Privacy notice

Who is responsible

California State Roleplay is responsible for the personal information used by this website. Contact CSRP through General Support in Discord with privacy questions or requests.

Discord sign-in and sessions

Discord sign-in provides your Discord ID, username, display name, and avatar. The website checks your CSRP server membership and roles to provide the correct pages, documents, and purchased benefits. This processing is necessary to provide the service securely and to support CSRP’s legitimate interests in access control, fraud prevention, and community safety.

Your browser holds an essential session cookie. The session lasts up to 30 days and can renew while you use the site, but you must sign in again after 90 days at most. Signing out or an administrator ending a session can close it earlier. The server stores a hash of the cookie identifier and encrypts the session contents, including Discord access and refresh tokens, before database storage. Discord credentials and bot tokens are never sent to your browser. The site does not add analytics or advertising cookies.

Staff documents

Document images include your display name, Discord ID, and a UTC timestamp. These watermarks identify the account that viewed a page and help deter unauthorized sharing. Original PDFs remain on the server. Access does not grant permission to redistribute staff material.

Uploaded documents retain the uploader’s Discord ID and upload and update timestamps until the document is removed.

Signed-in website activity

When you are signed in, CSRP records login and logout times, pages and protected documents opened, page-to-page navigation and approximate time on the previous page. It also records the browser and device user agent, referrer, language, time zone, screen size, viewport size, and pixel ratio associated with the session. The website does not copy IP addresses or Cloudflare country codes into its activity records.

These records help CSRP understand website use, diagnose problems, investigate misuse, and protect accounts and restricted material. They are available only to the designated website owner, are not used for advertising, and are automatically limited to 90 days. The website does not record page-view activity for visitors who are not signed in.

Marketplace purchases

Ko-fi purchases are recorded by Ko-fi and its connected payment provider, while memberships are recorded by Patreon. CSRP may receive the purchaser name, email, message, product and transaction details needed to verify the order and deliver benefits. The website does not receive or store your full card number.

New Ko-fi and Patreon purchases are not automatically connected to your website login. Keep your receipt and open an assistance ticket so staff can verify the payment. Historical Stripe-linked website orders remain in the private purchase ledger for payment administration, refunds, disputes, fraud prevention, tax or accounting obligations, and legal claims.

Transaction records are kept for as long as reasonably needed for those purposes, then deleted or anonymised when no longer required. Robux payments are processed separately through Roblox and verified by staff.

Service providers and transfers

CSRP uses Discord for identity and roles, Ko-fi and Patreon for current payments, Stripe for historical payment records, Supabase for database hosting, Cloudflare for traffic protection and routing, and AWS for application and document hosting. These providers process limited information under their own terms and privacy notices and may process it outside the United Kingdom using the safeguards available to them.

Hosting and security infrastructure may retain request, security, and error logs under the operator’s retention settings. CSRP does not sell personal information.

Your choices and rights

You may ask for access to, correction of, or deletion of your information, object to or restrict some processing, or ask for a portable copy where applicable. Some records may need to be retained for payment, security, or legal reasons. You may also complain to the UK Information Commissioner’s Office if you believe your information has been handled improperly.

Open General Support in Discord to make a request. CSRP may need to verify that the Discord account belongs to you before responding.