Privacy policy

In short

Cubix is a mobile app that shows values, codes and shops for Roblox games. It is built by an independent developer and it is not affiliated with, or endorsed by, Roblox Corporation.

The best defence is not holding the data, so the app is built to ask for as little as possible: there is no mandatory sign-up, we do not ask your age, we do not ask for your email, and we never ask for your Roblox password.

Data controller: the developer of Cubix, reachable at privacy@usecubix.com.

Without an account, the app is complete

Every screen that answers a question — values, codes, the rotating shop, the trade calculator — works signed out. What you mark as yours, your favourites and your settings stay on your phone for as long as you have no account.

Signing in is optional and buys one thing: your stuff is still there when you change phones.

What the phone sends even without an account

The app generates a random identifier the first time it opens. It is not a person’s identifier, it is never shown, and it is not tied to your name or your Roblox account for as long as you do not sign in.

That identifier travels with every request, alongside the platform (iOS or Android), the system version, the phone model, the language and time offset, and the app version.

It exists for three things and nothing else: counting your "did this code work?" vote exactly once, knowing which app versions are still in use so we do not break them, and knowing the app has been opened so we stop sending alerts to a phone that no longer has it.

Delete the app and install it again and the identifier is a different one.

Signing in with Roblox

The only way to sign in is Roblox’s official system (OAuth 2.0 with OpenID Connect). It opens in the system browser rather than inside the app, and it is Roblox that asks for your password. We never see it, never receive it and never store it.

We ask for three permissions and no more: openid, to know it is you; profile, to read your username, display name and avatar; and user.inventory-item:read, to see which of a game’s passes and badges you own.

We neither ask for nor receive anything from inside a game: no Robux, no friends, no messages, no who you play with, no where you are connected.

You can withdraw the permission at any time from your own Roblox account, as well as by deleting your account in the app.

What we store if you sign in

From your Roblox account we store five fields and a language: your Roblox user identifier, your username, your display name, the address of your avatar image and of your public profile, plus the date your Roblox account was created and the language you use the app in.

We do not store your email, your date of birth or your age. There is nowhere in the product that asks for them.

Roblox gives us a technical permission so we can refresh those fields when they change and withdraw it if you delete your account. It is stored encrypted and it is never used to act on your behalf: we do not post, play, accept trades or touch your inventory.

That profile is re-read at most once a week, so the avatar in the app is the one you actually have.

The passes and badges you own

With your permission we check, against a short list of passes and badges we curate per game, which of them you own. It lets the app know what is yours without you marking it by hand.

We do not read your whole inventory, we do not keep a copy of everything you own, and we do not show it to anybody. It is yours and only you see it, in your app.

If Roblox has your inventory set to private, the app says so and does not insist.

Sessions, security and IP addresses

To keep you signed in without asking again we store one session per device: the platform, the device name, the app version, the user-agent string and the country it was opened from.

The IP address is not stored. What is stored is an irreversible cryptographic digest of it with a secret salt, which exists to detect a stolen session and not to know where you are. The country is stored, because it is what makes "somebody got into my account" answerable.

The credential that keeps the session open is not stored either — its digest is. If somebody copied our database, nothing inside it would let them into your account.

A session expires after sixty days unused, and you can close it from the app.

Alerts

If you turn alerts on, we store the notification address your phone issues, your language and your time zone, and a record of which alerts were sent and whether they were opened, so they are not repeated and the daily cap is respected.

Alerts are delivered through Expo’s notification service, which hands them to Apple or Google. Without that step there is no way for a notification to reach a phone.

You can switch them off entirely from the app’s settings or from the system’s. If the app is not opened for ten days, we stop sending to that phone on our own.

Advertising

Cubix is free and complete forever: no subscription, no in-app purchases, nothing locked away. It is paid for by advertising.

Advertising in Cubix is served by Google. The file at usecubix.com/app-ads.txt publicly declares which seller is authorised to sell our inventory, which is the industry mechanism that stops anyone selling ads in our name.

Advertising in Cubix is not personalised. The app declares itself family-friendly, which requires non-personalised ads, networks certified for a child audience, and no use of advertising identifiers to profile anybody. We do not share your Roblox account, your name, your inventory or anything you do in the app with the ad network.

You will never see an ad inside a trade calculation in progress, over a shop countdown, disguised as content or as an alert, or an ad you have to watch to unlock a feature.

Who it is shared with

We do not sell data — not yours, not anybody’s. We do not hand it to third parties for their own marketing.

Data is processed on our behalf by the providers that make the product work: Cloudflare, which hosts the service and the database; Expo, for notification delivery; Apple and Google, for delivering those notifications to your phone and for distributing the app; and Google, for advertising.

This can mean data is processed outside your country, including in the United States, under the contractual safeguards European law requires.

In addition, because Roblox’s rules for third-party apps require it and because we agree with them: we do not sell any data obtained through the Roblox APIs, we do not use it to train artificial-intelligence models, we do not track anybody across experiences or combine what we know with data from outside Roblox, and we identify you solely by your Roblox user identifier. If we lost access to those APIs, we would delete everything obtained through them.

We may also disclose data where a competent authority requires it with a valid order.

How long it is kept

While you have an account, your things are kept. When you delete it, your profile is anonymised immediately, the Roblox permission is withdrawn immediately, and the empty row is removed entirely after thirty days.

Sessions expire after sixty days unused. Technical operating records are kept briefly and contain no name, no IP address and no credential.

Votes on whether a code worked stop being tied to you when you delete your account, but the tally stays: it is what makes the code useful to the next person who reads it.

Your rights, and the button

You can access your data, correct it, delete it, object to its processing, ask that it be restricted, and ask for a copy. Write to privacy@usecubix.com and we answer.

Deletion needs no email: it is on your account screen, in the app, one tap. It anonymises the profile, closes every session, withdraws the permission at Roblox and removes the phone from the alert list.

If you think we handle your data badly, you can complain to the data-protection authority in your country.

The legal bases are your consent for signing in, alerts and advertising, and our legitimate interest in the service working and not being abused, for the minimum the phone sends without an account.

Children

A good share of the people who play these games are under age, and the product is designed accordingly: it can be used in full without an account and without giving us any personal data.

If you are under 13, or under the minimum age your country requires, do not sign in without permission from a parent or guardian.

We do not ask for age and we do not infer it. If a parent or guardian tells us a child created an account without their permission, we delete it when we are told: write to privacy@usecubix.com.

Changes to this policy

If something that matters changes, the date above changes and we announce it inside the app. A change that widens what we process is asked for again; it is never taken as accepted in silence.

Contact

Privacy and data: privacy@usecubix.com. Anything else: support@usecubix.com.

Roblox Corporation has its own privacy policy, which governs what Roblox does with your account and is not ours to change.