What we keep, and why
What Thumblox collects, why, who helps us run it and how long we keep it. The short version: what we need to log you in and make your builds, and nothing for ads.
Privacy policy · Version 2026-10-29
Who's responsible
Femsi Media, Gammelgårds Alle 17, 3. 37, 2665 Vallensbæk Strand, Denmark (CVR 46081269) runs Thumblox and is the data controller: we decide how your data is used and we're responsible for it. Questions about privacy go to orfanfemsi@gmail.com.
What we collect and why
- Your email
To log you in and send your magic links.
If you use Google or Discord, they send us your email and an account id, and the name and picture on that account. Supabase stores what they send. We use the name as your display name and show the picture on your account, where only you and our team see them. They never show on The Stack.
- A display name
- The name on your Google or Discord account when you log in with one, or one you set in Settings. Change it there any time. We never take it from your email.
- Your age check
When you sign up you tick a box to confirm you're 13 or older. We don't ask for your birthday.
We keep only that you confirmed it and when, plus which version of the Terms you agreed to and when.
- Your builds
- Your prompts, the settings and style you pick, the references you upload and the images and sounds you get back. We need them to make your builds, show your history and let you download them again. Our team can see them, with when you made them, to help you, fix problems and check them against the Terms.
- Builds you share
- Whether Share my builds is on, which builds you shared and when. A shared build's picture, prompt, tool and style are public on The Stack, with how many likes and views it has (counts, not who). Your name, email and references never are.
- Where you heard about us
- If you answer the question after signing up: the place you picked, what you wrote under Other and when. It's optional, kept with your account, and only our team sees it, as totals, to learn where Roblox devs find Thumblox.
- Reports
- If you report a build: the reason, and your account when you're logged in, so each person's report counts once. With each report we keep a copy of the build's prompt and where its picture is, until we've looked at it.
- Your Roblox avatar
- Only if you add it: the username you type and a copy of the avatar picture, to use as a reference.
- The Studio plugin
- Only if you connect it: a hashed version of its connect code (for 10 minutes) and of its token, when you connected it and last used it, and which builds you sent to Studio (for a day). The plugin uploads your UI's pictures to your own Roblox account from your Studio; we never get your Roblox login.
- Your blox history
- Every grant, spend and refund, so your balance is always right.
- Likes on The Stack
- Which designs and shared builds you liked, so your hearts stay put.
- Log in protection
A hashed version of your IP address and of your email, to limit how often links can be asked for.
Hashed means we store a scrambled code made from the value, not the value itself.
- Free plan check
- A hashed version of your email, so each person gets the free blox once a month, even after deleting and remaking an account.
- Extra account check
Each time you log in, a hashed version of the network you came from (your IP address), kept for 30 days. If several accounts look like one person's, because they log in from the same network with the same name or nearly the same email, or many new accounts share one network, we ban every free one but the oldest, as the Terms allow one account per person. Accounts on a paid plan or with blox you paid for are never banned this way.
Our team checks every ban the check makes, and you can dispute a ban from the app. We do this because of our legitimate interest in keeping the free blox fair.
- Banned accounts
- Why an account was banned, which the account sees. If a banned account is deleted, we keep a hashed version of its email so it can't sign up again.
- Ban disputes
- If you dispute a ban: what you wrote, the ban reason at the time and our answer, which we show you in the app and may email you.
- Technical logs
Supabase keeps a record of each log in, with the email address, the IP address and the time.
Our hosting, database and AI providers also keep short request logs (like the IP address, the page or request and the time) to run and protect their services.
- Payments
- Stripe takes your card details on its own page. We keep your plan, your subscription's status and dates, and a Stripe customer id, never your card number. Stripe keeps the payment and invoice details.
- Emails you send us
- Your message and address, so we can answer and help you.
Why we're allowed to use it (the legal basis under the GDPR):
- Your account, name and picture, builds, avatar, blox, likes, plan and Studio plugin: to give you the service you signed up for (our agreement with you, Article 6(1)(b)).
- Showing builds you share on The Stack: because you chose to share them (your consent, Article 6(1)(a)). Take a build off, or turn Share my builds off, any time; that doesn't change what was shown before.
- Reports and taking builds off The Stack: to keep it safe and deal with illegal content, as the EU Digital Services Act asks (our legitimate interest, Article 6(1)(f)).
- Payment and invoice records: because Danish bookkeeping law requires us to keep them (a legal obligation, Article 6(1)(c)).
- Log in protection, the free plan check, ban records, technical logs and the age check: to keep Thumblox safe and fair, stop abuse and keep under-13s out (our legitimate interest, Article 6(1)(f)).
