Welcome to the Infinite Craft Recipe Book & Wiki ("we", "our", or "the Site"). The Site is a non-commercial community reference for the Roblox game Infinite Craft AI. By accessing or using the Site you agree to the Terms of Service and acknowledge the Privacy Policy below. If you don't agree, please don't use the Site.
1.1 Who runs the Site. The Site is operated by a single individual as a personal, non-commercial community project, hosted on Cloudflare Pages (free tier). There is no uptime guarantee and no formal customer-support contract.
1.2 Eligibility & accounts. The Site's public wiki content is browsable by anyone. To contribute (submit recipes, vote, star, customise elements, send in-app feedback), you need an account. You can register a username + password, or sign in with Roblox OAuth. You agree:
1.3 User contributions & moderation. When you submit a recipe, cast a vote, give a star, add a note, or participate in any other user-driven content flow, your contribution is stored in the public Site database and attributed to your username (so other users can see who contributed what). Moderators may edit, hide, or remove submissions that are intentionally abusive, spammy, off-topic, malicious, infringing, or that violate the in-game community standards, with or without prior notice. An audit log of moderator actions is kept in moderation_events for administrative review.
1.4 Site roles. In addition to ordinary users, the Site recognises three roles:
The current list of admins, mods, and trusted submitters is publicly visible at /api/mods and surfaced on the Recipes page in the Account panel.
1.5 Prohibited conduct. You agree not to:
1.6 Service availability & modifications. The Site is provided on a best-effort basis with no service-level commitment. Features may change, be paused, or be removed at any time. We may suspend or shut down the entire Site if the running cost is no longer sustainable or the hosting platform changes its terms; if that happens, we will do our best to announce it in the community Discord beforehand so you have a chance to export any data you want to keep.
1.7 No warranty & limitation of liability. THE SITE IS PROVIDED "AS-IS" AND "AS-AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE OPERATOR DISCLAIMS ALL LIABILITY FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF DATA, ARISING OUT OF OR RELATED TO YOUR USE OF THE SITE.
2.1 What we collect. We store the minimum information needed to operate the Site, all kept in a single Cloudflare D1 (SQLite) database at the edge:
users): a username, a one-way password hash (never plain text), an optional Roblox sub user id (if you signed in via Roblox OAuth), an optional Roblox avatar thumbnail URL (if linked), an account-creation timestamp, and is_mod / is_admin / is_trusted role flags.stars_balance = 50; stars_received counts total stars other users have given your recipes. Both are publicly visible.sessions): server-side record of each active login token, bound to your user id, with a 30-day expiry that's pruned lazily on access.recipes): the two elements you combined (a, b), the result, an optional note, the submission status (pending / approved), the moderator who approved them and when, and per-recipe vote/star counts.recipe_votes, recipe_stars): which recipes you voted works/broken on, and which recipes you starred — used to display your own contributions back to you and to drive leaderboards.element_meta): the per-element emoji, colour, mutation, discoverer, and owner that moderators set. Public.notifications): in-app feed telling you when one of your recipes is approved, rejected, starred, or flagged by another user. Capped at 200 entries per user; older entries are pruned automatically. Repeated events on the same recipe collapse into one updated row, so you don't get spammed for star-on/star-off cycles.user_prefs): the in-app settings you've chosen (which display modes are on, recipe page size, etc.). Stored as a single JSON blob so we can add new preferences without a database schema change. Falls back to localStorage for users not logged in.moderation_events): an immutable record of moderator actions against recipes and users, kept for accountability.If you registered via username + password, we never ask for, request, or store your email address through the Site itself. Email shows up only if you voluntarily type one into the feedback widget — see §2.4 below.
2.2 Cookies. We set two cookies, both HttpOnly + SameSite=Lax, with Secure auto-derived from your connection (set on https, omitted on plain http so local development still works):
session — your login token. 30-day expiry. Cleared on logout. Path /.oauth_state — a CSRF token issued during the Roblox OAuth handshake. 10-minute expiry, scoped to /api/auth/roblox. Without this binding a malicious site could trick you into completing an OAuth flow that links the attacker's Roblox identity to your account (RFC 6749 §10.12).We use no third-party analytics or advertising cookies, and we set no client-readable cookies ourselves.
