Privacy Policy

1. Who we are

CORE operates and maintains the websites, account-linking service, dashboards, Discord bots, and related technical services used by the Citramaria community. Citramaria is the community these services support; CORE does not claim ownership of Citramaria as a community. The existing Scholars Archive remains a separate interface but may use shared account and permission information.

2. What this policy covers

This policy explains how personal information is handled when you use Citramaria websites, Discord bots, Roblox account linking, mission and activity systems, staff dashboards, or other connected community tools.

3. Information we collect

Depending on the features you use, we may process:

• Discord user ID, username, display name, avatar, guild membership, roles, nickname, and bot-related activity.
• Roblox user ID, username, display name, profile information returned through Roblox sign-in, group memberships, group ranks, and group-management results.
• The link between your Discord and Roblox accounts.
• Brotherhood and division records such as Valor or merit entries, ranks, promotions, demotions, events, patrols, mission submissions, approvals, inactivity notices, onboarding progress, arrests, AoS records, and other records created through the bots.
• Evidence or attachments you choose to submit for missions, patrols, reviews, or other supported workflows.
• Administrative records such as role mappings, channel configuration, permissions, lawbook changes, staff actions, bot-management actions, and audit history.
• Authentication/session information needed to keep you signed in and to protect OAuth and form requests.

4. Information we do not intentionally collect

Our application is designed not to store client IP addresses or user-agent strings in application logs. The supplied reverse-proxy configuration also disables access logging and does not forward client IP headers to the application. Network, DNS, certificate, hosting, or platform providers may still process technical connection information as part of delivering their services.

We do not ask you to provide passwords for Discord or Roblox. Account ownership is verified through the relevant platform's sign-in or approved staff procedures.

5. How we get information

Information may come directly from you, from actions performed by authorised community staff, from Discord, from Roblox, from existing Citramaria records being migrated into the platform, or from automated bot activity such as role and group synchronisation.

6. Why we use information

We use personal information to:

• link and verify accounts;
• provide Discord and website access;
• sync Roblox group ranks and Discord roles;
• operate Brotherhood progression, events, missions, patrols, inactivity and onboarding systems;
• maintain lawbook, moderation, arrest and organisational records where applicable;
• review submissions and respond to support or account issues;
• protect the services, enforce permissions, investigate misuse, and keep audit records;
• maintain historical organisational records where there is an ongoing reason to do so.

7. Lawful bases

Where UK data-protection law applies, the lawful basis depends on the activity. We generally rely on legitimate interests to operate and secure the community, administer membership and permissions, preserve necessary organisational records, and prevent misuse. Where processing is necessary to provide a feature you request under these Terms, we may rely on performance of a contract or steps taken at your request. We may also process information where required by law. If we introduce an optional feature that specifically relies on consent, we will ask separately.

Authorising a Discord or Roblox OAuth screen is a technical authorisation to the platform; it is not automatically the same thing as data-protection consent.

8. Sensitive information

CORE does not ask users to submit special-category information such as health, religion, ethnicity, sexual orientation, or similar sensitive details. Free-text fields and evidence can nevertheless contain information a user chooses to provide. Please avoid including sensitive personal information unless it is genuinely necessary. Where unnecessary sensitive information is identified, administrators may restrict, redact, or remove it.

9. Account linking and synchronisation

When you link accounts, the platform stores the stable Discord and Roblox identifiers needed to recognise you across supported servers and bots. Your current Roblox group memberships and ranks may be checked and used to grant or remove Discord roles, update nicknames, determine access, or create approval requests. A linked account does not give CORE your Discord or Roblox password.

10. Who can see information

Information is available only to users, bots, and staff roles that need it for the relevant feature. Access is controlled per Discord server and by configurable permissions. Some records, such as public mission information, ranks, event results, or published lawbook material, may be intentionally visible to a wider community audience. Evidence, review notes, audit records, and administrative controls are restricted by default.

11. Third-party services

We use or integrate with services such as Discord, Roblox, PostgreSQL/database hosting, domain/DNS providers, certificate providers, and server/hosting infrastructure. Those providers may process data under their own terms and privacy policies. The Scholars Archive may also use the shared Citramaria identity/backend while retaining its existing interface.

12. Cookies and local storage

CORE-operated Citramaria websites use strictly necessary session and security cookies for sign-in, OAuth state, and form protection. These are needed for the requested service to work. We do not currently use advertising or behavioural-tracking cookies. If optional analytics or other non-essential storage technologies are introduced later, this policy and any required consent controls will be updated before they are used.

13. Retention

We keep information only for as long as there is a reasonable operational, security, dispute-resolution, organisational-history, or legal need. Active account links and current membership data are kept while they are needed for synchronisation. Progression, promotion, audit and organisational records may be retained for longer because they provide continuity and accountability. Evidence and free-text material should be reviewed and removed or restricted when it is no longer needed. Where a historical record can be kept without identifying a person, it may be anonymised instead of retaining unnecessary personal information.

14. Security

We use access controls, owner-only service controls, permission checks, audit logging, encrypted secrets, OAuth state protection, CSRF protection, and restricted bot credentials. No system can be guaranteed completely secure. If a security incident affects personal information, we will assess and respond to it in line with applicable requirements.

15. Your rights and requests

Depending on the law and circumstances, you may have rights relating to access, correction, deletion, restriction, objection, or portability of your personal information. These rights are not absolute and may differ depending on the lawful basis and the record involved. You can also ask for an incorrect Discord/Roblox link to be corrected or removed. Some audit or organisational records may need to be retained where there is an ongoing legitimate reason.

Requests can be made through https://citramaria.com/contact.

16. Account unlinking

Unlinking your Roblox account stops that account from being used for future synchronisation. It does not automatically erase historical Valor, rank, mission, event, audit, disciplinary, or other organisational records associated with your Citramaria identity. You may separately request review of retained personal information.

17. International processing

Some connected platforms or hosting providers may process information outside the United Kingdom. Where applicable, those providers are responsible for the safeguards attached to their services, and CORE will use available settings and contractual protections appropriate to the service.

18. Changes

We may update this policy when the services, data practices, or legal requirements change. The current version and update date will be published on this page.

19. Contact

Privacy questions or data requests should be directed to https://citramaria.com/contact.