Privacy Policy

1. What this covers

This policy covers the BloxCircle website operated by [LEGAL ENTITY NAME]. It does not cover the advertisers and offer networks you are handed to when you click an offer — those are separate companies with their own privacy policies, and you leave our site when you go to them.

2. What we collect

Account information

• The username you chose for BloxCircle. It is your own choice and does not have to match your Roblox name.
• A one-way hash of your password. We never store the password itself and cannot recover it.
• The numeric ID of your Roblox account, once you link it. We do not receive or store any Roblox credentials.
• Your email address, once you provide one.
• Your birth year, to check the age requirement.
• Whether you opted in to marketing email.

Technical information

• Your IP address, and what we can derive from it: approximate country, network operator, and whether it is a VPN, proxy, Tor exit or datacenter connection.
• Your browser user agent and device characteristics.
• Sign-in times and the IP address each session was created from.

Activity on the site

• Which offers you click, and when.
• Which offers converted, what the network paid, and what we credited you.
• Your full balance history — every credit, reversal and adjustment.
• Claims you submit, and when a gift card code was revealed to you.
• Who referred you, and who you referred.

Support messages

Anything you send us, and our replies.

3. Where it comes from

• From you — signup, verification, support.
• From your device — IP address and user agent, sent automatically by your browser.
• From offer networks — when you complete an offer, the network sends us a server-to-server notification containing the offer, the payout, and the identifiers we attached when you clicked.
• From an IP reputation service — we look up whether your IP is a VPN, proxy or datacenter address.
• From Roblox’s public API — when you link your Roblox account, we read your public profile to find the short code you placed there. We never ask for, and never have, your Roblox password.

4. Why we use it

The right-hand column is the legal basis, for anyone whose local law works that way.

• To run your account and pay out rewards — creating your account, crediting offers, processing claims, delivering codes. Basis: performing our contract with you.
• To prevent fraud — this is the big one. Detecting duplicate accounts, VPN and datacenter traffic, falsified completions, and referral farming. IP addresses, device characteristics and the referral graph exist almost entirely for this. Basis: our legitimate interest in not being defrauded, and our obligations to the advertising networks.
• To keep records — accounting, tax, and evidence for disputes with a network or a user. Basis: legal obligation and legitimate interest.
• To send transactional email — verification, claim status, security notices. These are not marketing and you cannot opt out of them while holding an account. Basis: performing our contract.
• To send marketing email — only if you opted in, and every message carries a one-click unsubscribe. Basis: your consent, which you can withdraw at any time.

5. Who we share it with

We do not sell your personal data, and we do not share it for advertising or profiling by anyone else. We share the minimum necessary with:

• Offer networks (currently OGAds) — when you click an offer we pass your account handle and a click identifier so the completion can be credited back to you. The network independently receives your IP address and user agent, as it would for any site you visit.
• proxycheck.io — we send your IP address to check whether it is a VPN, proxy or datacenter connection.
• Resend — our email provider, which receives your email address and the content of messages we send you.
• Our hosting and database providers — which store the data on our behalf under contract.
• Law enforcement or regulators — where we are legally required to, or to investigate fraud.

6. Cookies

We use two first-party cookies, and no third-party advertising cookies.

• Session cookie — keeps you signed in. It holds a random token, not your details. Expires after 30 days, or when you sign out. The site does not work without it.
• Referral cookie— set when you arrive through someone’s invite link, so they get credited if you sign up. Expires after 30 days.

Clicking an offer takes you to an advertiser, which will set its own cookies under its own policy. We have no control over those.

7. How long we keep it

• Your account — while it exists, and 12 months after you close it.
• Balance history, offer completions and network notifications — kept indefinitely. These are financial records and the evidence trail for disputes with an advertising network, which can be raised long after the fact.
• IP reputation lookups — re-checked periodically; addresses move between networks.
• Support messages — 24 months.

Being straight about the conflict here: a deletion request and a fraud-prevention record pull in opposite directions. When you ask us to delete your data, we anonymise your account — removing your username, email and IP addresses — but retain the underlying transaction and completion rows with your identity stripped out. Deleting those outright would let a suspended account return by asking to be forgotten first, and would leave us unable to answer an advertiser’s query about a payment.

8. Your rights

Depending on where you live you may have the right to access, correct, delete, export, or object to our use of your data, and to withdraw consent. Regardless of where you live, we will honour all of the following:

• A copy of the data we hold about you.
• Correction of anything wrong.
• Deletion, on the anonymisation basis described in section 7.
• An export of your account and balance history.
• Marketing opt-out, immediately and permanently.

Email privacy@[YOURDOMAIN] from the address on your account, or contact us from the account itself. We respond within 30 days and never charge for it.

If you are unhappy with how we handled a request you can complain to your local data protection authority.

9. Children

BloxCircle is for people aged 13 and over. We ask for your birth year at signup and block accounts below that age.

We do not knowingly collect data from children under 13. If we learn that we have, we delete the account and its personal data. If you are a parent or guardian and believe your child has signed up, email privacy@[YOURDOMAIN] and we will remove it.

10. How we protect it

• Sign-in tokens are stored only as a one-way hash. A copy of our database would not let anyone into your account.
• Passwords are hashed with bcrypt and never stored in readable form. Nobody at BloxCircle can see your password.
• Gift card codes are encrypted in the database and decrypted only at the moment they are shown to you.
• Gift card codes are never sent by email and never written to our logs.
• Access to production data is limited to staff who need it, and every staff action on an account is logged.

No system is perfectly secure. If a breach affects you, we will tell you and the relevant regulator as required by law.

11. International transfers

Our providers may process data outside your country, including in the United States. Where the law requires a transfer safeguard, we rely on standard contractual clauses with those providers.

12. Changes and contact

We will update this policy as the site changes and revise the date at the top. If a change materially affects how we use your data, we will tell you rather than relying on you re-reading this page.

[LEGAL ENTITY NAME]
Privacy and data requests: privacy@[YOURDOMAIN]
Everything else: support@[YOURDOMAIN]