What we keep, and why
What Thumblox collects, why, who helps us run it and how long we keep it. The short version: what we need to log you in and make your builds, and nothing for ads.
This is a draft that will be reviewed before Thumblox opens to the public.
Privacy policy · Version 2026-10-25
Who's responsible
[Company name and address] runs Thumblox and is responsible for your data. Questions about privacy go to [Contact email].
What we collect and why
- Your email
To log you in and send your magic links.
If you use Google or Discord, they send us your email and an account id, and may also send the name and picture on that account. Supabase stores what they send. Thumblox doesn't show or use that name or picture.
- A display name
- Only if you set one in Settings. We never take it from your email or your Google or Discord name.
- Your age check
When you sign up you tick a box to confirm you're 13 or older. We don't ask for your birthday.
We keep only that you confirmed it and when, plus which version of the Terms you agreed to and when.
- Your builds
- Your prompts, the style and headline text you pick, the references you upload and the images you get back. We need them to make your images, show your history and let you download them again.
- Your Roblox avatar
- Only if you add it: the username you type and a copy of the avatar picture, to use as a reference.
- Your blox history
- Every grant, spend and refund, so your balance is always right.
- Gallery activity
- Which builds you shared and which ones you liked.
- Reports you file
- The build, the reason and any note you add, so a moderator can look at it.
- Log in protection
A hashed version of your IP address and of your email, to limit how often links can be asked for. Kept 2 days.
Hashed means we store a scrambled code made from the value, not the value itself.
- Free plan check
- A hashed version of your email, so each person gets the free blox once a month, even after deleting and remaking an account. Kept about 13 months.
- Banned accounts
- If a banned account is deleted, we keep a hashed version of its email so it can't sign up again.
- Technical logs
Our providers keep technical logs. Supabase keeps a record of each log in, with the email address and IP address used.
[What these logs hold and how long they are kept]
- Payments
- When paid plans open, Stripe takes your card details on its own page. We'll keep your plan and a Stripe customer id, never your card number.
[Legal basis for each use, from legal review]
Who helps us run Thumblox
- Supabase
- Accounts, the database and file storage, in an EU region.
- Kie.ai
Our AI provider. It gets your prompts and reference images to make your images. It also gets your prompts to check them before you spend blox, and to write Boost briefs.
[Where Kie.ai processes data and how long it keeps it]
- Cloudflare Turnstile
- The quick bot check on the log in page. It sees your IP address and details about your browser.
- Vercel
Hosts the website.
[Hosting region]
- Stripe
- Payments, once paid plans open. Your card details go to Stripe, not to us.
- Email delivery
Sends your magic links.
[Email provider]
- Roblox
- Only when you add your avatar: we send Roblox the username you type to fetch the picture.
[Transfers outside the EU and the safeguards used]
How long we keep it
- Your account and builds
- Until you delete them, or your account.
- Sign-ups never confirmed
- Deleted after 1 day if the email link was never used.
- No age or Terms answer
- Accounts that never confirmed their age and the Terms are deleted after 7 days.
- Deleted accounts
Removed at once, with their files. Copies in database backups go when those backups expire.
[Backup period]
- Reports you filed
- Stay after you delete your account, without your name or the note you wrote.
- Reports about your builds
If someone reports a build you shared, the report keeps a copy of its prompt for moderators, even if the build or your account is deleted.
[How long reports are kept]
- Log in protection
- 2 days.
- Free plan check
- About 13 months.
- Banned emails
The hashed email of a banned account has no end date yet.
[How long ban records are kept]
Your choices and rights
In Settings you can change your display name, download your data as a file and delete your account.
You can also ask us what we hold about you, ask us to correct it or limit how we use it, or object to a use. Email [Contact email].
You can complain to a data protection authority. [Lead supervisory authority]
Children
- Thumblox is for 13 and up. If the age check at sign-up says under 13, no account is made and the form stays closed on that device for 24 hours.
- If an account answers under 13 when we ask again, for example after the Terms change, it's deleted at once.
- Paid plans need you to be 18 or older, or to have a parent's or guardian's permission.
If you think a child under 13 has an account, tell us at [Contact email].
Changes to this policy
If this policy changes in a way that matters, we'll ask you again in the app. This is version 2026-10-25.
Contact
[Company name and address] · [Contact email]