2.3 IP addresses & rate limiting. Each request to the Site carries the originating public IP via Cloudflare's CF-Connecting-IP header. Failed login, register, and reset-password attempts record an auth_attempts row keyed to (ip, endpoint) so we can throttle brute-force attempts (10 failed logins per IP per 5 minutes, 5 registrations per IP per 10 minutes, 5 failed reset attempts per IP per 10 minutes). These rows are pruned automatically when they fall outside their window. The feedback endpoint keeps a short-lived in-memory per-IP cooldown (60 seconds) so rapid-fire feedback submissions can't flood Discord. Successful login and reset-password calls clear their bucket so a typo-then-succeed user isn't punished for their mistakes.
The IP itself is never stored against your user record, never exported, and never shared with a third party.
2.4 Feedback widget. The 💬 Feedback button in the bottom-left of every page opens a small modal that lets you type a message (max 2000 characters) and an optional reply email (RFC-validated, max 254 characters). When you submit, the message, the email (if provided), the URL of the page you were on, and — if you're logged in — your username and Roblox avatar URL (read from your local fb_user entry) are POSTed to /api/feedback. The handler formats the payload as a Discord embed and forwards the whole thing to a private Discord webhook.
functions/api/feedback/index.js.2.5 What is publicly visible. The Site is a wiki — significant portions of your activity are visible to anyone, no login required:
is_mod / is_admin / is_trusted flags.stars_balance, your stars_received, and the date your account was created (on your profile)./api/users/[username]/activity and your public profile page./api/leaderboard if you have received enough stars to qualify.If you do not want your username, avatar, or submission history associated with this Site, do not register an account.
2.6 Where your data lives. All of the data described in §2.1 sits in a single Cloudflare D1 (SQLite) database replicated across Cloudflare's global edge network. About eleven tables in total — users, sessions, recipes, recipe_votes, recipe_stars, moderation_events, password_resets, element_meta, user_prefs, notifications, and the rate-limit helper's auth_attempts rows. Authentication cookies are scoped per-origin and aren't shared with anyone else. Password hashes use a one-way cryptographic algorithm and aren't reversible. We do not back D1 up to anywhere else, and we do not export user records for any third party.
2.7 On request — data export. Because the database is small and you own the data you put in, we're happy to provide a copy of your stored data (recipes you submitted, votes you cast, notification history, profile fields) on request. Ask via Discord (see §4).
2.8 What we don't do. To be explicit, the Site does not:
3.1 Game data & affiliation. Infinite Craft AI is a Roblox game developed and operated by Strongest Roblox Players. The Site is an unofficial, community-run reference and is not affiliated with, endorsed by, sponsored by, or representative of Strongest Roblox Players, Roblox Corporation, or any of their subsidiaries. All game screenshots, gameplay descriptions, badge listings, marketplace data, and similar content are referenced for informational purposes only.
3.2 Trademarks. "Infinite Craft", "Infinite Craft AI", "Roblox", and the Roblox logo are trademarks of their respective owners. Their appearance on the Site is purely descriptive — identifying the game the recipes and elements come from — and is not intended to imply endorsement or a commercial relationship. Element names and short descriptions originate from the game and from the contributing community and remain the intellectual property of their respective creators; user-contributed recipes and notes live in the public Site database on a permissive "use freely for gameplay and personal wiki purposes" posture (see §1.5).
3.3 Third-party services we depend on. To make the Site work we rely on:
openid profile scopes (a public user id and an avatar URL). We do not request openid email and we do not receive your Roblox password.Each of these services has its own privacy practices; your use of the Site acknowledges that some of your data is processed by them according to their own terms.
users row, your sessions, your submitted recipes, your recipe_votes, your recipe_stars, your user_prefs, your notifications, and any moderation_events you were the actor on. For takedowns, copyright complaints, bug reports, partnership enquiries, and data-export requests the same channel works — we're a tiny operation and Discord is the fastest way to reach us. Response time is best-effort; we have no formal SLA.
The Last updated date below tracks the last time this document materially changed. By continuing to use the Site after a "Last updated" change you accept the new terms. Material changes — anything that changes what data we collect, who can see it, or how the Site operates — are also announced in the community Discord so existing users have a heads-up. If you don't agree with a change, you can request account deletion under §4 above before the new terms take effect on your continued use.