Boxy
Sign in Play

Support and trust

Privacy Policy

How Boxy collects, uses, shares, protects, retains, exports, and deletes information.

All support pages

Last updated: July 18, 2026

This Privacy Policy explains how Boxy and its operators ("Boxy," "we," "us," and "our") collect, use, disclose, and retain information when you use the Boxy game, websites, browser and native clients, online worlds, account services, community features, purchases, and support services (together, the "Service"). Boxy is the name of the application and service covered by this policy.

By using the Service, you acknowledge the practices described in this policy. This policy should be read with our Terms of Service. It does not govern a third-party website, payment page, app store, ad network, or independently operated service that has its own privacy notice.

1. Information you provide

Depending on how you use Boxy, you may provide:

  • Account information: a username, e-mail address, optional profile or contact information, password, age-eligibility confirmation, account preferences, and information used to recover or secure your account. Passwords are stored in hashed form rather than as readable text.
  • Player and gameplay information: character names and appearance choices, world membership, settings, inventory, statistics, progress, quests, achievements, homes, builds, map edits, claims, guild activity, trades, auctions, mail, and other actions or state associated with an account or character.
  • Communications and Player Content: chat, whispers, commands, signs, world or schematic content, reports, appeals, feedback, support requests, attachments, and other material you submit or create. Chat and sign records may include the character, world, time, and in-game coordinates connected with the message.
  • Purchase information: the product, price, currency, payment provider, transaction or purchase token, subscription status and period, refund or chargeback status, virtual-currency ledger entries, and identifiers needed to reconcile a purchase with your account.

2. Information collected automatically

When you access an online Boxy service, we and the providers described below may automatically collect:

  • IP address, account and session identifiers, login and logout times, authentication events, and the IP address used to create an account;
  • browser or client type, user-agent information, operating system or device category, requested page or service path, response status, and timestamps;
  • gameplay events such as world joins, character actions, commands, interactions, moderation flags, errors, and in-game position. In-game coordinates describe a location inside a Boxy world, not your device's GPS location;
  • diagnostic, crash, performance, security, fraud-prevention, and service-availability information; and
  • cookies, local storage, cache entries, device or app identifiers, and similar technologies used for sign-in, preferences, security, advertising, measurement, and service operation.

Boxy does not request precise physical location, contacts, camera, microphone, or health data unless a future feature clearly explains the need and requests any permission required before collection.

3. Local and offline data

Boxy clients may store settings, downloaded assets, authentication state, caches, and local world saves on your browser or device. A world created for offline play normally remains on that device and is not sent to Boxy merely because it was created. Information will leave the device if you choose an online feature, upload or submit it, contact support with it, synchronize it through a service, or use a third-party feature that discloses its own collection.

4. How we use information

We use information to:

  • create and manage accounts, authenticate players, maintain sessions, and provide worlds, gameplay, community features, purchases, subscriptions, virtual currency, and support;
  • save characters, content, preferences, and progress and synchronize them across relevant Boxy services;
  • send service, security, billing, support, policy, and account communications and respond to requests;
  • detect and prevent cheating, exploitation, fraud, abuse, harassment, unauthorized access, payment abuse, and other violations of our rules;
  • investigate reports and appeals, moderate Player Content, enforce rules, protect players and staff, and preserve evidence of misconduct;
  • process, verify, fulfill, reconcile, cancel, or refund transactions and maintain financial and virtual-currency records;
  • operate advertising and affiliate programs, measure ad or link performance, prevent invalid traffic, and provide personalized or non-personalized advertising where permitted;
  • diagnose problems, analyze use of the Service, balance gameplay, plan features, conduct research, and guide improvements to Boxy; and
  • comply with legal obligations, valid legal process, tax and accounting requirements, and requests from authorities, and establish or defend legal claims.

Where applicable law requires a legal basis, our bases may include performing our agreement with you, our legitimate interests in operating and protecting the Service, consent, and compliance with legal obligations.

