Privacy Policy

Version 2026.11.04 · 109 provisions in 21 sections · See also our Terms of Service

1. About This Policy

1. 1.1This Privacy Policy explains what personal information the CITY PLAY account services (the "Service") collect, why, how it is used and shared, how long it is kept, and the choices and rights you have.
2. 1.2The Service is operated by CITY PLAY, which is responsible for the personal information described here.
3. 1.3This Policy describes the Service as it is actually built: if a type of data is not listed here, the Service does not collect it.
4. 1.4This Policy does not cover Discord or Roblox, which process your data under their own privacy policies.
5. 1.5CITY PLAY has not obtained any third-party privacy or security certification, and this Policy does not claim one.

2. Information from Discord

1. 2.1When you sign in with Discord we receive, through Discord's OAuth2 "identify" permission: your permanent Discord user ID, your username, your display (global) name, and the address of your profile picture.
2. 2.2We do not request access to your Discord email, messages, friends list or server list.
3. 2.3Our bot records whether you are a member of the CITY PLAY Discord server, and updates this when you join or leave.
4. 2.4Our bot reads your server roles when you use a command, so it can check staff permissions; roles are not stored.
5. 2.5We never receive your Discord password.

3. Information from Roblox

1. 3.1When you link Roblox we receive, through Roblox's official OAuth "openid" and "profile" permissions: your permanent Roblox user ID, your username, your display name and your profile picture address.
2. 3.2When you or staff refresh your account, we read your public Roblox profile and avatar from Roblox's public APIs.
3. 3.3If staff review is enabled and you request a manual review, we store the Roblox user ID and note you submit.
4. 3.4We never receive your Roblox password, browser cookies or security codes.

4. Information You Provide

1. 4.1Your email address, if you choose to connect one.
2. 4.2Your website display name, optional custom server nickname, and your preferences (nickname synchronization, public profile visibility, security-email notifications and layout).
3. 4.3Your acceptance of these documents, including the version accepted and when.
4. 4.4Any information you send to us when you contact staff.

5. Information Created When You Use the Service

1. 5.1Session records: when each session started, when it was last used, when it expires, the sign-in method, your IP address and your browser's user-agent string.
2. 5.2Login history: the time, sign-in method, success or failure, IP address and user-agent of sign-in attempts to your account.
3. 5.3Security events: changes to your account such as linking or unlinking accounts, email changes, display-name changes and staff actions, with the time and IP address where available.
4. 5.4Account linking history: which Discord, Roblox and email identities were linked or unlinked, when, and by whom; email addresses are stored here only in masked and hashed form.
5. 5.5Verification records: when your verification status changed, the linked IDs involved and the method used.
6. 5.6Moderation records: actions taken by staff against your Discord account, including case number, type, reason, notes, duration, responsible staff member and time, together with your Discord ID and, if linked, your Roblox ID.
7. 5.7Audit logs: a record of staff and security-relevant actions, including the account affected and the IP address of the person acting through the website.
8. 5.8Agreement records: your user ID, the agreement and document versions accepted, the time of acceptance and your IP address.
9. 5.9Temporary one-time email codes, which are stored only as keyed cryptographic hashes and deleted within a day.

6. Information We Do Not Collect

1. 6.1We do not collect passwords for Discord, Roblox or email accounts, and the Service has no passwords of its own.
2. 6.2We do not store OAuth access tokens; they are used once to read your identity and then revoked.
3. 6.3We do not use advertising, advertising trackers, or third-party analytics.
4. 6.4We do not knowingly collect payment information.
5. 6.5We do not intentionally collect special categories of personal information, and you should not send us such information.

7. Cookies and Similar Technologies

1. 7.1The Service uses one essential cookie that keeps you signed in and protects forms against cross-site request forgery.
2. 7.2The cookie is signed to prevent tampering, is not readable by page scripts, and is sent only over HTTPS when the site is served over HTTPS.
3. 7.3The cookie also briefly holds sign-in state while you are redirected to Discord or Roblox.
4. 7.4We do not use cookies for advertising or tracking across other websites.
5. 7.5Your browser loads profile pictures directly from Discord's and Roblox's image servers, which means those companies may receive your IP address under their own privacy policies.

8. How We Use Information

1. 8.1To create and operate your account and sign you in.
2. 8.2To confirm that you control the Discord and Roblox accounts you link, and to prevent one Roblox account being linked to multiple people.
3. 8.3To assign or remove Discord roles and set your server nickname according to your status and settings.
4. 8.4To display your account, moderation history and security information to you.
5. 8.5To let authorized staff moderate the community, review verifications and investigate abuse.
6. 8.6To detect and prevent fraud, impersonation, ban evasion, account takeover and abuse of the Service.
7. 8.7To send one-time codes and security notices to your connected email.
8. 8.8To keep records needed to demonstrate that you accepted the current Terms and Privacy Policy.
9. 8.9To maintain, secure, troubleshoot and improve the Service.
10. 8.10To comply with legal obligations and respond to lawful requests.

9. Legal Bases for Processing

1. 9.1Where data-protection laws such as the GDPR or UK GDPR apply, we rely on the following legal bases.
2. 9.2Performance of a contract: to provide the account, linking, verification and dashboard features you request.
3. 9.3Legitimate interests: to keep the community and Service safe, moderate the Discord server, prevent ban evasion and abuse, and keep security and audit logs; we balance these interests against your rights.
4. 9.4Consent: for optional features you choose to use, such as connecting an email address; you can withdraw consent by removing the email at any time.
5. 9.5Legal obligation: where we must keep or disclose information to comply with the law.

