Privacy Policy

This Privacy Policy explains how BloxCord ("BloxCord", "we", "us", or "our") collects, uses, shares, and protects personal information when you use the Service. BloxCord is operated by Starstruck Solutions LLC, contactable at help@starsol.io or at 1007 N Orange Street, #3029, Wilmington, DE 19801, United States of America.

BloxCord is an independent web dashboard for managing Roblox groups and communities, including organizations, roles and permissions, sessions, reputation, handbooks, audit logs, webhooks, and analytics. This Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms.

By using the Service, you acknowledge the practices described in this Policy. If you do not agree, do not use the Service.

When you use BloxCord for yourself (for example, your Account, your billing, and your personal settings), we act as the controller of that personal information.

When an Organization uses the Service to collect and process information about its Members and about the Roblox users and players in its groups and experiences ("Subject Data"), the Organization is the controller of that data and BloxCord acts as its processor, handling the data on the Organization's behalf and under its instructions. In that case, the Organization's own privacy notices and choices govern that data, and you should direct requests about it to the Organization. We make a standard data processing addendum (DPA) available to Organizations on request.

This Policy describes our own practices as a controller and gives general transparency about how the Service processes data. It is not a substitute for the notices an Organization must give to its Members and players.

Account and identity data: when you authenticate through Roblox OAuth and/or Discord OAuth, we receive identifiers and profile information from those platforms, such as your Roblox and Discord user IDs, usernames, display names, avatars, and, where you authorize it, connected group and server memberships and roles. The data we receieve from OAuth platforms is limited to what you authorize during the flow.

Organization and group data: the Organizations you belong to, your roles and permissions, and the configuration, settings, and Content associated with those Organizations.

Content you submit: user-generated content and media you create, upload, or configure on the BloxCord dashboard, including reputation entries and scores, handbooks, profile text, comments, player audit and logbook entries, session and log records, layouts and configurations, uploaded images such as banners and cosmetics, webhook configurations, and other materials you create or upload through the Service.

Profile information: optional details you add to your BloxCord profile, such as pronouns, an about-me blurb, and a birthday month and day. If you provide a birthday and the birthday feature is enabled in an Organization you belong to, your birthday may be announced within that Organization on the day it occurs in your time zone. Because the timing of that announcement reflects your time zone, others could infer your approximate time zone from it. You can avoid this by not providing a birthday.

Age-verification data: if you use our Age Check feature, we temporarily process a short series of images of you to estimate your age using automated systems. See the "Age Verification" section below for details on how this data is processed and deleted.

Subject Data about players and non-users: on behalf of Organizations, the Service may collect playtime and session tracking, in-experience presence and activity (which may include chat logs, command logs, network logs, movements, and any other content that occurs within the experience), live-view and replay of in-experience activity, approximate location derived from network signals such as ping-based triangulation, ban records, reputation targets, and audit targets. Some of this data may relate to Roblox users who do not hold a BloxCord Account. Approximate location derived from ping-based triangulation is not available to Organizations as of the effective date of this Policy, but may be made available at a later date.

Game-server and device data from Roblox experiences: where an Organization connects a Roblox experience to our API, we may collect data reported by its game servers about players. This may include device and hardware information, operating system and device type, signals that may indicate alternative or linked accounts, device geolocation and time zone, gyroscopic and accelerometer (motion) data, device performance metrics such as ping, latency, memory usage, and CPU time, chat logs, movement and position data, join and leave times, and key-press or other input data. We may not collect all of these categories today, and we may collect some or all of them now or in the future. Game-server and device data is only visible and within the scope of the Organizations whose attached experiences the player has played.

Payment data: when you purchase Plus, Premium, or other paid products, our payment processor (Stripe) handles your payment-card details. We do not store full card numbers; we receive limited billing metadata such as transaction identifiers, subscription status, the outcome of a payment, and billing information such as the cardholder or billing name and billing address. This billing information is not displayed on the BloxCord dashboard.

Technical and usage data: IP address, approximate location and time zone derived from your device or connection, device and browser information, a device or browser fingerprint (a probabilistic identifier derived from characteristics of your device, browser, and connection), session keys and authentication tokens, and telemetry, diagnostic, and performance data collected automatically as you use the Service. We may log requests to the Service and our API, including request headers, request bodies and parameters, IP addresses, and user-agent strings.

Communications and support data: the contents of messages you send us, support requests, and related correspondence, including through Discord.

Directly from you, when you create an Account, configure Organizations, submit Content, make a purchase, or contact us.

From Roblox and Discord, through OAuth and their APIs, based on the permissions you grant when connecting your accounts.

Automatically, through cookies, local storage, session keys, authentication tokens, and server-side logging as you interact with the Service.

From Organizations and their Members, and from the Game-Internal API and related integrations, which collect gameplay, session, and telemetry data from Roblox experiences connected to an Organization.

To provide, operate, and maintain the Service, including authentication, Organizations, roles and permissions, sessions, reputation, handbooks, audit logs, webhooks, and analytics.

To process payments, manage subscriptions and entitlements, and deliver purchased features, products, and Virtual Items through Stripe.

