Privacy Policy

Who we are

This Privacy Policy describes how North Carolina State Roleplay (“NCSRP,” “we,” “us”) handles information when you use the website at ncsrp.xyz (the “Site”). The Site provides community pages, Discord sign-in, optional Roblox account linking for Discord shop claims, and access to closed-ticket transcripts for authorized users.

The Site has no separate user database of its own. Account and link data used for Discord features are stored by our Discord bot service (“NC Operations”), not in a website-owned database.

Information we collect

Depending on how you use the Site, we may process:

• Discord account data — when you sign in with Discord OAuth (scopes identify and guilds): Discord user id, username, avatar, and guild membership information needed for access checks. We store Discord OAuth access and refresh tokens in an encrypted, httpOnly session cookie on your browser.
• Roblox account data — when you link Roblox via OAuth (scopes openid and profile): Roblox user id (sub) and display username. We do not keep Roblox refresh tokens for linking. The Discord↔Roblox link is stored by the bot service so Discord shop claims can verify ownership.
• Ticket transcript content — when you open a transcript you are allowed to view, the Site fetches that record from the bot service and displays it. Transcripts may include Discord message content, attachments, and related metadata from closed support tickets.
• Technical data — standard server logs (e.g. IP address, user agent, request path/time) from our hosting provider, and short-lived OAuth state cookies used to protect login and Roblox linking flows.

How we use information

• Authenticate you and keep you signed in on the Site
• Authorize access to staff areas and ticket transcripts
• Link your Discord and Roblox identities for community shop / game-pass claims
• Operate, secure, and troubleshoot the Site and related bot services
• Comply with Discord, Roblox, and applicable platform rules

We do not sell your personal information.

Cookies and session storage

We use essential cookies only:

• Session cookie — encrypted Discord OAuth tokens and basic profile fields so you stay signed in
• OAuth state cookies — short-lived CSRF protection for Discord login and Roblox linking
• OAuth known cookie — remembers that this browser previously authorized Discord so we can attempt a quieter re-login

These cookies are required for sign-in and account linking. Clearing cookies or using Log out ends the Site session on this device.

Sharing and processors

We share information only as needed to run the service:

• Discord — authentication and identity APIs when you sign in
• Roblox — OAuth when you choose to link a Roblox account
• NC Operations (our Discord bot) — receives Discord user tokens (over a private server-to-server API) to check access, serve transcripts, and store Roblox link records
• Hosting — infrastructure providers (e.g. Railway) that host the Site and bot and may process request logs

Your browser never talks directly to the private bot API. The Site’s server acts as a backend-for-frontend.

Retention

• Site session — kept while your session cookie is valid (about 30 days, with token refresh), or until you log out
• Roblox link — kept by the bot until you unlink on Account or staff remove it through operational processes
• Transcripts — retained by the bot according to community ticket operations; the Site does not keep a separate copy after the page response
• Server logs — retained according to our hosting provider’s defaults and operational needs

Your choices

• Manage Roblox linking (link, relink, or unlink)
• Log out to clear the Site session cookie on this device
• Revoke the Discord application’s access in your Discord settings (Authorized Apps)
• Revoke Roblox OAuth access in your Roblox account settings if you previously linked

Children

The Site is intended for users who meet Discord’s and Roblox’s minimum age requirements (generally 13+, or older where required by local law or platform policy). We do not knowingly collect personal information from children below those ages. If you believe a child has provided data through the Site, contact us via Discord so we can delete it.

Contact

Privacy questions and data requests: reach NCSRP staff through our Discord server — discord.gg/K3j69ZkQpa.

Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the Site after an update means you acknowledge the revised policy.