5. When information is disclosed

We may disclose information to:

  • Boxy services and world hosts: account identifiers, roles, status, entitlements, characters, session information, connecting IP address, and relevant gameplay data may pass between the Boxy website and the server hosting the world you select.
  • Other players and the public: character and guild names, appearance, presence, chat, builds, listings, rankings, and other features intended for shared worlds may be visible to other people. Do not put private information in public Player Content.
  • Vendors and service providers: providers that perform hosting, storage, security, content delivery, communications, customer support, diagnostics, advertising, analytics, or payment services may process information under their terms and appropriate contractual or legal restrictions.
  • Payment and storefront providers: Stripe, PayPal, Google Play, Google Payments, Steam, banks, card networks, and related providers may receive account, device, transaction, and fraud-prevention information needed to offer and administer a transaction.
  • Authorities and affected parties: we may disclose information when we reasonably believe it is required by law or valid process, necessary to protect rights or safety, or appropriate to investigate fraud, abuse, security incidents, or rule violations.
  • A successor: information may be reviewed or transferred as part of a merger, financing, reorganization, bankruptcy, sale of assets, or acquisition, subject to applicable confidentiality and notice requirements.

We do not sell personal information for money. The use of advertising cookies or identifiers may be considered a "sale," "sharing," or targeted advertising under some privacy laws even when no money is exchanged for the information. Where such a law applies, we will provide any consent or opt-out mechanism it requires.

6. Payments and storefronts

Boxy may use Stripe, PayPal, Google Play, Google Payments, or other storefronts and payment processors. A provider may collect information directly from you on its own page or through its software, including contact, billing, payment-method, device, cookie, transaction, and fraud-prevention information. The provider processes that information under its own privacy notice.

Boxy normally does not receive or store a complete payment-card number when a hosted payment provider handles checkout. We receive and retain the provider references and transaction details needed to identify the account and product, grant benefits, manage subscriptions, handle support, prevent duplicate fulfillment, and meet accounting or legal obligations.

  • Stripe Privacy Policy: Stripe may collect transactional data and information identifying devices through cookies or similar technologies for payments, authentication, analytics, service improvement, and fraud prevention and detection.
  • PayPal Privacy Statement: PayPal may provide Boxy with information needed to complete and support a transaction and may use cookies or other data under its own choices and policies.
  • Google Payments Privacy Notice: Google processes Google Play purchase and payment information under its own notice.

7. Google advertising: AdSense and AdMob

Boxy may display web advertising through Google AdSense and in-app advertising through Google AdMob. Third-party vendors, including Google, use cookies or similar identifiers to serve ads based on a user's prior visits to Boxy or other websites and apps. Google's use of advertising cookies enables Google and its partners to serve ads based on visits to Boxy and other sites on the Internet. Other authorized ad vendors or networks may also use cookies, web beacons, IP addresses, mobile identifiers, or similar technologies to deliver and measure ads.

Google is the advertising vendor specifically identified in this policy. Before Boxy enables another third-party ad vendor or network, we will identify it and provide an appropriate privacy or opt-out link here or through Boxy's consent-management interface.

When AdMob is active, the Google Mobile Ads SDK may automatically collect and share an IP address, app interactions such as launches, taps, and video views, diagnostic and performance information, Android advertising ID, app set ID, and other device or account identifiers. Google states that it uses this information for advertising, analytics, and fraud prevention. An IP address may be used to estimate a device's general location.

Google may use information received from Boxy to deliver and personalize ads, measure advertising, maintain and improve its services, and protect against fraud and abuse. Learn more in How Google uses information from sites or apps that use its services.

You can manage personalized Google advertising through Google Ads Settings, reset or delete the Android advertising ID through Android device settings where supported, or opt out of some participating vendors through WebChoices. Blocking advertising technologies may not remove ads; it may make them less personalized. Where required, Boxy or its advertising provider will request consent or offer additional privacy controls before using data for personalized advertising.

8. Amazon affiliate disclosure

As an Amazon Associate I earn from qualifying purchases.

Boxy may use specially tagged Amazon links. If you follow one, Amazon may receive information such as your IP address, the referring and destination URLs, browser and operating-system information, link views or clicks, and a cookie or pseudonymous identifier. Boxy may receive a commission if you make a qualifying purchase, without increasing your price. Affiliate links will be identified near the link where required. Purchases occur on Amazon and are governed by the applicable Amazon Privacy Notice and terms. Amazon does not sponsor or endorse Boxy merely because Boxy participates in the Associates Program.

9. Cookies and similar technologies

Boxy and its providers may use:

  • essential technologies for login, authentication, security, load balancing, fraud prevention, preferences, and requested features;
  • measurement technologies to understand visits, performance, errors, and use of features; and
  • advertising technologies to select, deliver, limit, personalize, and measure advertising and affiliate referrals.

You can control browser cookies and site storage through browser settings, but deleting or blocking essential storage may sign you out, remove local preferences, or prevent parts of Boxy from working. Any consent-management interface offered by Boxy supplements the device, browser, and provider controls described above.

