BuxyBuxy

Privacy Policy

Last Updated: September 7, 2026

1. Introduction

Buxy ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access our website and application (the "Service").

By using the Service, you consent to the data practices described in this policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Data Controller

The data controller responsible for your personal data is Andrea, contactable at support@buxyapp.com.

3. Data We Collect

We collect information that identifies, relates to, describes, or could reasonably be linked to you ("Personal Data").

  • Account Data: Roblox username, Roblox user ID, display name, and avatar URL. If you link an OAuth provider (Google, Discord), we store the associated email address.
  • Roblox Account Connection: You can sign in with Roblox using Roblox OAuth 2.0. We never see or ask for your Roblox password — you authenticate on Roblox's own site, and Roblox tells us only that the sign-in succeeded. Under the openid and profile scopes we receive your Roblox user ID, username, display name, and avatar image URL, and nothing else. We do not request access to your Robux, your inventory, your friends, your messages, or any experience you own or play. You can revoke Buxy's access at any time from your Roblox account settings.
  • Technical Data: IP address, browser type, device information, operating system, and access times.
  • Usage Data: Offer completions, survey responses, reward history, transaction records, and quest progress.
  • Market Research Profile Data (optional): If you choose to unlock market research surveys, you may voluntarily provide demographic information — first and last name, email address, gender, date of birth, and postal address (street, city, state/province, ZIP/postal code, country) — together with the devices you use. This information is transmitted directly to our survey partner AdscendMedia to build your survey profile and match you with eligible surveys; we do not store this demographic data on our own servers. This feature is optional and intended for adults aged 18 or over.
  • Community Chat Data: If you use the community chat, we store the messages you send, your username and avatar, timestamps, and any reports or moderation actions taken. Chat messages are public to other signed-in users.
  • Device Fingerprint: We use FingerprintJS to generate a unique device identifier for fraud prevention. This does not collect personal information but creates a hash based on browser and device characteristics. To be precise about what this is and is not: it fingerprints the browser you are using on buxyapp.com, to stop one person farming rewards from many accounts. It is not used to identify Roblox users, to recognise you anywhere outside buxyapp.com, or to enrich anything we receive from Roblox.
  • Cookies & Local Storage: We use cookies and similar technologies to manage authentication, track activity, store preferences, and analyze usage. See our Cookie Policy for details.

4. How We Use Your Data

We process your data for the following legitimate business purposes:

  • Service Delivery: To provide, operate, and maintain the Service, including processing transactions, rewards, and Robux redemptions via Roblox gamepasses.
  • Authentication: To verify your identity using Supabase Auth with secure httpOnly cookies. Where you sign in with Roblox, the data we receive is used for one purpose: to establish that the Roblox account is yours, so that rewards are paid to the right person and one player cannot operate several accounts.
  • Fraud Prevention: To detect and prevent fraudulent activities, including the use of VPNs, multi-accounting, bots, and device manipulation, using FingerprintJS and server-side analysis.
  • Error Tracking: To monitor and fix technical issues using Sentry (under legitimate interest — essential for service reliability).
  • Analytics: To analyze usage patterns and improve user experience using Google Analytics and PostHog (with your consent). PostHog may record anonymized session replays to help us identify usability issues — all text inputs are masked by default.
  • Push Notifications: To send you optional web push notifications (daily bonuses, reward reminders) via Webpushr. You can subscribe or unsubscribe at any time through your browser settings.
  • Community Chat & Safety: To operate the community chat and keep it safe. Messages are screened by automated filters and AI moderation, and may be reviewed, blocked, or removed. We act on user reports and may suspend or ban accounts that violate our rules.
  • Communication: To send you security alerts and administrative messages related to your account.

5. Sharing Your Data (Third Parties)

Offerwall Partners: We share your User ID and IP address with third-party offerwall partners — currently Kiwiwall, Timewall, TheoremReach, CPX Research, and AdscendMedia — to attribute rewards to your account when you complete offers and surveys. Without this data sharing, reward tracking is impossible. By using these features, you explicitly consent to this data transfer.

Your Roblox identity, specifically: the "User ID" shared with offerwall partners above is the internal Buxy account identifier, not your Roblox identity. We do not send your Roblox user ID, Roblox username, or Roblox avatar to offerwall partners or advertisers, and we never sell them. Your Roblox username or user ID does reach three processors, for operational reasons and nothing else:

  • PostHog (product analytics) receives your Roblox user ID and username as attributes of your account — only if you accept analytics cookies.
  • Crisp (support chat) receives your Roblox username, your Buxy balance, and your email if we have one, so that whoever answers your ticket knows who they are talking to.
  • PandyHub (payout fulfilment) receives the gamepass link required to deliver Robux to your account when you request a withdrawal.

