Privacy Policy

Last updated: 2026-06-16.

Template notice. This is a good-faith starter policy describing how SboxPlays actually handles data. It is not legal advice — have it reviewed by a qualified person before relying on it for a public or EU/UK launch, and replace the contact domain below with your real one.

SboxPlays ("we", "the site") is a fan-made website for browsing and launching s&box games. This policy explains what data we process, why, the legal basis, how long we keep it, and the rights you have. We are not affiliated with Facepunch Studios or Valve.

1. Who we are / contact

For any privacy question or to exercise your rights, contact [email protected]. To report abuse or illegal content, use [email protected] (see our Terms of Service).

2. Data we process

Category	What	Why (purpose)	Legal basis (GDPR)
Account identity	Your 17-digit Steam ID and public Steam persona name & avatar	Sign you in, show your profile, attribute your posts	Contract / legitimate interest
Social graph	Friend requests and friendships you create on the site; blocks	Provide the friends/social features	Contract
Your content	Reviews, community posts/comments, chat messages, avatar/wardrobe choices, favourites & subscriptions	Show your content to you and others as intended	Contract
Safety	Reports you submit or that are submitted about your content	Moderation, legal compliance, keeping the platform safe	Legal obligation / legitimate interest
Technical	IP address (transiently, for rate-limiting/anti-abuse), browser type	Security, abuse prevention, keeping the service running	Legitimate interest
Analytics (opt-in)	Pages viewed, games opened/launched/searched, engagement, country/region, device, anonymised session layout recordings	Understand usage to improve the site	Consent

3. Analytics & cookies

We use privacy-friendly product analytics (PostHog, EU-hosted). Analytics run only after you click "Accept" on the consent banner; decline and no analytics cookies are set and no usage events are sent. The content of anything you type is masked in recordings — passwords, chat and search text are never captured visually. We respect browser "Do Not Track" and tracker blockers. A small, strictly-necessary cookie signs you in (sbsession); it is not used for tracking and needs no consent.

4. Third parties

Steam (Valve) — sign-in (OpenID) and public profile/friends/server data.
sbox.game (Facepunch) — the game catalogue and related public data.
PostHog (EU) — analytics, only with your consent.
YouTube / Twitch / Kick — embedded creator content on the Creators page.
Cloudflare — CDN, TLS and security/DDoS protection.

We never sell your data.

5. How long we keep it

Account and content data is kept while your account exists. When you delete your account (see below) we remove your profile, social graph, reviews, community posts, chat, favourites and wardrobe. Reports and minimal safety/audit records may be retained as required for legal compliance. Analytics data follows PostHog's retention and can be deleted on request.

6. Your rights

Under the GDPR / UK GDPR you can access, export, correct, delete, restrict or object to our processing, and withdraw consent at any time. In the app you can:

Download your data — Profile → Settings → "Download my data".
Delete your account — Profile → Settings → "Delete account".
Withdraw analytics consent — re-open the consent choice from the footer.

Or email [email protected] and we'll action it. You may also complain to your local data protection authority.

7. Children

SboxPlays is not directed at children under 13 (or the minimum digital-consent age in your country, if higher). We do not knowingly collect data from children under that age; if you believe we have, contact us and we'll delete it. See the Terms.

8. Changes

We'll update the "last updated" date above when this policy changes materially.

← Back to SboxPlays · Terms of Service