10. Retention

We retain information for as long as reasonably necessary for the purposes described in this policy. The period depends on the nature of the information, the lifetime of an account or world, operational needs, user expectations, the sensitivity of the data, and legal, security, fraud-prevention, dispute, tax, accounting, and enforcement requirements.

  • Account, character, world, and Player Content data may remain while the account, world, or Service operates so that we can provide persistent gameplay.
  • Chat, sign, command, moderation, ban, audit, security, and support records may be kept for an extended period to enforce rules, investigate abuse, protect the community, and preserve the integrity of decisions.
  • Transaction, subscription, virtual-currency, refund, chargeback, tax, and fraud-prevention records may be retained after an account closes for legal, accounting, reconciliation, and dispute purposes.
  • Backups and disaster-recovery copies may persist for a limited period after information is removed from active systems.

We may aggregate or de-identify information and retain the resulting information when it no longer reasonably identifies a person. As described in the Terms, inactive accounts and associated data may also be deleted after an extended period.

11. Data management, export, and correction

Account tools may allow you to review or change account details, settings, sessions, characters, subscriptions, reports, or other information. You may also ask us to correct inaccurate account information or provide a copy of information associated with your verified account. The scope and format of an export may depend on the systems involved, other players' privacy, security, intellectual-property restrictions, and what is reasonably available.

To make a privacy request, use Contact and Support. Sign in when possible so we can verify the account. We may request additional information to confirm identity, authority, and the scope of the request. We will respond as required by applicable law and may honor additional requests voluntarily.

12. Account and data deletion

You may request deletion of your Boxy account and associated data through the dedicated Delete account and data page. It remains available even if you no longer have the app or cannot sign in; support verifies ownership before acting. You may also use Contact and Support.

Deleting an account removes or de-identifies associated data from active Boxy systems except information we must or reasonably need to retain for security, fraud prevention, moderation integrity, legal compliance, financial recordkeeping, dispute resolution, or protection of other players. Shared content may remain where removal would affect another player's world or record, but we may remove or disassociate account identifiers where appropriate. Data may remain temporarily in backups.

Deleting Boxy does not automatically cancel a subscription billed by Stripe, PayPal, Google Play, or another provider. Cancel recurring billing through Boxy's subscription tools or the provider before requesting deletion. Deletion also does not control copies already held independently by a payment provider, app store, ad provider, or another third party; contact that provider under its privacy notice.

13. Voluntary GDPR-style practices and other privacy rights

Boxy is not established in the European Union and does not presently consider itself subject to EU jurisdiction. Even where the EU General Data Protection Regulation does not apply, we aim to cooperate with its principles of transparency, access, correction, portability, and deletion by providing or developing reasonable privacy tools and request processes. This voluntary approach does not concede jurisdiction, create rights beyond those provided by applicable law, or limit any non-waivable right you already have.

Depending on where you live, applicable law may give you rights to know about, access, correct, delete, or obtain a copy of personal information; withdraw consent; restrict or object to certain processing; or opt out of targeted advertising, sale, or sharing. Submit a request through Contact and Support. We will not unlawfully discriminate against you for exercising a privacy right. An authorized agent may submit a request where permitted, subject to verification.

14. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. These include access controls, data-protected authentication credentials and tokens, hashed passwords, encrypted network transport where supported, audit logging, provider webhook verification, and restrictions on access to sensitive IP, payment, support, and moderation information.

No storage or transmission method is completely secure. You are responsible for protecting your credentials and devices and should notify support promptly if you believe your account has been compromised.

15. Children

Boxy accounts and online services are not directed to children under 13, and account registration requires confirmation that the player is at least 13. We do not knowingly collect personal information through an online account from a child under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and delete it as appropriate. Parents and guardians should supervise minors' use of online games, chat, purchases, advertising, and external links.

16. International processing

Boxy and its providers may process and store information in the United States and other countries where they operate. Those countries may have privacy laws different from the laws where you live. Where applicable law requires a transfer mechanism or additional safeguard, the responsible party will use an appropriate mechanism.

17. Changes and contact

We may update this policy as Boxy, its providers, or applicable requirements change. The date above shows the latest revision. If a change is material, we will provide reasonable notice through the Service or another appropriate channel before it takes effect when required.

For account deletion, use Delete account and data. For other privacy questions, requests, complaints, or concerns about Boxy, use Contact and Support.