WingyBlox WingyBlox

Privacy Policy.

How WingyBlox collects, uses, and protects your data when you sign in and use the site.

Last updated: September 2026

Overview

WingyBlox is a free, community-run Roblox group website (under 500 members), operated by a volunteer in Latvia. Servers and databases are hosted on Oracle Cloud in Germany; access is limited to the site operator. This page covers what we collect (including tickets, reviews, applications), why we have it, and what you can do about it.

1. What we collect

When you sign in with Discord, here's what ends up stored on our side:

Discord ID
Your unique Discord account identifier.
Roblox ID and username
Resolved via Bloxlink so we can link your accounts.
Roblox group rank and role
Read from the WingyBlox Roblox group to determine your access, staff status, and permissions on this site.
Account metadata
Created date and, where applicable, staff/permission flags derived from your group rank.

For security we also log your IP address and browser info when you sign in or do important actions. And of course we keep whatever you actually send us:

Support tickets and messages
Whatever you send our support team, plus any star rating you leave afterwards.
Reviews
Your review — the rating and what you wrote. An automatic filter checks reviews before they go public.
Applications
If you apply for a staff position, we keep your answers, your score (if the application is graded), and staff feedback. Each application shows its own privacy notice before you submit.
Automatic moderation results
The filter that checks reviews can flag one as potentially toxic. Flagged reviews don't get published — staff look at them first and decide.

2. Cookies and sessions

One cookie keeps you logged in: __Host-wblox_session, signed, Secure/HTTPS-only, SameSite Lax, 7 days or until sign-out. That's the only one we set: no ads, no tracking, no analytics.

The Cloudflare Turnstile checkbox may keep its own technical cookies to work. Those belong to Cloudflare, not us.

3. How we use it and legal basis

  • Verify Roblox identity and link Discord account — contract (provide the site).
  • Grant site access, rank, and permissions — contract.
  • Operate support, reviews, applications, moderation — consent (by submitting) + contract.
  • Detect/prevent abuse, rate-limit logins, block spam/bots — legitimate interest (security). We balance this by collecting minimal IP/user-agent data and deleting logs after 12 months.

If you are under digital consent age in your country (13–16 — 16 in Germany, 14 in Spain, 13 in Latvia), you need parent/guardian permission. We rely on Discord/Roblox age gates and do not independently verify age.

4. Who we share it with

We don't sell your data — ever. But running the site involves outside services, including US providers. No sale, but IPs/IDs are transmitted as needed:

Discord
OAuth2 authentication to verify your identity.
Bloxlink
To resolve your Discord account to a Roblox account.
Roblox
To read your username and group rank.
Cloudflare Turnstile
The "prove you're human" checkbox on our forms. It may send your IP and some browser signals to Cloudflare to do its job. We never see the secret values involved.
jsDelivr CDN
Delivers our fonts and front-end files. Like any CDN, it logs standard request data (like your IP) to serve those files.
Oracle Cloud (hosting, Germany)
Servers and databases in Germany. Backups on same server. Access limited to site operator.

Transfers: Discord, Roblox, Bloxlink, Cloudflare, jsDelivr process data in the US. We have no signed SCCs/DPAs as a hobby project; where providers are EU-US Data Privacy Framework certified that is relied on, otherwise transfer is based on necessity to provide the service you requested. Contact us if you object.

5. Data retention

Account data lasts as long as your account. Sign-in/security logs (auth_logs with IP/user-agent) and webhook logs are kept 12 months rolling, then deleted — enough to trace abuse without indefinite storage. Backups rotate on the same schedule.

Applications are kept while under review and 12 months after decision for records; ask to remove earlier and we will. Reviews are public until you delete them or your account.

If you delete your account via settings: applications, drafts, permissions and blacklist entries are wiped immediately. Reviews are detached to "Anonymous". Tickets are kept for history but your IP is removed. Security logs older than 12 months are already gone; newer ones are anonymized on deletion where technically possible.

Warning: public reviews may be indexed by search engines or copied by AI scrapers — we cannot recall third-party copies.

6. How we protect your data

HTTPS everywhere, signed __Host-wblox_session cookie (7 days, Secure, Lax), session rotation against fixation, PBKDF2-SHA256 salted hashing for staff/owner passwords (Discord is primary login — we never store Discord passwords), Turnstile tokens verified not stored, rank-based permissions, audit logging for staff actions, secrets in Doppler/.env never committed.

7. Your rights

You have GDPR rights: access, correction, deletion, portability, restriction, objection, withdraw consent. Delete your account in settings for immediate deletion, or open a support ticket / Discord for other requests — we reply within 1 month. You can also complain to your supervisory authority (e.g. Latvia DSI, Germany BfDI).

9. Changes to this policy

Material changes get at least 30 days' bottom-popup notice on the website. Continued use after effect means acceptance. If you disagree, stop using and delete your account.

10. Contact

Privacy requests: support ticket or Discord. For files use Discord. Website copyright: site operator. Game content: Roblox game owner. Rules: rules document.

Need help?