signing up with an email. We ask for your date of birth on a plain screen before anything else. The question is asked neutrally — nothing on that screen tells you what answer would let you through, and no value is filled in for you.

If the answer is under 13, nothing at all is created or kept. No account, no email address, no session — and we do not record the date you gave us, nor even the fact that someone was turned away. We considered counting refusals and decided against it: keeping a record of children who were refused would be collecting the very information we had just declined to accept.

If the answer is 13 or over, we still do not keep the date. All that is stored is a single yes/no flag saying the check was passed. Your birth date is used once, in memory, and then gone.

We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child has created an account or otherwise given us personal information, contact us at support@secretblox.com: you can review what is held, have it deleted, and refuse any further collection — no proof of purchase, no forms, no argument.

8. Your choices and rights

• Delete your account and everything in it: the Delete account button on your account page does it immediately and completely. See section 3.
• See what we hold: your account page shows it — your sign-in methods, whether your email is confirmed, and your saves — and the saves page lists every saved game, saved item and logged trade. If you want it in another form, ask us.
• Correct it: your display name and email address are editable from your account page. Ask us about anything else.
• Detach Roblox: you can remove a linked Roblox account at any time, as long as you keep one way to sign in. Removing it deletes the Roblox id and avatar we stored. Your display name — which may have started as your Roblox name — stays whatever it is, and it is yours to change or keep from the account page.
• Erase local personalisation: clear site data for secretblox.com in your browser. This works whether or not you have an account.
• Block ads or trackers: using an ad blocker or your browser's tracking protection is fine; SecretBlox works without ads loading.
• Do Not Track / Global Privacy Control: we do not perform cross-site tracking of any kind, so there is nothing to switch off.
• Just do not sign in: the entire site works without an account, and then there is nothing to retrieve, correct or erase.

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising.

United States state privacy laws. Some states give their residents specific rights — to know, access, correct, delete, and to opt out of the sale or sharing of personal information. We do not gate any of that on where you live: everything in the list above is available to everyone. Because we do not sell or share personal information, there is no sale or sharing to opt out of, and a Global Privacy Control signal asks us to stop something we already do not do. We will not treat you differently for exercising any of these rights.

9. International visitors

SecretBlox is operated from the United States and served from Cloudflare's global network, so requests are handled by whichever data centre is nearest to you. If you use the site from outside the United States, standard request information is processed in that context.

If you are in the European Economic Area, the United Kingdom or another jurisdiction with a comparable privacy law: where we process personal data at all, we rely oncontract (running the account you asked for), legitimate interest (serving pages, keeping the site available, preventing abuse), andconsent where the law requires it. You have the rights described in section 8 — access, correction, deletion, objection, and portability — and you can exercise most of them yourself from your account page, or by writing to support@secretblox.com. You also have the right to complain to your local supervisory authority. If an advertising partner that requires consent-based cookies ever goes live for your region, you will be asked for consent before any such cookie is set, and section 6 will name the partner first.

10. How long we keep things

Account records are kept for as long as the account exists, and are removed when you delete it. Sign-in sessions expire on their own after thirty days, or immediately when you sign out. The link that confirms your email address expires after an hour; it is a signed token, not a stored record, so there is nothing on our servers to keep or delete. A password-reset link also expires after an hour and works once — the short-lived record behind it is deleted when you use it, or swept away shortly after it expires — and resetting your password signs you out everywhere, on every device. Operational logs age out after a short period. Nothing about a person is archived after deletion — there is no "deleted accounts" table, and no backup we would restore you from.

11. Third-party links

SecretBlox links out to Roblox experience pages, community wikis and other external sites. Those sites have their own privacy practices and this policy does not apply to them.

12. Security

The site is served only over HTTPS. Passwords are stored only as a one-way hash and cannot be read back, by us or by anyone who obtained the database. Session cookies cannot be read by page scripts. Account data lives in a separate database from the public game statistics, so the systems that gather those statistics have no path to it. If you never create an account we hold nothing about you, and a compromise of our systems could not expose personal information you never gave us.

13. Changes to this policy

If our practices change, we will update this page and change the "Last updated" date at the top. Material changes — in particular anything that would begin collecting personal information we do not collect today — will be described here before they take effect. This page was substantially revised when optional accounts were introduced; before that it stated, accurately at the time, that no accounts existed.

14. Contact

Privacy questions, deletion requests, or anything that looks wrong on this page:support@secretblox.com.