To provide customer support and respond to your requests, including through AI-assisted or automated tools.

To power AI-assisted or AI-generated features where we make them available and you choose to use them. In that case, the Content and any data you submit to or process through those features may be made available to our third-party AI providers so they can process your request. Those providers process the data to provide the feature to us and under their applicable terms.

To secure the Service and prevent, detect, and respond to abuse, fraud, spam, security incidents, and violations of our Terms, including through automated systems.

To maintain, improve, and develop the Service, understand how it is used, and build new features.

To send you transactional and Service-related communications, and, where permitted, product or promotional messages you can opt out of.

To comply with legal obligations and enforce our Terms, and to establish, exercise, or defend legal claims.

To create and use aggregated or de-identified data that no longer identifies you, for analytics, research, security, benchmarking, and improving and developing the Service. We maintain and use such data only in de-identified form and do not attempt to re-identify it, except as permitted by law.

Where the EU or UK GDPR applies and we act as a controller, we rely on the following legal bases: performance of a contract, to provide the Service you request and administer your Account and purchases; our legitimate interests, to secure and improve the Service, prevent abuse, and run our business, balanced against your rights; consent, where we ask for it, such as for certain optional communications or technologies (which you may withdraw at any time); and legal obligation, to comply with applicable law.

Where BloxCord processes Subject Data as a processor on an Organization's behalf, the Organization is responsible for establishing a lawful basis for that processing and for providing required notices and obtaining any required consents.

Where consent is required for certain technologies or processing, such as non-essential cookies, device or browser fingerprinting, or precise geolocation, we will ask for it through an in-product prompt or banner where and as required by law, and you may withdraw your consent at any time. Withdrawing consent does not affect processing carried out before the withdrawal.

We use automated systems, including artificial intelligence, to help operate, secure, and support the Service, to respond to support requests, and to detect and act on suspected violations of our Terms, which may include automatically restricting, suspending, or terminating Accounts or Organizations.

These automated processes may be imperfect. Where you believe an automated decision affecting you was made in error, you may contact us at help@starsol.io to request review. Nothing here limits any rights you may have under applicable law regarding automated decision-making.

Where you use our Age Check feature, we capture a short series of images of you and process them through an automated, AI-based age-estimation system. The estimated age is compared against the age and date of birth you provide to help confirm your eligibility.

These images are processed only by automated systems. They are not shown to, or manually reviewed by, our staff, and they are deleted after the automated review completes. We use the images, and any facial-geometry or biometric signals derived from them, solely to estimate your age and verify eligibility, and not to identify you or for any other purpose.

Age estimation may be carried out with the help of a third-party AI provider that processes the images on our behalf to return an age estimate. Because this can involve biometric or similar data, we rely on your consent where required by law. You can choose not to use the Age Check feature, although some features or access may then be unavailable to you.

When you complete an Age Check within an Organization, the results are made available to that Organization's Owners and Admins, as delegated by its permission roles. The information shared with them includes your declared age group (for example, 13–14, 15–17, or 18–20), the age group estimated by our AI, the number of unique devices on which the Age Check was accessed, and your liveness status (whether you correctly completed the liveness-detection tasks). We do not share the underlying images with the Organization.

Service providers and processors: we share information with vendors that help us run the Service, including Stripe (payment processing), Cloudflare (image hosting, storage, CDN, and delivery), and our hosting and database infrastructure providers. They may process data only to provide services to us.

Roblox and Discord: we exchange data with these platforms through their APIs to provide connected features, based on the permissions you grant. Their own privacy policies govern data held on their side.

Within Organizations: Content and Subject Data you contribute to an Organization are visible to that Organization's Owners, Admins, and, depending on configuration, Members, and are controlled by the Organization.

Roblox experiences via our API: Organizations can configure their Roblox experiences to request data from the Service through our API. When they do, information from BloxCord may be exposed to, and used within, that Roblox experience. The Organization is responsible for how it requests, displays, and uses that data.

Discord role binds: where enabled, the Service can assign or remove Discord roles based on conditions you or an Organization configure, such as being on a leave of absence, your birthday, the roles you hold in the BloxCord permission system, your Roblox group or community rank, and other available binds. Because Discord roles are visible to others in a server, these role changes may reveal related information about you (for example, that you are on leave or that it is your birthday) to other members.

Legal and safety: we may disclose information where required by law, legal process, or governmental request, or where necessary to protect the rights, property, safety, or security of BloxCord, our users, or the public, and to enforce our Terms.

Business transfers: if we are involved in a merger, acquisition, reorganization, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising.

The Service depends on third-party platforms and providers, including Roblox, Discord, Stripe, and Cloudflare. Your use of features that rely on them is also subject to their terms and privacy policies for the portions of the Service they power.

If you configure webhooks, you are responsible for the endpoints you point them at and for the data you send to them; we are not responsible for third-party systems that receive that data. We are not responsible for the privacy practices of third-party sites, servers, or destinations you access through the Service.

We use cookies, local storage, session keys, and authentication tokens to operate the Service, keep you signed in, secure your session, remember your preferences, and understand and improve how the Service is used.

