Limblox Ltd. runs Limblox, a marketplace for buying and selling Robux. We are responsible for the personal data described here. Contact us at [email protected] or through our support page about this policy or your data.
What we collect and why
- Accounts and sign-in. We keep your name, email, profile image if supplied, sign-in method, password hash when you use a password, and session records. Sessions can include an IP address and browser details. We use these to let you sign in, protect your account, and link orders and wallet activity to you. Google sign-in shares the information needed to authenticate you with Google when you choose it.
- Roblox accounts and delivery. We keep Roblox user IDs, usernames, account and group details, balances, and the recipient of a purchase. Sellers who connect an account give us a Roblox session cookie and, if they enable Auto 2FA, its secret. We use these credentials to check seller access, sync stock, and perform the delivery or payout steps that need Roblox access. We send the relevant account and recipient details to Roblox.
- Orders and money. We keep a buyer or guest email, order and payment status, amounts, transaction references, wallet balance activity, and seller withdrawal details such as a crypto address and transaction hash. We use these to take payment, deliver Robux, send receipts, handle refunds, and pay sellers. OxaPay receives the details needed to create and settle crypto payments and withdrawals. Wallet balance stays in our own order and wallet records.
- Support and safety. We keep support messages and their order or account context so we can answer you. We also keep IP addresses, user agents, security events, and error details to prevent abuse and diagnose failures. hCaptcha processes challenge responses on forms that use it.
- Usage and attribution. We record page views and product events in our self-hosted OpenPanel service to understand how the marketplace works. We use referral and campaign cookies to attribute visits. These cookies last up to 30 days. Login and reset cookies are used for account access and recovery.
Who receives data
Our hosting handles requests and stores the marketplace database. Cloudflare handles traffic before it reaches us and can see network request details. We use Resend to send account, order, and support email, so it receives the recipient address and message. For a completed order, a configured Trustpilot review invitation trigger sends the Roblox username on the order, the buyer's email, the order reference, type, amount, and order link through Resend to Trustpilot.
Seller Roblox traffic can go through IPRoyal proxies, which handle the connection to Roblox. hCaptcha receives challenge data when you complete a protected form. Our self-hosted Soketi service handles live update channels and event payloads. Our in-house support inbox keeps those conversations in our database.
Legal bases
We use account, order, seller, and payment information to provide the marketplace you request. We use security logs, support records, and product measurements for our legitimate interests in operating, protecting, and improving it. We may keep transaction records to meet legal obligations. Where a specific feature asks for consent, you can withdraw that consent; this does not undo processing that happened before withdrawal.
Storage, retention, and security
Account, order, seller, wallet, withdrawal, support, and security records are stored in our database. Most of these records are not deleted automatically. Login sessions have expiry times. A cleanup job removes sampled production error occurrences after 30 days, or after 7 days for ignored occurrences. Error groups can remain. Referral and campaign cookies expire after 30 days. Other providers may keep data under their own retention rules.
A Roblox session cookie can grant access to a seller's Roblox account. We use them only for the seller connection and delivery workflows, restrict access to the database that holds them, and are adding encryption at rest for them. Do not share these credentials in support messages. If you disconnect an account, its record can be marked deleted; that does not mean every related transaction record disappears.
International transfers
Some providers and Roblox may process data outside your country. This includes Google sign-in, OxaPay, Resend, Trustpilot, IPRoyal, and hCaptcha when you use their features. Contact support if you want details about a particular transfer.
Your choices and rights
You can ask us for access to your data, correction, deletion, restriction, or a portable copy. You can object to processing based on legitimate interests. Some requests may be limited by transaction or legal record requirements. Email [email protected] or use the support page. We may need to verify that the data belongs to you. If you are in the EEA, you can also complain to your local data protection authority.
Young users
Our Terms do not currently state a minimum age. If you are a parent or guardian with a question about a young person's data, contact [email protected].
Changes
We may update this policy when our data practices change. The date at the top shows when we last updated it. For questions, contact [email protected].