Privacy Policy

1. INTRODUCTION AND DEFINITIONS

This Privacy Policy explains how Bloxino ("we, us, our, ours, etc."), the owner and operator of www.bloxinox.com and any affiliated websites and related mobile versions ("Bloxino"), collects, uses, stores, shares, and protects information about you ("you, your, yours, etc.") when you access Bloxino or use our services ("Services"). This Privacy Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined here have the meaning given to them in the Terms of Service.

Bloxino is not affiliated with, endorsed by, or sponsored by Roblox Corporation. "Roblox," "Robux," and all related names, marks, and logos are trademarks of Roblox Corporation, used herein solely for identification purposes.

As used in this Privacy Policy:

"Personal Information" means information that identifies, relates to, or could reasonably be linked with you, such as your email address, your Roblox account details, and cryptocurrency wallet addresses you provide.

"Account Data" means the information associated with your Bloxino account, including your balance of BT, gameplay statistics, game state, provably-fair data, and activity history.

"BT" (short for "Bloxino Tokens") means the internal virtual currency on Bloxino, as defined in the Terms of Service.

2. SCOPE AND ACCEPTANCE

This Privacy Policy applies to information we collect through Bloxino and the Services. By accessing Bloxino or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you must not access Bloxino or use the Services. This Privacy Policy does not apply to information collected by any third party, including Roblox Corporation, cryptocurrency networks, or any third-party website or service that may be linked to or from Bloxino, whose data practices are governed by their own policies.

3. CHANGES TO THIS POLICY

We reserve the right to revise this Privacy Policy at any time. All modifications or changes are in force and enforceable immediately upon posting. The updated version supersedes any prior versions immediately upon posting. If we change this Privacy Policy, we will change the "Last Updated" date at the top of this page. You agree to re-visit this page on a frequent basis. If the "Last Updated" date has changed, you must review the updated Privacy Policy in its entirety. Your continued use of Bloxino after any change constitutes your acceptance of the updated Privacy Policy.

4. INFORMATION WE COLLECT

We collect the following categories of information:

4.1 Information You Provide

When you register for and use an account, you provide us with:

• Email address. Used to identify and communicate with you about your account.
• Password. We never store your password in plain text. It is stored only as a salted cryptographic hash (scrypt), from which the original password cannot practically be recovered.
• Roblox username. You provide a Roblox username when you register, which we use to look up and link your Roblox account (see Section 4.2).
• Cryptocurrency wallet addresses. If you choose to save a Bitcoin or Ethereum address for the purpose of making cryptocurrency deposits, we store that address on your account. Each address must be unique across all users; we store a normalized (lowercased, whitespace-trimmed) form of each address in a dedicated crypto_addresses table to enforce this uniqueness, and we associate each address with your account so it is traceable to you. Addresses are also stored within your account's crypto_info JSON field for display and pre-filling purposes in the deposit interface.
• Two-factor authentication secret. If you enable two-factor authentication, we store the shared secret required to verify your one-time codes.
• Support communications. Any information you provide when you contact us for support.

4.2 Information From Roblox

When you enter a Roblox username during registration, we send that username to Roblox's publicly available application programming interfaces (APIs) in order to (i) confirm the Roblox account exists, (ii) retrieve the associated Roblox user ID and display name, and (iii) retrieve the account's public avatar thumbnail image. We store the Roblox user ID, username, and avatar image URL on your account. We only access publicly available Roblox information; we do not receive your Roblox password or any private Roblox account details.

4.3 Gameplay and Account Data

As you use the Services, we automatically generate and store data associated with your account, including:

• BT balance and changes to it;
• Gameplay statistics, such as the number of rounds played, wins, losses, total amounts wagered and returned, largest win, largest multiplier, and win/loss streaks, including a per-game breakdown;
• In-progress game state for round-based games (such as an unfinished Mines, Tower, Road Crossing, or Crash round);
• Provably-fair data, including server seeds, the hash of the server seed, your client seed, and a nonce counter, which together allow game outcomes to be independently verified;
• Activity history, being a record of recent transactions and bets on your account (deposits, cash-outs, and game results). This history is capped at a limited number of the most recent entries.

4.4 Publicly Visible Information

Bloxino displays a real-time "live bets" feed that is visible to all users. When you place a bet, that feed may publicly display your Roblox username, your Roblox avatar image, the game you played, the amount you bet, the resulting multiplier, and the payout. This information is shown to other users and is not private. Do not use the Services if you do not wish this gameplay information to be visible to others.

