Privacy Policy

01Who we are

roflex.xyz ("roflex", "we") is a fan-made site for showing the Roblox accounts you own in one public collection. We are not affiliated with, endorsed by or run by Roblox Corporation. Questions about this policy go to support@roflex.xyz.

02What we collect

When you sign in with Roblox. We use Roblox OAuth 2.0 and only ask for the openid and profile scopes. From Roblox we receive:

• your Roblox user ID, username and display name
• your profile link, avatar picture and account creation date
• an access token and a refresh token that let us read that profile information again

We never see or store your Roblox password, email, phone number, Robux balance or payment details. We can't log in to Roblox as you or change anything on your Roblox account.

Public Roblox data. For each linked account we look up public information through Roblox's public APIs: avatar thumbnails and, if your inventory is public, your collectible items and their values (including whether you own items such as Headless or Korblox). We keep a cached copy so pages load quickly.

What you add on roflex. Your profile handle, display name, bio, banner choice or banner image link, which accounts are public or pinned, each account's status (showcase, open to offers or for sale), prices and sale notes.

Offers and buy requests. If you send or receive an offer, we store the amount, your optional message, who sent it, which account it's for and its status (pending, accepted, declined or withdrawn).

Bio-code verification. If you link an account with a one-time code in your Roblox About section, we read that account's public About text to check the code.

Basic technical data. Like most sites, our hosting provider may log IP addresses, browser type and request times for security and debugging. We don't run advertising trackers or sell analytics data.

03How we use it

• To sign you in and keep you signed in.
• To prove you own each Roblox account you link, and mark it verified.
• To show your public profile, linked accounts and items to visitors.
• To deliver offers and buy requests between users.
• To keep the site safe, for example blocking banned users and investigating abuse.

04What other people can see

Your profile at /u/your-handle is public. Anyone can see your handle, display name, avatar, bio, banner and the linked accounts you've made public, along with their usernames, avatars, items and any status or price you set.

Accounts you mark as private stay off your public profile. Offers are only visible to the buyer and the account's owner.

05How we store and protect it

Data is kept in a PostgreSQL database hosted by Neon. Roblox access and refresh tokens are encrypted before they are saved. Your login session is a signed cookie (roflex_session) that is HTTP-only and expires after 30 days. During sign-in we also set short-lived cookies to protect the login from tampering; they are deleted when sign-in finishes.

No system is perfectly secure, but we limit what we collect and protect what we keep.

06Who we share it with

We don't sell your personal information. We only share it with:

• Roblox, when we sign you in or request public data about your accounts;
• service providers that run the site for us, such as our database (Neon) and web hosting;
• authorities, if the law requires it or it's needed to protect people from harm.

We don't process payments today, so no payment provider receives your data.

07How long we keep it

We keep your data while your profile exists. If you remove a linked account in My collection, its tokens, cached inventory and offers are deleted with it. If you ask us to delete your profile, we delete it and everything tied to it, except records we must keep for legal or safety reasons.

08Your choices and rights

• Make any linked account private, or remove it, from My collection.
• Edit your profile details at any time.
• Sign out to end your session on that device.
• Revoke roflex's access in your Roblox account settings under the OAuth apps you've authorized.
• Email support@roflex.xyz to get a copy of your data, correct it, or delete your profile. Depending on where you live (for example the EU, UK or California), you may have more rights under local law, and we'll honor them.

09Children

roflex isn't meant for children under 13. If you are under the age of digital consent where you live, use roflex only with a parent or guardian's permission. If you believe a child under 13 has given us personal information, email support@roflex.xyz and we will delete it.

10Changes to this policy

If we change what we collect or how we use it, we'll update this page and its date. Big changes will be shown on the site before they take effect. Also see our Terms of Service.