Community policies

Privacy Policy

Last updated: 29 September 2026

This policy explains how Arizona State Roleplay handles information in connection with the staff guide at azrp.website. It covers this website, not every activity on Roblox, Discord, or other services.

1. Information that may be processed

When you visit, we and our hosting provider may process technical information such as your IP address, request time, requested URL, browser or device information sent with the request, response status, and diagnostic or security logs. Some of this information is needed to deliver the page and protect the service.

If you contact leadership about the site, we may receive the username, contact details, messages, and supporting information you choose to provide through that support channel. Please send only what is needed and do not send passwords, authentication tokens, payment details, or unnecessary information about other people.

2. Search, checklists, and clipboard

The current guide processes search text, callsign previews, selected filters, and checklist ticks in your browser. These entries are not submitted to our server or stored by the guide in a database. They are temporary and normally reset when the page reloads.

When you choose Discord sign-in, Discord asks permission for the identify and guilds.members.read scopes. We receive your Discord user ID and membership information, including roles, for our designated server to verify staff access. We do not request your email address, password, messages, or permission to join servers for you. Discord's own processing is described in Discord's Privacy Policy.

We store your Discord user ID, username, display name or server nickname, avatar URL, and role IDs for this server in your session so you can view your own staff profile. The session also contains verification and expiry times, configured server and role IDs, a hashed session identifier, and encrypted OAuth access and refresh tokens. If configured, our bot looks up the server's role names for display; role names do not grant access. We do not request your roles in other servers. Access checks and profile updates happen at login and at least every five minutes when protected content or session status is requested; an open, visible guide also requests session status every minute.

Your profile is visible through your authenticated session and is not a public member directory. Profile images load from Discord's image service, which receives the usual connection information, such as your IP address, when your browser requests the image. Your profile details are removed with the session under the retention rules below.

Copy buttons write the displayed greeting or command to your clipboard only when you activate them. The guide does not read your clipboard. Your device or clipboard manager may retain copied text according to its own settings.

3. Cookies and tracking

When signed-in staff open a page within the Staff, Internal Affairs, or High Rank guide, the website records their Discord user ID, the guide and page name, and the server-recorded access time. These navigation records are sent as bot embeds to the designated staff access-log channel on Discord for staff oversight and security. They do not include page contents, practice answers, case notes, IP addresses, or authentication credentials. People permitted to view that Discord channel can see these records.

Delivery and duplicate-prevention records are kept in the website database for up to seven days, then removed during scheduled cleanup. Temporary delivery failures may delay notifications. Discord messages remain until removed by authorised channel managers, subject to Discord's own processing. Contact leadership through the support process for questions about access records or deletion requests. A navigation record indicates a page was opened, not that its content was read or understood.

We use two necessary first-party cookies: a short-lived OAuth security cookie (up to ten minutes) and a login session cookie (up to seven days). They contain random identifiers and use Secure, HttpOnly, and SameSite protections in production. The security cookie helps prevent forged sign-in requests; the session cookie keeps you signed in across visits. You can remove them through your browser settings, but doing so signs you out and does not by itself delete existing server records.

Staff feedback

The public home page displays staff reviews from the designated Discord feedback channel, limited to recognised messages from the approved sender. Staff names or Discord IDs, ratings, review text, and timestamps are displayed and grouped by staff member. Structured submitter names and IDs, private source-message links, and raw Discord messages are not included in the public feed. Discord IDs in review text are masked, but free-text reviews may still contain identifying information; this is not a guarantee of anonymity. Do not submit private or sensitive details for publication. Contact leadership through the support process about inaccurate or inappropriate reviews.

Feedback is temporarily cached in server memory and is not archived in the website database or sent to Gemini. Source edits and deletions are reflected when the relevant page is fetched again after cache expiry. Public reviews can be viewed without signing in and may be copied by visitors. A confirmed-source badge identifies the approved sender, not the accuracy of the review.

Optional AI training

When enabled, SPaG and scenario practice sends your submitted practice text, the fictional scenario, and the relevant coaching instructions to Google's Gemini API. Use fictional examples only. Do not submit real reports, private messages, identifying information, credentials, or confidential case material. Your Discord identity is not included in the AI request. The website does not save your answers or AI feedback in a database; they remain temporarily in the page and are cleared when it reloads. Hashed account identifiers and request counters are stored temporarily to enforce usage limits.

