Boxy Privacy Policy
===================
How Boxy collects, uses, shares, protects, retains, exports, and deletes
information.
Last updated: July 18, 2026
This Privacy Policy explains how Boxy and its operators ("Boxy," "we," "us,"
and "our") collect, use, disclose, and retain information when you use the
Boxy game, websites, browser and native clients, online worlds, account
services, community features, purchases, and support services (together, the
"Service"). Boxy is the name of the application and service covered by this
policy.
By using the Service, you acknowledge the practices described in this
policy. This policy should be read with our Terms of Service
(/support/terms). It does not govern a third-party website, payment page,
app store, ad network, or independently operated service that has its own
privacy notice.
1. Information you provide
--------------------------
Depending on how you use Boxy, you may provide:
- Account information: a username, e-mail address, optional profile or
contact information, password, age-eligibility confirmation, account
preferences, and information used to recover or secure your account.
Passwords are stored in hashed form rather than as readable text.
- Player and gameplay information: character names and appearance choices,
world membership, settings, inventory, statistics, progress, quests,
achievements, homes, builds, map edits, claims, guild activity, trades,
auctions, mail, and other actions or state associated with an account or
character.
- Communications and Player Content: chat, whispers, commands, signs,
world or schematic content, reports, appeals, feedback, support
requests, attachments, and other material you submit or create. Chat and
sign records may include the character, world, time, and in-game
coordinates connected with the message.
- Purchase information: the product, price, currency, payment provider,
transaction or purchase token, subscription status and period, refund or
chargeback status, virtual-currency ledger entries, and identifiers
needed to reconcile a purchase with your account.
2. Information collected automatically
--------------------------------------
When you access an online Boxy service, we and the providers described below
may automatically collect:
- IP address, account and session identifiers, login and logout times,
authentication events, and the IP address used to create an account;
- browser or client type, user-agent information, operating system or
device category, requested page or service path, response status, and
timestamps;
- gameplay events such as world joins, character actions, commands,
interactions, moderation flags, errors, and in-game position. In-game
coordinates describe a location inside a Boxy world, not your device's
GPS location;
- diagnostic, crash, performance, security, fraud-prevention, and
service-availability information; and
- cookies, local storage, cache entries, device or app identifiers, and
similar technologies used for sign-in, preferences, security,
advertising, measurement, and service operation.
Boxy does not request precise physical location, contacts, camera,
microphone, or health data unless a future feature clearly explains the need
and requests any permission required before collection.
3. Local and offline data
-------------------------
Boxy clients may store settings, downloaded assets, authentication state,
caches, and local world saves on your browser or device. A world created for
offline play normally remains on that device and is not sent to Boxy merely
because it was created. Information will leave the device if you choose an
online feature, upload or submit it, contact support with it, synchronize it
through a service, or use a third-party feature that discloses its own
collection.
4. How we use information
-------------------------
We use information to:
- create and manage accounts, authenticate players, maintain sessions, and
provide worlds, gameplay, community features, purchases, subscriptions,
virtual currency, and support;
- save characters, content, preferences, and progress and synchronize them
across relevant Boxy services;
- send service, security, billing, support, policy, and account
communications and respond to requests;
- detect and prevent cheating, exploitation, fraud, abuse, harassment,
unauthorized access, payment abuse, and other violations of our rules;
- investigate reports and appeals, moderate Player Content, enforce rules,
protect players and staff, and preserve evidence of misconduct;
- process, verify, fulfill, reconcile, cancel, or refund transactions and
maintain financial and virtual-currency records;
- operate advertising and affiliate programs, measure ad or link
performance, prevent invalid traffic, and provide personalized or
non-personalized advertising where permitted;
- diagnose problems, analyze use of the Service, balance gameplay, plan
features, conduct research, and guide improvements to Boxy; and
- comply with legal obligations, valid legal process, tax and accounting
requirements, and requests from authorities, and establish or defend
legal claims.
Where applicable law requires a legal basis, our bases may include
performing our agreement with you, our legitimate interests in operating and
protecting the Service, consent, and compliance with legal obligations.
5. When information is disclosed
--------------------------------
We may disclose information to:
- Boxy services and world hosts: account identifiers, roles, status,
entitlements, characters, session information, connecting IP address,
and relevant gameplay data may pass between the Boxy website and the
server hosting the world you select.
- Other players and the public: character and guild names, appearance,
presence, chat, builds, listings, rankings, and other features intended
for shared worlds may be visible to other people. Do not put private
information in public Player Content.
- Vendors and service providers: providers that perform hosting, storage,
security, content delivery, communications, customer support,
diagnostics, advertising, analytics, or payment services may process
information under their terms and appropriate contractual or legal
restrictions.
- Payment and storefront providers: Stripe, PayPal, Google Play, Google
Payments, Steam, banks, card networks, and related providers may receive
account, device, transaction, and fraud-prevention information needed to
offer and administer a transaction.
