Privacy policy

last updated September 17, 2026

The short version

BloxRAP prices Roblox accounts for fun. Without signing in we only read data Roblox already shows to everyone. If you sign in with Roblox we can additionally read your own inventory — and we still don't keep it. There is no database, no account system of our own and no ads tracking.

Without signing in

  • We fetch public Roblox profile data (username, join date, avatar, badge list, friend counts, public inventory) and item prices from Rolimons when you look up a username.
  • Items you add yourself ("Add what you actually own") are stored in your browser's localStorage only. They never leave your device.
  • Sound preference and "already seen this reveal" flags are also stored locally in your browser.

When you sign in with Roblox

  • You are sent to roblox.com. You type your password there, never on BloxRAP. We cannot see it.
  • Roblox asks you to allow three permissions: openid (your user id), profile (username, avatar) and user.inventory-item:read (read your inventory, including private items).
  • We receive a short-lived access token (15 minutes) and use it only to read your inventory for your report and share card. Nobody else's page ever uses your token.
  • The refresh token Roblox sends is revoked immediately. We do not store any Roblox token on a server.
  • We set one encrypted, http-only cookie (bw_session, 30 days) that remembers your Roblox user id and username so we can show "it's you" on your report. The 15-minute access token rides inside that cookie and simply expires; nothing is written to disk on our side.
  • Signing out deletes the cookie. You can also revoke BloxRAP any time at Roblox → Settings → Apps.
  • Roblox only allows accounts aged 13+ to authorize third-party apps. Under-13 accounts can still use everything else on the site.

What we never do

  • Ask for your password, cookies, or .ROBLOSECURITY.
  • Sell, share or export any data — there is nothing stored to sell.
  • Facilitate account sales or trades. Estimates are for fun and are not offers.

Server logs

Like any website, our hosting provider may keep standard access logs (IP address, requested URL, time) for a short period to keep the site running. We don't combine them with Roblox identities.

Contact

Questions or removal requests: open an issue on the project repository or write to the address in the site footer. See also our Terms.