Google processes AI inputs and outputs under its own terms. Treatment depends on the account's service tier, and Google may retain content for abuse prevention. Unpaid services may use content for improvement and human review. See Google's Gemini API terms. These optional tools are restricted to eligible adults and require confirmation before sending. Do not use them if you are under 18. AI feedback can be inaccurate and is not an official grade, policy, or disciplinary decision.

The guide does not use local storage, advertising trackers, or third-party analytics scripts. Hosting infrastructure and external platforms may process technical information independently. If we introduce non-essential tracking, we will update this policy and obtain any consent required by applicable law.

The public Analytics page shows aggregate ER:LC server activity, including player counts, capacity, queue size, online staff counts, and team totals. Our server requests live game data from the ER:LC API and reduces player entries to counts. Analytics does not retain or publish player names, IDs, locations, callsigns, private logs, or the server join key. Aggregate readings are retained for seven days, with expired readings removed by periodic cleanup. These statistics describe game activity, not individual website browsing.

4. Why information is used

We use relevant information to deliver and maintain the guide, diagnose faults, respond to support requests, investigate abuse or unauthorised disclosure, enforce community rules fairly, and meet applicable legal obligations. We do not use guide entries to build advertising profiles or make automated disciplinary decisions. Where applicable law requires a legal basis for processing, we must have one; this notice is not a substitute for consent where consent is required.

5. Hosting and disclosures

The site is hosted on Railway. Its infrastructure may process request and connection data, including IP addresses, and retain logs according to the service configuration and provider policies. See Railway's Privacy Policy for its practices.

Relevant information may be accessible to authorised community operators and service providers who need it for hosting, troubleshooting, security, or support. We may disclose information where legally required, to respond to valid legal process, or where reasonably necessary and lawful to address abuse or protect people's rights and safety. We do not publish technical logs or personal information as punishment.

6. Retention and security

Login sessions expire seven days after sign-in. Sign-out deletes the active session on that device; failed staff checks or invalid authorisation also remove the affected session. Expired session records and OAuth security records are removed by a cleanup job every fifteen minutes while the service is running, and on startup. Expired records never grant access while awaiting cleanup. Temporary aggregate login counters are also removed. Hosting logs, backups, and support records may have different retention periods depending on provider settings and legal or security needs; contact leadership for details.

Session tokens are encrypted in the database, and staff access is checked by the server before it sends protected content. The Terms and Privacy pages remain public. No website or storage method can guarantee complete security or retrieve copies already viewed or saved by an authorised user. Please report suspected exposure privately; we will assess it and make notifications required by applicable law.

7. International processing

Hosting and support services may process information in countries other than your own. Locations depend on the configured hosting region and the provider's operations. Contact leadership for information about the current arrangements. Where applicable law requires safeguards for an international transfer, those requirements still apply.

8. Your choices and requests

You can read the public policy pages without signing in. Access to the operational guide requires Discord authorisation and the current staff role; the reference tools remain optional. Use Sign out to end this device's session. You can also revoke the app in Discord's Authorised Apps settings; access ends when invalid authorisation is detected at the next check. Depending on the law that applies, you may be entitled to request access, correction, deletion, restriction, portability, or object to certain uses of your personal information, and withdraw consent where processing relies on it.

Contact Arizona State Roleplay leadership through the community Discord's support or ticket process. Describe your request and the information concerned without posting it publicly. We may need proportionate verification before releasing or changing records. We will respond as required by applicable law and explain any lawful limits, such as necessary security records or information we do not control. You may also complain to the privacy regulator with authority over your situation.

9. Young users and other services

The staff guide is not directed at children under 13. Users must also meet the applicable platform age requirements. If you believe a child has provided personal information through a related support request, contact leadership so it can be reviewed and removed where appropriate. Roblox, Discord, and other external services operate under their own policies; using those services may involve separate data collection.

10. Policy changes

We will update this page and its revision date when our practices change. Material changes should also be communicated through the community's announcements. We will provide any additional notice or choice required by law. This policy can be shared independently of the confidential operational guide.