Beyond that, we do not track which Roblox experiences you play, we do not build advertising profiles from anything Roblox gives us, and we do not combine Roblox data with data obtained from other sources.

Survey Demographics: When you complete your survey profile, the demographic details you provide (gender, date of birth, country, and postal code) are shared with our survey partners CPX Research and TheoremReach to match you with surveys you qualify for. We do not collect or share your name, email, or home address for this purpose.

We may also share data with:

  • Robux Fulfillment: PandyHub (processes your Robux redemption orders — receives the target Roblox gamepass link and order details required to deliver the purchase to your account). Until 16 August 2026 this role was performed by RBXStock.
  • Infrastructure Providers: Supabase (authentication, database, realtime), Cloudflare (CDN, hosting, DDoS protection, Turnstile CAPTCHA).
  • Analytics Providers: Google Analytics and PostHog (only with your consent via our cookie banner). PostHog session replays mask all text inputs and elements marked as private.
  • Push Notifications: Webpushr (processes a push subscription token to deliver browser notifications). No personal data beyond the browser-generated token is shared.
  • Support Chat: Crisp (powers the in-app support chat — receives your Roblox username, your Buxy account ID, balance, and total earned, plus your email address if your account has one, so support can identify you and answer your ticket).
  • Content Moderation: OpenAI (when you post in community chat, the message text is sent to OpenAI's moderation API to detect unsafe content — such as harassment or content sexualizing minors — solely for safety screening; it is not used to train models).
  • Error Tracking: Sentry (processes error data including IP address and browser info for debugging).
  • Fraud Prevention: FingerprintJS (device fingerprinting, under legitimate interest — essential for protecting the reward system).
  • Legal Authorities: If required by law or to protect our rights (e.g., responding to a subpoena).

6. Data Retention

We retain your data for the following periods:

  • Account Data: Until you request deletion or after 12 consecutive months of inactivity, at which point your account and associated data will be permanently deleted.
  • Transaction History: 24 months after account deletion, retained for fraud dispute resolution.
  • Security Logs (IP, device): 6 months, for fraud detection purposes.
  • Community Chat Messages: Retained while your account is active for moderation and safety. Messages removed by moderation are tombstoned (content erased, metadata retained for abuse review).
  • Analytics Data: 26 months (Google Analytics default retention period).
  • Support Communications: 12 months after resolution.

7. International Data Transfers

Your information, including Personal Data, is processed at our operating offices and in any other places where the parties involved in the processing are located. This means your data may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those in your jurisdiction.

8. Your Rights (GDPR & CCPA)

Depending on your location, you may have the following rights regarding your personal data:

  • Right to Access: You can request copies of your personal data.
  • Right to Rectification: You can request that we correct any information you believe is inaccurate.
  • Right to Erasure ("Right to be Forgotten"): You can request that we erase your personal data, subject to certain exceptions (e.g., legal retention requirements).
  • Right to Restrict Processing: You can request that we restrict the processing of your personal data.
  • Right to Data Portability: You can request that we transfer the data we have collected to another organization, or directly to you.
  • Right to Withdraw Consent: You can withdraw your consent for analytics cookies at any time via our cookie banner.

To exercise any of these rights, please contact us at support@buxyapp.com. We will respond within 30 days.

9. Data Security

We use administrative, technical, and physical security measures to help protect your personal information. Authentication tokens are stored in httpOnly, Secure cookies and are never exposed to client-side JavaScript. All data in transit is encrypted via HTTPS. However, no electronic transmission over the Internet can be guaranteed to be 100% secure.

10. Children's Privacy

Our Service is not intended for anyone under the age of 16. We do not knowingly collect personally identifiable information from anyone under 16. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us at support@buxyapp.com and we will take steps to remove that information. Some third-party survey partners set their own minimum age requirements, and you must meet those before taking part in their surveys. Signing in with Roblox additionally requires a Roblox account aged 13 or over, which is a rule Roblox enforces on its own side when you authorise the connection.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this page periodically for any changes.

12. Contact Us

If you have questions or comments about this policy, or wish to exercise your data rights, please contact us at support@buxyapp.com.