4.5 Cookies and Local Storage

We use a single essential cookie to keep you logged in. This is a signed authentication cookie that contains your username together with a cryptographic signature; it is set as "HTTP-only" (meaning it is not accessible to client-side scripts) and expires after approximately thirty (30) days. We also store a small flag in your browser's local storage to remember that you have acknowledged our age and consent notice, so that it is not shown to you repeatedly. We do not use cookies for advertising or third-party tracking.

4.6 Technical and Log Data

Our infrastructure and hosting providers automatically process certain technical information necessary to operate the Services, which may include your Internet Protocol (IP) address, browser type, device information, and request logs. We may also record server-side operational logs of certain account actions, including cash-out requests and saved cryptocurrency addresses, for security, fraud-prevention, and record-keeping purposes. We do not use third-party advertising networks or third-party analytics trackers on Bloxino.

4.7 Cryptocurrency Deposit Data

When you send cryptocurrency to one of our master wallet addresses, we use an automated server-side scanner that queries public blockchain APIs to detect incoming transactions. For each deposit detected, we collect and store: the transaction hash (TXID); the sender wallet address; the type of cryptocurrency (Bitcoin or Ethereum); the amount sent in both decimal form and the blockchain's native smallest unit; the USD and AUD value of the deposit at the time it was processed, calculated using CoinGecko's public price API; the number of blockchain confirmations at the time of processing; whether the deposit has been credited to your account and the date and time of crediting; and the number of BT credited to your account as a result. This data is stored in a dedicated crypto_deposits table and is linked to your account via your user ID. We collect this data to accurately credit your account, maintain an auditable deposit history, prevent fraud, and comply with anti-money-laundering obligations. The scanner matches the sender address from the blockchain transaction to the cryptocurrency wallet address you saved on your account. Only deposits sent from an address that matches a saved address on your account will be credited to you. Deposits from unsaved or unrecognized addresses are not credited.

5. HOW WE USE INFORMATION

We use the information we collect to:

• create, operate, secure, and maintain your account and the Services;
• authenticate you and keep you logged in;
• process purchases of BT and cash-outs, and maintain accurate balances;
• operate the Games, resolve outcomes, and enable provably-fair verification;
• display the public live-bets feed and gameplay statistics;
• enforce the uniqueness of cryptocurrency wallet addresses and trace addresses to the accounts that submitted them;
• monitor our master wallet addresses for incoming cryptocurrency transactions, match sender addresses to saved user wallet addresses, and credit user accounts with the appropriate amount of BT based on the deposit value at the current market rate;
• maintain a complete and auditable record of all cryptocurrency deposits, including transaction hashes, amounts, and conversion rates;
• detect, investigate, and prevent fraud, abuse, money laundering, and violations of our Terms of Service;
• respond to your support requests and communicate with you about your account;
• comply with applicable legal obligations and enforce our legal rights.

6. HOW WE SHARE INFORMATION

We do not sell your Personal Information. We share information only as described below.

6.1 Service Providers

We rely on third-party service providers to operate Bloxino, and your information is stored and processed on their infrastructure. These include our database provider, which hosts your account records in a managed PostgreSQL database, and our application-hosting provider, which serves Bloxino. These providers process data on our behalf and are only permitted to use it to provide services to us. Access to our database is restricted; database access controls are enabled so that account records are accessible only through our server using a privileged service credential that is never exposed to your browser.

We also use the following third-party services for cryptocurrency deposit processing. Blockchain.info API: we query Blockchain.info's public API to retrieve transaction data for our master Bitcoin wallet address. Etherscan API: we query Etherscan's public API to retrieve transaction data for our master Ethereum wallet address. CoinGecko API: we query CoinGecko's public price API to obtain the current USD exchange rate for Bitcoin and Ethereum at the time a deposit is processed, as well as the USD-to-AUD exchange rate. No personal information is transmitted to CoinGecko. Each of these services' handling of data is governed by its own privacy policy.

6.2 Roblox

As described in Section 4.2, when you register we transmit the Roblox username you enter to Roblox's public APIs in order to look up and link your Roblox account. This transmission is necessary to provide the Services. Roblox's handling of that request is governed by Roblox Corporation's own privacy policy, over which we have no control.

6.3 Legal, Safety, and Anti-Money-Laundering

We may disclose information where we believe in good faith that doing so is necessary or appropriate to: comply with applicable law, regulation, legal process, or governmental request; enforce our Terms of Service; detect, prevent, or address fraud, security, or technical issues; monitor for and report suspicious transactions to financial regulators or law enforcement; or protect the rights, property, or safety of Bloxino, our users, or others. This includes disclosure of cryptocurrency deposit records, wallet addresses, and transaction data.

