Privacy Policy

Strix ("Strix", "we", "us") is a free Discord bot and web dashboard for moderating and managing private servers of Emergency Response: Liberty County ("ERLC"), a game on Roblox. It is operated by [Operator legal name], an individual. You can reach us at [contact email] or through our support Discord server.

Two different roles matter under data protection law:

• Communities are controllers of their community data. The Discord community (server) owner who adds Strix decides what data is collected about their players and staff, why, and for how long they keep it. For that data, Strix acts as a processor, handling it on the community's behalf and on their instructions.
• We are the controller of account and login data, meaning the information we receive when you log in to the dashboard with Discord (section 2.1), and of the technical data needed to keep the service secure.

If you are a player or staff member in a community that uses Strix, the community's own rules and privacy practices also apply, and that community is usually the best first contact for questions about how your data is used in their server.

2.1 Discord login (OAuth)

When you click "Log in with Discord" we ask Discord for the identify and guilds scopes. We receive your Discord user ID, username and avatar, and the list of servers you are in and manage, which we use only to show you the communities you can administer. We keep this in a session cookie rather than a separate account database. We never receive your Discord password, email address, or messages.

2.2 Discord server data

• Server (guild) ID, name and icon.
• Channel and role IDs that the community chooses in its settings.
• Members' Discord IDs when they use commands, for example clocking on or off shift, filing leave of absence (LOA), or linking a Roblox username with /link.
• Punishments and notes that staff record about members or players.

We do not read or store the general message history of your server. The bot only handles the commands and interactions addressed to it.

2.3 ERLC data from the PRC private server API

With the server owner's authorization, we read data about the community's private ERLC server through the official Police Roleplay Community (PRC) API. This can include:

• in-game usernames and Roblox user IDs, teams, callsigns, and permission levels;
• player positions and locations on the map, and wanted stars;
• kill logs, join and leave logs, and staff command logs;
• mod calls and 911 calls;
• spawned vehicles (model, plate, colour, and owner).

From that data we create derived records for the community, such as:

• shifts and staff activity;
• incidents, which are automated detections of possible rule-breaking;
• plate reads from virtual cameras;
• analytics and statistics.

We only receive what the game API exposes. We do not collect real names, contact details, or location data beyond in-game positions.

2.4 ERLC server keys

To connect a server, a community supplies its ERLC server key. Server keys are encrypted at rest using AES-256-GCM, are never displayed again after they are saved, and are never shared with anyone other than the PRC API when we make requests on the community's behalf.

2.5 Optional AI feature ("Ask")

If, and only if, a community enables the optional "Ask" feature, the question a user types and the relevant server data needed to answer it (for example logs, shifts or incidents) are sent to Anthropic, which generates the answer. Under Anthropic's commercial terms, API data is not used to train their models by default. If the feature is not enabled for a community, no data from that community is sent to Anthropic.

2.6 Technical data and what we do not collect

Our servers and hosting providers may process standard technical data such as IP address, request time and user agent in operational logs, used to run and secure the service. We do not run advertising, we do not use third-party trackers or third-party analytics, and we do not build advertising profiles.

We use personal data to:

• log you in, show your communities, and keep your session secure;
• provide the bot and dashboard features a community has set up (moderation, logging, shifts, analytics, dispatch tools);
• detect abuse, protect the service, and fix bugs;
• answer support and deletion requests, and meet our legal obligations.

Where laws such as the GDPR or UK GDPR apply, our legal bases are:

• Performance of the service (including taking steps at your request) for login and account data and for providing the features you use;
• Legitimate interests, namely the legitimate interests of the community operating its server in moderating it and keeping it safe and fair, and our own interest in running a secure and reliable service. We balance these against your rights and expectations, and you may object (section 9);
• Consent where it is required, for example where a community asks its members to consent to a specific use. You can withdraw consent at any time without affecting earlier processing.

We do not sell personal data, use it for advertising, or make decisions with legal or similarly significant effects on people without human review by community staff.

We never sell personal data and we do not share it for advertising. We share data only as needed to run the service:

• Discord (login, bot interactions, and sending messages to your server);
• Roblox and the PRC API (to read ERLC data for servers whose owners have authorized this);
• Anthropic, only for communities that enable the "Ask" feature (section 2.5);
• Hosting and infrastructure providers that run our application and database and act as our sub-processors;
• The community itself. Data about a community's players and staff is shown to that community's authorized staff in its dashboard and Discord server, and communities can export it;
• Authorities and advisers where required by law or to protect rights, safety or the service, limited to what is necessary.

Those services handle data under their own terms and privacy policies.

We and our providers may process data in countries other than your own, including the United States. Where personal data is transferred out of the EEA or the UK, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses (with the UK addendum where relevant), typically provided through our providers' data processing terms.

• Login data lives in your session cookie and is removed when you log out or the session expires.
• Player position snapshots are kept for 7 days and then deleted automatically.
• All other community data (logs, shifts, incidents, plate reads, punishments, notes, analytics) is kept until the community deletes it or the server is removed.
• If you remove the bot or the server is removed, we delete that server's data within 30 days.
• Operational logs are kept only as long as needed to run and secure the service.
• Backups, if any, are overwritten on a rolling basis, so deleted data may persist briefly in a backup before being overwritten.

We use measures appropriate to the risk, including encryption of server keys at rest (AES-256-GCM), encrypted connections (HTTPS) between you and the dashboard, and dashboard access limited to authorized community staff. No system is perfectly secure. If a breach affecting your data occurs, we will notify affected communities and, where required, regulators and individuals without undue delay.

Export. Communities can export everything we hold for their server from the dashboard.

Deletion. To request deletion of your data (or your child's), contact us through the support Discord or at [contact email]. Removing the bot from your server, or removing the server from the dashboard, deletes that server's data within 30 days. Because a community controls its own data, we may refer a request about community records to that community's staff and will help them act on it. We may need to verify your identity first, and may keep limited records where the law requires.

Depending on where you live, including under the GDPR and UK GDPR, you have the right to access your personal data, to have it corrected, to have it deleted, to object to or restrict certain processing, to data portability, and to withdraw consent. You can also complain to your local data protection authority.

California (CCPA/CPRA). You may request to know, correct, and delete personal information we hold about you, and you will not be discriminated against for doing so. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information to infer characteristics about you.

To exercise a right, contact us (section 8). For data held in a community's records, the community is the controller and we will route your request to them where appropriate.

Strix is intended for Discord users aged 13 or older, in line with Discord's Terms of Service, and is not directed at children under 13. We do not knowingly collect login data from anyone under that age and will delete it if we learn we have.

Many ERLC players are young, and in-game usernames and Roblox IDs may belong to minors. We limit data to what the game API exposes, and communities must use it responsibly, for moderation only and never to harass, expose, or contact players. Parents and guardians can request deletion of their child's data at any time (section 8).

We use only what is strictly necessary to run the site:

• dispatch_session, a session cookie that keeps you logged in;
• a short-lived OAuth state cookie used during Discord login to prevent forged requests;
• a theme preference stored in your browser's localStorage.

We use no advertising, analytics, or tracking cookies, so no consent banner is shown. You can clear these in your browser at any time; logging in again will set them anew.

We may update this policy as the service changes. We will change the "Last updated" date above and, for material changes, give notice in our Discord server or the dashboard. Continuing to use Strix after a change means you accept the updated policy.

Questions, requests or complaints: [contact email], or ask in our support Discord. See also our Terms of Service and the Legal hub. Operator: [Operator legal name].