1. Overview
BloxyCrab is an independent directory for community-shared Blox Fruits private servers. You can browse public listings without signing in. Roblox sign-in is required only for submitting and managing your server listing.
We do not sell personal information. We handle information to operate the directory, authenticate submitters, display approved listings, prevent spam and respond to support requests.
2. Information we handle
Information from Roblox sign-in
If you choose “Continue with Roblox”, Roblox's OAuth service returns limited identity information requested by BloxyCrab: your Roblox user ID, username, display name, profile URL and, when Roblox supplies it, a profile image URL. BloxyCrab requests the openid and profile scopes. We do not ask for or receive your Roblox password.
Information you submit
When you submit a server listing, we handle the details you provide: server name, Roblox private-server link, sea, region, activities, raid type and selected fruits (if applicable), selected sea events (if applicable), description and optional Discord invite. We associate the listing with your Roblox user ID and store its status and timestamps for review and expiry.
Account and operational information
When a listing is submitted, we save a basic Roblox profile record containing your user ID, username, display name, profile image URL (if supplied) and Roblox profile URL. If you are added as an administrator, we also store your Roblox user ID in the administrator allow-list. Our hosting and service providers may process technical information such as IP address, browser information, request timestamps and server logs as part of delivering and protecting their services.
Messages you send us
The Contact page opens your email application using a mailto: link. If you email us, we receive the email address and the message you choose to send. Your email provider also processes that message under its own privacy terms. BloxyCrab does not currently provide a hosted contact-message form.
3. How we use information
- Authenticate Roblox users and maintain their signed-in session.
- Associate a server listing with the Roblox account that submitted it.
- Review submissions and approve or reject listings.
- Show approved listing details and the submitting Roblox username in the public directory.
- Enforce the one-active-listing rule and automatically expire listings.
- Prevent spam, investigate errors, protect the service and respond to messages or data requests.
4. What is visible to other people
When a listing is approved, the public directory displays the server name, submitting Roblox username, private-server URL, sea, region, activity selections, raid details, sea-event selections and description. An optional Discord invite is also included in the listing data where provided. Anyone may view this information and follow the links.
Do not submit information you do not want to make public. In particular, only submit a private-server link that you are comfortable sharing with directory visitors and that you are authorised to share. Pending and rejected listings are not shown in the public directory, but authorised moderators can see them for review.
5. Cookies and session data
BloxyCrab uses essential, server-set cookies for Roblox OAuth and sign-in. The short-lived OAuth state cookie helps protect the sign-in process and expires after approximately 10 minutes. After successful sign-in, a signed session cookie is used to recognise your account; it is marked HttpOnly and SameSite=Lax and expires after 7 days. These cookies are not used by the current site code for advertising or cross-site analytics.
You can clear cookies through your browser settings. If you block or clear essential cookies, Roblox sign-in and account features may stop working; public browsing may still be available.
6. Service providers and information sharing
We use third-party providers to operate BloxyCrab:
- Roblox: authenticates your account and provides the identity information you authorise through OAuth. Roblox also hosts private-server destinations.
- Supabase: stores profile and server-listing records used by the directory and moderation tools.
- Vercel: hosts the website and runs its server-side API functions.
- Email provider: processes messages you send to our contact address through your own email service.
These providers process information under their own terms and privacy policies. We may also disclose information if required by law, to respond to valid legal requests, or to protect the rights, safety and security of users or the service. We do not sell personal information or share it with third parties for their independent advertising purposes.
7. Retention and deletion
Server listings: Each listing is deleted automatically 24 hours after it was submitted, whether it is pending, approved or rejected. The cleanup task runs periodically, so deletion from the active database may occur a few minutes after the 24-hour point. You can also delete your own listing manually from your profile; manual deletion removes the listing immediately and frees your one-listing slot.
Roblox profile records: The profile record used to associate listings with your Roblox account is separate from an individual listing. Deleting a listing does not delete this profile record. The current site does not provide a self-service account or profile deletion button. To request deletion or correction of profile information, email contact@bloxycrab.site. We may need to verify that you control the account and may retain limited information where necessary for security, administration or legal reasons.
Cookies and provider logs: The OAuth state cookie expires after about 10 minutes and the session cookie expires after 7 days. Technical logs, backups or records held by Vercel, Supabase, Roblox or your email provider may be retained according to those providers' own retention settings and policies.
8. Your choices and privacy requests
You can browse without signing in. You can choose not to submit a listing, delete an active listing from your profile, log out, or clear BloxyCrab cookies in your browser. You may also contact us to request access to, correction of or deletion of personal information associated with your account.
Privacy rights vary by location. Where applicable, we will consider requests in accordance with the laws that apply to the request. We may ask for reasonable proof that you control the relevant Roblox account before acting. Deleting a listing does not itself remove the associated profile record or records held independently by third-party providers.
9. Children and younger users
BloxyCrab is a community directory related to a game that may be used by younger players. The site does not provide an age-verification feature. If you are below the age at which you can consent to online services or personal-data processing where you live, use sign-in and submission features only with the permission and involvement of a parent or legal guardian where required. Parents or guardians who have a privacy concern can contact us using the address below.
10. Security
We use server-side authentication and access controls intended to protect account and listing information. No website, transmission or storage system can be guaranteed completely secure. Keep your Roblox account secure and do not share passwords, cookies, recovery codes or private account credentials with anyone.
11. International processing
BloxyCrab and its service providers may process information in countries other than the country where you live. Data protection laws may differ between those locations. The providers' privacy policies describe their own processing and international data arrangements.
12. Changes to this policy
We may update this Privacy Policy as the website or its data practices change. We will update the “Last updated” date at the top when a new version is published. Please review this page periodically.
13. Contact us
For privacy questions or requests, email contact@bloxycrab.site. Do not include your Roblox password, session cookie or recovery codes in your message.