10. Who Can See Your Information

1. 10.1You can see your own account information, linked accounts, moderation history, sessions and security events.
2. 10.2Other members cannot see your moderation history, email address, login history or security events.
3. 10.3If your profile is public (the default), other server members can use the /verified command to see that you are verified and which Roblox account you linked; you can turn this off in your settings.
4. 10.4Authorized staff can see account and moderation information needed for their role; access is tiered by staff level and staff actions are logged.
5. 10.5Verification and moderation logs may be posted in staff-only Discord channels configured by server administrators.
6. 10.6When you receive a warning, timeout, kick or ban, the bot may send you a direct message about it.

11. Sharing with Third Parties

1. 11.1We do not sell your personal information and do not share it for advertising.
2. 11.2Discord receives role and nickname changes made by our bot, and moderation actions executed through it.
3. 11.3Roblox and Discord receive the requests needed to authenticate you and read public profile information.
4. 11.4Our email delivery provider processes your email address and message contents in order to deliver codes and notices.
5. 11.5Our hosting provider stores the servers on which the Service and its database run.
6. 11.6We may disclose information if required by law, to respond to valid legal process, or where necessary to protect the safety of any person.
7. 11.7If the Service is transferred to another operator, your information may be transferred with it under this Policy.

12. International Transfers

1. 12.1Our servers and service providers may be located in a different country from you.
2. 12.2Where the law requires it, we use appropriate safeguards for international transfers of personal information.
3. 12.3Discord and Roblox may process your information in other countries under their own policies.

13. Data Storage

1. 13.1Your information is stored in a database on servers operated for the Service.
2. 13.2Accounts are keyed by permanent platform IDs so that username changes do not break links.
3. 13.3Database backups may be kept by the operator for disaster recovery and are protected like the live database.

14. Data Security

1. 14.1We encrypt connections to the website using HTTPS when it is deployed with a TLS certificate, as recommended.
2. 14.2Session identifiers are random, stored only as hashes, expire automatically and can be revoked by you at any time.
3. 14.3Forms are protected against cross-site request forgery, and pages are protected by a strict content security policy.
4. 14.4Sign-in, email and code-entry endpoints are rate-limited, and one-time codes are locked after repeated failures.
5. 14.5Database queries use parameterized statements, and user-supplied content is escaped before display.
6. 14.6Secrets such as bot tokens and OAuth client secrets are kept in server configuration, not in website code.
7. 14.7Staff access is permission-based and audited.
8. 14.8No method of storage or transmission is completely secure; we cannot guarantee absolute security of your information.

15. Unauthorized Access, Breaches and Information Exposure

1. 15.1If we discover unauthorized access to personal information, we will investigate promptly and take reasonable steps to contain it.
2. 15.2Where required by applicable law, we will notify affected users and the relevant authorities within the time the law requires.
3. 15.3Notifications may be sent by email, through the dashboard, or through the CITY PLAY Discord server.
4. 15.4If your Discord, Roblox or email account is compromised, someone may be able to access your CITY PLAY account; secure those accounts and sign out of all sessions from your Security page.
5. 15.5Information you choose to make public, such as your linked Roblox account on a public profile, can be seen by other members and may be recorded by them.

16. Data Retention

1. 16.1Account, linked-account, settings and email information is kept while your account exists.
2. 16.2Login history, security events and session records are kept while your account exists; expired or revoked sessions are deleted about 30 days after they end.
3. 16.3One-time email codes are deleted within one day.
4. 16.4Agreement records are kept while your account exists so we can show which version you accepted.
5. 16.5Moderation records, verification records and audit logs may be kept after your account is deleted, linked only to your Discord and Roblox IDs, for as long as reasonably needed for community safety, appeals and preventing ban evasion; staff review these records periodically.
6. 16.6Backups are overwritten on the operator's backup rotation schedule.

17. Data Deletion

1. 17.1You can delete your account at any time from the Security page; this immediately deletes your account, linked accounts, email, settings, sessions, login history, security events and agreement records.
2. 17.2You can disconnect your Roblox account, email address or (if you have a verified email) your Discord account at any time from your Settings page.
3. 17.3You can ask us to delete moderation records or audit logs that relate to you; we will do so unless we have a legitimate reason or legal obligation to keep them, and we will explain our decision.
4. 17.4Deleting your CITY PLAY account does not delete your Discord or Roblox accounts.

18. Your Privacy Rights

1. 18.1Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, and to receive a copy of it in a portable format.
2. 18.2You may withdraw consent where we rely on consent, without affecting earlier processing.
3. 18.3Residents of some US states may have rights to know, delete and correct personal information, and to not be discriminated against for exercising those rights; we do not sell or share personal information for cross-context behavioral advertising.
4. 18.4You can exercise many of these rights yourself in your dashboard; for others, contact us at CITY PLAY staff through the official CITY PLAY Discord server.
5. 18.5We may need to confirm your identity before acting on a request, normally by asking you to sign in.
6. 18.6We will respond within the time required by applicable law.
7. 18.7You have the right to lodge a complaint with your local data-protection authority.

19. Children

1. 19.1The Service is not directed at children under 13.
2. 19.2If we learn that we hold personal information of a child under 13 without appropriate consent, we will delete it.
3. 19.3Parents or guardians who believe a child has used the Service may contact us at CITY PLAY staff through the official CITY PLAY Discord server.

20. Changes to This Policy

1. 20.1We may update this Policy to reflect changes in the Service or the law.
2. 20.2Each version carries a version identifier shown at the top of this page.
3. 20.3If we make a material change, we will ask you to review and accept the updated Policy before you can use the dashboard again.

21. Contact

1. 21.1Questions or requests about this Policy or your personal information can be sent to CITY PLAY staff through the official CITY PLAY Discord server.
2. 21.2You can also contact CITY PLAY staff through the CITY PLAY Discord server.