Legal

Privacy Policy

Last updated September 24, 2026

This policy explains what data the BloxBot desktop app and the bloxbot.ai website collect, why, and what you can do about it. We keep it short on purpose. If anything is unclear, email us at hello@paralov.com.

Who is responsible

Paralov AS (organization number 936 301 185, VAT NO936301185MVA), Tordenskjolds gate 9, 4612 Kristiansand, Norway, is the data controller for the processing described here. Contact: hello@paralov.com.

What stays on your computer

BloxBot runs locally. Your projects, chat history, settings, and AI provider API keys or logins are stored on your computer. When you chat, BloxBot sends your prompts directly from your computer to the AI provider you connected (for example Anthropic, OpenAI, Google, or OpenRouter). That provider processes them under its own terms and privacy policy. We do not run a server in between, and we never receive your API keys.

What we collect

1. App analytics (always on)

To keep BloxBot working, the app sends basic usage events: a random device identifier created on first launch, a session identifier, app version, operating system, events such as "app opened" or "Studio connected", error types, and interactions with the app window. Interactions can include clicks and, where enabled, a screen recording of the BloxBot window (session replay). Our analytics provider derives an approximate location (country and city) from your IP address.

2. AI usage data (on by default, you can turn it off)

To understand how well BloxBot works and to improve it, the app also sends details of your AI sessions:

• your prompts, the AI's responses and reasoning, and timings
• the tool calls the AI makes and their results, which can include scripts and other content from your Roblox place
• code changes made during a session
• instruction files that shape the AI's behavior, such as AGENTS.md or CLAUDE.md
• the AI provider and model, token counts, and estimated cost
• Roblox place IDs and place names

Attached images and files are not uploaded. You can turn this off at any time in Settings → Privacy → Share AI usage data. Please avoid putting personal or sensitive information in prompts or instruction files.

3. Website analytics

bloxbot.ai uses analytics to see which pages are visited and how people find us. This uses cookies or similar browser storage and records pages viewed, clicks, browser and device type, referrer, and approximate location from your IP address. Our hosting provider keeps short-lived server logs (IP address, time, and requested page).

4. Updates and downloads

The app checks GitHub for BloxBot updates and downloads its local AI engine (OpenCode) from GitHub. GitHub receives your IP address when this happens, as with any download.

5. When you contact us

If you email us or write to us on Discord, we use what you send to answer you.

Why we process it (legal basis)

• App analytics, AI usage data, and website analytics: our legitimate interest in keeping BloxBot reliable, understanding how it is used, and improving it (GDPR Art. 6(1)(f)). You can object at any time: turn off AI usage data in Settings, or email us.
• Support: our legitimate interest in answering your questions.

We do not ask for your name or email in the app, we do not create user profiles, and we do not sell your data or use it for advertising.

Who we share it with

We use these service providers (data processors), only for the purposes above:

• PostHog: app and website analytics, hosted in the EU (Frankfurt)
• Vercel: website hosting (global network, USA-based company)

GitHub (updates and downloads) and the AI provider you connect act as independent controllers under their own privacy policies. Where data leaves the EEA, we rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep it

• AI conversation content (prompts, responses, reasoning, tool inputs and results): deleted after 30 days.
• Other analytics and AI usage data (such as events, models, token counts, and timings): kept for the retention period of our analytics plan, up to 7 years.
• Screen recordings of the app (session replay): kept for up to 90 days.
• Support messages: kept as long as needed to help you, then deleted.

Your rights

Under the GDPR you can ask for access to, correction of, or deletion of your data, ask us to restrict processing, object to processing, and ask for a copy in a portable format. Because app data is tied only to a random device identifier, include that identifier in your request. You can find it in Settings → Privacy in the app. Email hello@paralov.com and we will respond within one month.

You can also complain to the Norwegian Data Protection Authority, Datatilsynet, or your local data protection authority.

Children

BloxBot is not intended for anyone under 16. If you are a parent and believe your child has used BloxBot and shared data with us, contact us and we will delete it.

Security

Data is sent over encrypted connections, and access to analytics data is limited to the Paralov team members who need it.

Changes

We will update this page when our practices change and show the date at the top. If a change is significant, we will tell you in the app.

See also our Terms of Service.