We use these technologies primarily for essential and functional purposes. You can control cookies through your browser settings, but disabling essential cookies may prevent parts of the Service from working, including sign-in.

We also use device and browser fingerprinting, which combines characteristics of your device, browser, and connection into a probabilistic identifier. We use fingerprints for security, fraud and abuse prevention, account and session integrity, detecting ban or suspension evasion and duplicate accounts, and enforcing our Terms. Because a fingerprint is derived from your device and browser rather than stored solely in a cookie, it may not be fully avoidable by clearing cookies or browser storage.

We retain personal information for as long as needed to provide the Service, maintain your Account and Organizations, comply with our legal obligations, resolve disputes, prevent abuse, and enforce our agreements.

When you delete your Account or Content, or when an Organization deletes data, we remove or de-identify the associated information within a reasonable period, except for copies retained in backups or as required by law. Backups are retained on a rolling basis and purged in the ordinary course. We may treat inactive Accounts or Organizations as dormant and reclaim, restrict, or delete them and their data, subject to applicable law.

Removal from the Service may not immediately purge cached copies delivered through our content-delivery provider.

We use technical and organizational measures designed to protect personal information, including encryption in transit, access controls, authentication tokens and session keys, rate limiting, and a web application firewall.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials and connected sessions and for notifying us promptly at help@starsol.io if you suspect unauthorized access.

If we become aware of a data breach that affects your personal information, we will notify you and the relevant supervisory authorities where and as required by applicable law, and we will take reasonable steps to investigate, contain, and mitigate the incident.

We are based in the United States, and we and our providers may store and process information in the United States and in other countries where we or they operate. These countries may have data-protection laws different from those in your country.

Where we transfer personal information across borders in a way that requires safeguards, we rely on appropriate mechanisms, such as the European Commission's standard contractual clauses and the UK international data transfer addendum, or another lawful transfer mechanism.

Depending on where you live, you may have rights to access the personal information we hold about you, to correct inaccurate information, to delete it, to receive a portable copy, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.

To exercise these rights, contact us at help@starsol.io. We will respond within the time required by applicable law and may need to verify your identity. Exercising your rights will not result in discriminatory treatment.

Where BloxCord processes Subject Data as a processor for an Organization, please direct your request to that Organization; we will assist the Organization as required. You may also have the right to lodge a complaint with your local data-protection authority.

Because BloxCord operates in the Roblox ecosystem, the Service may process data about children, including players under the age of 13, primarily as Subject Data collected by Organizations about the players in their groups and experiences.

The Service is not directed to children for the creation of an Account, and you must meet the eligibility requirements in our Terms to hold an Account. We handle children's data in accordance with the U.S. Children's Online Privacy Protection Act (COPPA) and applicable law. As controllers, Organizations are responsible for any parental-notice and consent obligations that apply to their players.

If you are a parent or guardian and believe we or an Organization hold a child's data without a proper basis, contact us at help@starsol.io and we will take appropriate action.

If you are a California resident, the CCPA/CPRA gives you rights to know and access the categories and specific pieces of personal information we collect, to correct inaccurate information, to delete personal information, and to be free from discrimination for exercising your rights.

In the past 12 months, we have collected the categories of personal information described in the "Information We Collect" section, for the business purposes described in "How We Use Your Information," and disclosed them to the categories of recipients described in "How We Share Information." We do not sell personal information and do not share it for cross-context behavioral advertising.

To exercise your rights, contact us at help@starsol.io. You may use an authorized agent, and we will verify requests as permitted by law.

Some information we handle, such as precise geolocation, device motion data, or images and biometric signals processed for age verification, may be considered sensitive personal information under the CPRA. We use and disclose it only for purposes such as providing and securing the Service, verifying age, and preventing fraud and abuse, and not to infer characteristics about you beyond estimating your age. We do not sell or share sensitive personal information, and we do not use it in a way that would give rise to a right to limit its use.

If you are a resident of a US state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others as they take effect), you may have rights similar to those described above, including to confirm whether we process your personal information, to access, correct, delete, and obtain a portable copy of it, and to opt out of the sale of personal information, targeted advertising, and certain profiling. We do not sell personal information, engage in targeted advertising, or use personal information for profiling that produces legal or similarly significant effects.

To exercise these rights, contact us at help@starsol.io. If we deny your request, you may appeal by replying to our response; if you have concerns about how we handled an appeal, you may contact your state attorney general. Nevada residents may submit a request regarding the sale of covered information, although we do not sell such information.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by reasonable means, such as in-app notice or email, or by updating the date below. Changes take effect on the date stated, and your continued use of the Service after that date constitutes acceptance of the updated Policy.

Questions or requests about this Privacy Policy or your personal information can be sent to help@starsol.io, or by mail to Starstruck Solutions LLC, 1007 N Orange Street, #3029, Wilmington, DE 19801, United States of America.

You can also reach us in our support Discord at https://discord.gg/ewBeYh2ANy.

If you are in the EEA or the UK and we are required to designate a representative or a data protection officer, their contact details will be provided here. Until then, you may contact us at help@starsol.io for any data-protection matter, and you may also lodge a complaint with your local supervisory authority.