Privacy

Updated 12 November 2026.

Your saves stay on your PC

Your routes, times, ghosts and settings are saved on your PC, in the storage that Steam's in-game browser keeps for save.boxrun.gg. BoxRun opens that small page inside the game to save and load. Your routes and times stay on your PC until you press SHARE.

What SHARE publishes

Pressing SHARE publishes that route and its ghost to BoxRun's server, api.boxrun.gg, and gives it a short code. Anyone with the code can load the route and race the ghost. The route carries the creator name you gave it, and the ghost carries your Steam name as its runner. BR1 codes, the long kind, work without the server.

A route you share for the first time is also listed in COMMUNITY, the in-game list of players' routes, with its name and maker, so anyone can find it there. CODE ONLY, beside it on the SHARED screen and on the route's MORE, takes it off the list at once, and then only people with the code can load it. LIST IN COMMUNITY puts it back. An update keeps the route as it was, and routes shared before BoxRun 2.3.1 stay code only until you list them.

COPY RESULT copies your time, and on a shared route a link whose end holds that time and your Steam name, so the link's preview reads "Can you beat 25.703?". The link page reads them from the link and keeps nothing. Nothing is sent until you paste the link somewhere.

The weekly board

Sending a time to the weekly board is your choice. BoxRun never sends one by itself. When you press SEND MY BEST, BoxRun sends that run to api.boxrun.gg: its time and checkpoint times, the hero, the souls and game speed it was run at, how many runs you finished on the route this week, your Steam name and the run's ghost. Your name, time, hero and runs show on the board in every BoxRun game, anyone can watch the ghost, and the week's winners may be shown in BoxRun's results video. Players near your place on the board see your name and time beside theirs, not only the players who look at the top rows.

The server keeps your entry and its ghost for good, so past weeks' boards can be shown again. Your name, time, hero and runs show on that week's page, and anyone can race or watch the ghost. A scrambled form of the internet address that sent it is kept only to block cheats, and it's deleted 14 days after the week ends, when the next week's route starts. REMOVE MY TIME takes your entry and ghost off at once while the week is on. To have an entry from a past week taken off, with your name in that week's results, ask in the Discord.

What the menu asks for

When the menu opens, BoxRun asks api.boxrun.gg for the route of the week and its board, the newest BoxRun version and any notice. With a time of yours on this week's board, opening that route's page also asks for your place, at most once a minute. When you open a shipped route or one you loaded by code, BoxRun checks that code for a newer version, once a session. Loading a code sends a request for that code. Pressing RACE #1 or WATCH #1 on this week's route asks for the ghost of the board's fastest time. WATCH and RACE on last week's winner ask for that ghost.

Anonymous counts

BoxRun sends a few counts to api.boxrun.gg so we can see where new players get stuck and which routes get played:

• once each: the first time the map loads, the menu opens, the menu is in front of you, you shoot or melee while it's open, press one of its buttons, go to a route's start, the start says READY, you start a run, finish one, finish one that counts, make a route, load a code or open COMMUNITY, with the number of days since your first day and how many minutes after your first map load it came, rounded down to 0, 1, 2, 5, 10, 30 or 60 minutes or a day. Your first finished run also says whether it counted, or why not: a slowed game speed, a box missed or not collected, another hero than the route's, noclip, a missed checkpoint, or a time too fast to be real. If your first run ends without a finish, one count says how it ended (restarted, back at the start, another route loaded, or the game closed during it) and how many checkpoints you'd passed, rounded down to 0, 1, 2, 5 or 10
• once a day you play: the days since your first day, whether it's your first day this week, and whether you came back the day after your first day or in your second week
• after you play: how many runs you started, finished and got counted, how many of the counted ones were on sample, creator, community or your own routes, and the short code of each of those routes that has one, with how many runs and whether this PC sent that code before (up to 20 codes in one count)

Every count also carries BoxRun's version number and says which of these it is (for example “a run finished”). Nothing else, and no ID of any kind. They never include your routes, times, splits, names, Steam ID or saves. The server adds them to daily totals, and the short codes to each route's totals of runs and players, and keeps only the totals. With counts off, the menu's request for the route of the week isn't counted either. OPTIONS > RUNNING > COUNTS turns them off.

What the server keeps

• The routes and ghosts people publish.
• A scrambled form (a keyed hash) of the internet address that sent a request, never the address itself. It's used to limit how often one player can send requests, to block spam, to handle reports, to count each player who loads a code once, and to count how many players opened the menu each day and how many of them also opened it the day before. Only the daily totals of those menu counts are kept.
• The hourly counters for those limits expire within 4 days. The record that a scrambled address loaded a code, and when it first loaded one, is kept, because it's what "Loaded by N players" and the player counts use. Reports are kept until the route is reviewed.
• Daily totals of the anonymous counts, and each route's totals of runs and players from them.
• Some codes we post, for example under a video, are extra codes for the same route, so we can see which post brought players. Loading one counts you once for that code, the same way loading any code does.
• Links through boxrun.gg/yt, boxrun.gg/tt and api.boxrun.gg/go/, such as the GameBanana link under our videos, add one to that link's click total for the day and send you on. Nothing about who clicked is kept beyond the hourly limit counters above.
• Weekly board entries you sent, with their ghosts, and each week's results. The scrambled address on an entry is deleted 14 days after its week.
• Server logs hold no request contents and are deleted after 14 days.

The server never sees your Steam account or your saves, sees a best time only if you send it to the weekly board, and sets no cookies. Scrambled isn't the same as anonymous: whoever holds the server's key could match a hash to an address, and only the server and Marcus hold it.

Visits to boxrun.gg

The home page and the press page count visits with Cloudflare Web Analytics, which sets no cookies. This page and the save page don't count visits.

Nothing else

Nothing else is collected. Questions, or a route of yours you want taken down: ask in the BoxRun Discord.