6.4 No Sale of Personal Information

We do not sell, rent, or trade your Personal Information to third parties for their own marketing purposes.

7. COOKIES AND LOCAL STORAGE

Bloxino uses only the minimum browser storage necessary to function. Specifically: (i) an essential, HTTP-only, signed authentication cookie that keeps you logged in and expires after approximately thirty (30) days; and (ii) a small local-storage flag recording that you have acknowledged our age and consent notice. Because the authentication cookie is strictly necessary to provide the Services, it cannot be disabled while continuing to use your account. If you clear your cookies or local storage, you will be logged out and will be shown the age and consent notice again. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies.

8. DATA RETENTION

We retain your Account Data and Personal Information for as long as your account remains active and for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements. Your activity history is retained only up to a capped number of the most recent entries, with older entries being discarded automatically. The public live-bets feed retains only a small number of the most recent bets in temporary server memory and is not a permanent record. When you delete your account, we delete or de-identify your associated account records, except where retention is required for legal, security, fraud-prevention, or record-keeping purposes. Cryptocurrency deposit records in the crypto_deposits table are retained for as long as your account exists and for a reasonable period thereafter for audit, fraud-prevention, and legal compliance purposes. Saved cryptocurrency wallet addresses are deleted when you delete your account, unless retention is required for legal or fraud-prevention purposes.

9. DATA SECURITY

We implement reasonable technical and organizational measures designed to protect your information. These include storing passwords only as salted scrypt hashes, signing authentication cookies to prevent tampering, marking authentication cookies as HTTP-only, and restricting database access so that account records are reachable only through our server using a privileged credential that is never sent to your browser. However, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security, and you provide your information at your own risk. You are responsible for keeping your password and account credentials confidential and for enabling two-factor authentication where you wish to add an additional layer of protection. The cryptocurrency deposit scanner runs entirely server-side and uses a privileged database credential stored in environment variables that is never exposed to the browser.

10. YOUR RIGHTS AND CHOICES

Depending on your jurisdiction, you may have rights regarding your Personal Information, including the right to access, correct, update, or delete it, and to object to or restrict certain processing. You can exercise many of these choices directly:

• Access and update. You may view and update certain account information, including your saved cryptocurrency addresses and two-factor authentication settings, through your account.
• Deletion. You may request deletion of your account by contacting us. Having your account deleted causes you to forfeit any BT remaining in it, as described in the Terms of Service. You should cash out any BT before requesting deletion.
• Other requests. To make any other privacy request, contact us using the details in Section 15. We may need to verify your identity before acting on a request.

We will honor rights and requests as required by applicable law. We may decline requests where permitted by law, including where fulfilling them would compromise the privacy of others, our security, fraud-prevention obligations, or legal record-keeping requirements.

11. AGE RESTRICTION

Bloxino is intended solely for users who are eighteen (18) years of age or older and at least the age of majority in their jurisdiction. Bloxino is not directed to children, and we do not knowingly collect Personal Information from anyone under the age of eighteen (18). If we become aware that we have collected Personal Information from a person under eighteen (18), we will take steps to delete that information and terminate the associated account. If you believe a person under eighteen (18) has provided us with Personal Information, please contact us using the details in Section 15.

12. INTERNATIONAL DATA TRANSFERS

We and our service providers may store and process your information in countries other than the one in which you reside, including the United States. Data-protection laws in those countries may differ from those in your jurisdiction. By using the Services, you consent to the transfer of your information to such countries for the purposes described in this Privacy Policy.

13. THIRD-PARTY LINKS AND SERVICES

Bloxino may contain links to third-party websites and services, including Roblox and cryptocurrency networks. We do not control and are not responsible for the privacy practices or content of those third parties. When you follow a link to a cryptocurrency address or make a blockchain transaction, that transaction is recorded on a public blockchain that we do not control and cannot alter or erase. We encourage you to review the privacy policies of any third-party service you interact with. The public nature of blockchains means that your transaction details, including the sender and receiver addresses and the amount sent, are permanently visible to anyone.

14. DO NOT TRACK

Because we do not use third-party advertising or cross-site tracking technologies, Bloxino does not respond differently to "Do Not Track" signals sent by your browser. We treat all users' data in accordance with this Privacy Policy regardless of any Do Not Track setting.

15. CONTACT

If you have any questions, concerns, or requests regarding this Privacy Policy or your information, you may contact us at support[at]bloxinox[dot]com. Notices to you may be provided by email or by a general posting on Bloxino.