- Authorities and affected parties: we may disclose information when we
reasonably believe it is required by law or valid process, necessary to
protect rights or safety, or appropriate to investigate fraud, abuse,
security incidents, or rule violations.
- A successor: information may be reviewed or transferred as part of a
merger, financing, reorganization, bankruptcy, sale of assets, or
acquisition, subject to applicable confidentiality and notice
requirements.
We do not sell personal information for money. The use of advertising
cookies or identifiers may be considered a "sale," "sharing," or targeted
advertising under some privacy laws even when no money is exchanged for the
information. Where such a law applies, we will provide any consent or
opt-out mechanism it requires.
6. Payments and storefronts
---------------------------
Boxy may use Stripe, PayPal, Google Play, Google Payments, or other
storefronts and payment processors. A provider may collect information
directly from you on its own page or through its software, including
contact, billing, payment-method, device, cookie, transaction, and
fraud-prevention information. The provider processes that information under
its own privacy notice.
Boxy normally does not receive or store a complete payment-card number when
a hosted payment provider handles checkout. We receive and retain the
provider references and transaction details needed to identify the account
and product, grant benefits, manage subscriptions, handle support, prevent
duplicate fulfillment, and meet accounting or legal obligations.
- Stripe Privacy Policy (https://stripe.com/privacy): Stripe may collect
transactional data and information identifying devices through cookies
or similar technologies for payments, authentication, analytics, service
improvement, and fraud prevention and detection.
- PayPal Privacy Statement
(https://www.paypal.com/us/legalhub/paypal/privacy-full): PayPal may
provide Boxy with information needed to complete and support a
transaction and may use cookies or other data under its own choices and
policies.
- Google Payments Privacy Notice
(https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice):
Google processes Google Play purchase and payment information under its
own notice.
7. Google advertising: AdSense and AdMob
----------------------------------------
Boxy may display web advertising through Google AdSense and in-app
advertising through Google AdMob. Third-party vendors, including Google, use
cookies or similar identifiers to serve ads based on a user's prior visits
to Boxy or other websites and apps. Google's use of advertising cookies
enables Google and its partners to serve ads based on visits to Boxy and
other sites on the Internet. Other authorized ad vendors or networks may
also use cookies, web beacons, IP addresses, mobile identifiers, or similar
technologies to deliver and measure ads.
Google is the advertising vendor specifically identified in this policy.
Before Boxy enables another third-party ad vendor or network, we will
identify it and provide an appropriate privacy or opt-out link here or
through Boxy's consent-management interface.
When AdMob is active, the Google Mobile Ads SDK may automatically collect
and share an IP address, app interactions such as launches, taps, and video
views, diagnostic and performance information, Android advertising ID, app
set ID, and other device or account identifiers. Google states that it uses
this information for advertising, analytics, and fraud prevention. An IP
address may be used to estimate a device's general location.
Google may use information received from Boxy to deliver and personalize
ads, measure advertising, maintain and improve its services, and protect
against fraud and abuse. Learn more in How Google uses information from
sites or apps that use its services
(https://policies.google.com/technologies/partner-sites).
You can manage personalized Google advertising through Google Ads Settings
(https://adssettings.google.com/), reset or delete the Android advertising
ID through Android device settings where supported, or opt out of some
participating vendors through WebChoices (https://optout.aboutads.info/).
Blocking advertising technologies may not remove ads; it may make them less
personalized. Where required, Boxy or its advertising provider will request
consent or offer additional privacy controls before using data for
personalized advertising.
8. Amazon affiliate disclosure
------------------------------
As an Amazon Associate I earn from qualifying purchases.
Boxy may use specially tagged Amazon links. If you follow one, Amazon may
receive information such as your IP address, the referring and destination
URLs, browser and operating-system information, link views or clicks, and a
cookie or pseudonymous identifier. Boxy may receive a commission if you make
a qualifying purchase, without increasing your price. Affiliate links will
be identified near the link where required. Purchases occur on Amazon and
are governed by the applicable Amazon Privacy Notice
(https://www.amazon.com/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ)
and terms. Amazon does not sponsor or endorse Boxy merely because Boxy
participates in the Associates Program.
9. Cookies and similar technologies
-----------------------------------
Boxy and its providers may use:
- essential technologies for login, authentication, security, load
balancing, fraud prevention, preferences, and requested features;
- measurement technologies to understand visits, performance, errors, and
use of features; and
- advertising technologies to select, deliver, limit, personalize, and
measure advertising and affiliate referrals.
You can control browser cookies and site storage through browser settings,
but deleting or blocking essential storage may sign you out, remove local
preferences, or prevent parts of Boxy from working. Any consent-management
interface offered by Boxy supplements the device, browser, and provider
controls described above.