- Emails you send us: to answer you (our legitimate interest, Article 6(1)(f)).
We don't sell your data, we don't use it for ads, and we don't use your prompts, uploads or builds to train AI models.
Who helps us run Thumblox
- Supabase
- Accounts and the database. Supabase is a US company; our data is stored in its Ireland (EU) region.
- Cloudflare R2
- File storage: your builds, reference images and avatar pictures. Cloudflare is a US company; the files are stored in the EU, under its EU jurisdiction setting.
- Kie.ai
Our AI provider, run by NexusAI Services LLC in the US. It gets your prompts and reference images to make your builds, and your prompts to check them before you spend blox, to look up named characters and to write Boost briefs.
It runs models from AI companies such as OpenAI and Google, which process the same prompts and images to make the result. Kie.ai deletes generated files after 14 days and its request logs after 2 months.
- Cloudflare
- Hosts the website and runs our server code, at the Cloudflare location nearest you. To deliver the pages it sees your IP address and details about your browser. Cloudflare is a US company.
- Cloudflare Turnstile
- The quick bot check on the log in page. It sees your IP address and details about your browser. Cloudflare is a US company.
- Stripe
- Payments for plans and packs, through Stripe Payments Europe in Ireland (EU). Your card details go to Stripe, not to us.
- Resend
- Sends your log in emails, and our answers to ban disputes, from its Ireland (EU) region. Resend is a US company.
- Google and Discord
- Only if you log in with them. They tell us who you are, and their own privacy policies cover what they keep.
- Roblox
- Only when you add your avatar: we send Roblox the username you type to fetch the picture. If you use the Studio plugin, it uploads your UI's pictures to Roblox from your Studio, under your Roblox account and Roblox's own terms.
Some of these companies are in the US, so your data can be sent there. When it is, we rely on the EU-US Data Privacy Framework where the company is certified, and on the EU's standard contractual clauses otherwise. Email orfanfemsi@gmail.com for a copy of the safeguards.
How long we keep it
- Your account and builds
- Until you delete them, or your account.
- Shared builds
- On The Stack until you take them off or delete them; gone from it within a few minutes.
- Withdrawals
- Your name, email and what you withdrew from, kept like payment records below, even if you delete your account.
- Reports
- Until we've looked at them, then 12 months as a record of what we did.
- Sign-ups never confirmed
- Deleted after 1 day if the email link was never used.
- No age or Terms answer
- Accounts that never confirmed their age and the Terms are deleted after 7 days.
- Deleted accounts
- Removed at once, with their files, whether you delete it or we do. A copy in our database provider's backups is gone within 7 days.
- Payment records
- 5 years after the end of the financial year they belong to, as the Danish Bookkeeping Act requires, even if you delete your account. Stripe holds them for us.
- Unused free accounts
- We may delete a free account nobody has logged in to for 12 months, with everything in it. Never one with a paid plan or blox you paid for.
- Log in protection
- 2 days.
- Extra account check
- 30 days after the last log in from that network.
- Ban disputes and checks
- Until we've answered or settled them, then 12 months as a record of what we did. Gone at once if you delete your account.
- Log in records
- 30 days.
- Request logs
- Up to 30 days at our hosting and database providers, 2 months at Kie.ai.
- Free plan check
- About 13 months.
- Banned emails
- As long as the ban stands.
- Emails you send us
- As long as we need them to help you, and at most 3 years.
Your choices and rights
In Settings you can change your display name, turn Share my builds on or off, download your data as a file and delete your account. Each build's viewer shares it on The Stack or takes it off.
You can also ask us for a copy of what we hold about you, ask us to correct or delete it, limit how we use it, or object to a use. Email orfanfemsi@gmail.com and we'll answer within a month.
You can complain to the Danish Data Protection Agency (Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk), or to the data protection authority where you live.
Children
- Thumblox is for 13 and up. You confirm your age with a checkbox when you sign up, and again before you build if you logged in with Google or Discord without the sign-up form.
- If we learn that someone under 13 has an account, we delete it.
- Paid plans need you to be 18 or older, or to have a parent's or guardian's permission.
If you think a child under 13 has an account, tell us at orfanfemsi@gmail.com.
Changes to this policy
If this policy changes in a way that matters, we'll ask you again in the app. This is version 2026-10-29.
Contact
Femsi Media, Gammelgårds Alle 17, 3. 37, 2665 Vallensbæk Strand, Denmark (CVR 46081269) · orfanfemsi@gmail.com