10. Retention
-------------
We retain information for as long as reasonably necessary for the purposes
described in this policy. The period depends on the nature of the
information, the lifetime of an account or world, operational needs, user
expectations, the sensitivity of the data, and legal, security,
fraud-prevention, dispute, tax, accounting, and enforcement requirements.
- Account, character, world, and Player Content data may remain while the
account, world, or Service operates so that we can provide persistent
gameplay.
- Chat, sign, command, moderation, ban, audit, security, and support
records may be kept for an extended period to enforce rules, investigate
abuse, protect the community, and preserve the integrity of decisions.
- Transaction, subscription, virtual-currency, refund, chargeback, tax,
and fraud-prevention records may be retained after an account closes for
legal, accounting, reconciliation, and dispute purposes.
- Backups and disaster-recovery copies may persist for a limited period
after information is removed from active systems.
We may aggregate or de-identify information and retain the resulting
information when it no longer reasonably identifies a person. As described
in the Terms, inactive accounts and associated data may also be deleted
after an extended period.
11. Data management, export, and correction
-------------------------------------------
Account tools may allow you to review or change account details, settings,
sessions, characters, subscriptions, reports, or other information. You may
also ask us to correct inaccurate account information or provide a copy of
information associated with your verified account. The scope and format of
an export may depend on the systems involved, other players' privacy,
security, intellectual-property restrictions, and what is reasonably
available.
To make a privacy request, use Contact and Support (/support/contact). Sign
in when possible so we can verify the account. We may request additional
information to confirm identity, authority, and the scope of the request. We
will respond as required by applicable law and may honor additional requests
voluntarily.
12. Account and data deletion
-----------------------------
You may request deletion of your Boxy account and associated data through
the dedicated Delete account and data (/account/delete) page. It remains
available even if you no longer have the app or cannot sign in; support
verifies ownership before acting. You may also use Contact and Support
(/support/contact).
Deleting an account removes or de-identifies associated data from active
Boxy systems except information we must or reasonably need to retain for
security, fraud prevention, moderation integrity, legal compliance,
financial recordkeeping, dispute resolution, or protection of other players.
Shared content may remain where removal would affect another player's world
or record, but we may remove or disassociate account identifiers where
appropriate. Data may remain temporarily in backups.
Deleting Boxy does not automatically cancel a subscription billed by Stripe,
PayPal, Google Play, or another provider. Cancel recurring billing through
Boxy's subscription tools or the provider before requesting deletion.
Deletion also does not control copies already held independently by a
payment provider, app store, ad provider, or another third party; contact
that provider under its privacy notice.
13. Voluntary GDPR-style practices and other privacy rights
-----------------------------------------------------------
Boxy is not established in the European Union and does not presently
consider itself subject to EU jurisdiction. Even where the EU General Data
Protection Regulation does not apply, we aim to cooperate with its
principles of transparency, access, correction, portability, and deletion by
providing or developing reasonable privacy tools and request processes. This
voluntary approach does not concede jurisdiction, create rights beyond those
provided by applicable law, or limit any non-waivable right you already
have.
Depending on where you live, applicable law may give you rights to know
about, access, correct, delete, or obtain a copy of personal information;
withdraw consent; restrict or object to certain processing; or opt out of
targeted advertising, sale, or sharing. Submit a request through Contact and
Support (/support/contact). We will not unlawfully discriminate against you
for exercising a privacy right. An authorized agent may submit a request
where permitted, subject to verification.
14. Security
------------
We use reasonable administrative, technical, and organizational safeguards
designed to protect information. These include access controls,
data-protected authentication credentials and tokens, hashed passwords,
encrypted network transport where supported, audit logging, provider webhook
verification, and restrictions on access to sensitive IP, payment, support,
and moderation information.
No storage or transmission method is completely secure. You are responsible
for protecting your credentials and devices and should notify support
promptly if you believe your account has been compromised.
15. Children
------------
Boxy accounts and online services are not directed to children under 13, and
account registration requires confirmation that the player is at least 13.
We do not knowingly collect personal information through an online account
from a child under 13. If you believe a child under 13 has provided personal
information, contact us so we can investigate and delete it as appropriate.
Parents and guardians should supervise minors' use of online games, chat,
purchases, advertising, and external links.
16. International processing
----------------------------
Boxy and its providers may process and store information in the United
States and other countries where they operate. Those countries may have
privacy laws different from the laws where you live. Where applicable law
requires a transfer mechanism or additional safeguard, the responsible party
will use an appropriate mechanism.
17. Changes and contact
-----------------------
We may update this policy as Boxy, its providers, or applicable requirements
change. The date above shows the latest revision. If a change is material,
we will provide reasonable notice through the Service or another appropriate
channel before it takes effect when required.
For account deletion, use Delete account and data (/account/delete). For
other privacy questions, requests, complaints, or concerns about Boxy, use
Contact and Support (/support/contact).