Privacy policy

Who runs this site

psbaf.xyz is a community activity tracker for a British Armed Forces roleplay group. It is not the UK Ministry of Defence, the British Army, or any other official government service. The people who administer the site are the data controllers for the information described here.

Secure connection

The live site is served only over HTTPS. Pages, sign-in, and activity requests are encrypted in transit with a TLS certificate. Do not use the site over a plain http address. A session cookie set on the live site is marked Secure, so the browser sends it only on HTTPS.

Accounts

An administrator grants access by Roblox username. We store that username, the role, and the Roblox user id once they sign in. We do not store a site password. Once a day, the list of granted usernames and roles is sent to a private Discord channel.

Sign-in

Signing in uses Roblox. It sets a cookie named baf_session. It lasts 30 days, is limited to this site, and is not readable by page scripts. The cookie remembers the Roblox username and role. Sign-in is sent to a private Discord channel with the account name, role, Roblox id, and IP address. A Roblox account that has not been granted access is turned away.

Visits

A visit to a page is recorded in a private Discord channel. A record can include:

• The page opened
• Whether the visitor is a guest, or the signed-in username and role
• IP address
• Browser and whether the device is a phone or a computer
• Screen size, processor count, and approximate memory, as reported by the browser
• Language, timezone, and the page the visitor came from
• Country, when the host provides it

The same visitor on the same page is not recorded again for about a minute. We do not use advertising cookies or sell this information.

Activity and commands

Public activity figures, including Roblox usernames and time played, are loaded from the Polaris activity service. Staff commands that change that data are sent to a private Discord channel with the account name, role, command, result, and IP address.

How long it is kept

Accounts and sessions stay until an administrator removes them or the session expires. Discord messages stay in those private channels until an administrator deletes them. Server logs kept by the host may exist for a shorter period under the host’s own retention.

Who receives it

Site administrators receive account, visit, sign-in, and command records through private Discord channels. The host that serves the site processes connection data needed to deliver HTTPS. The Polaris activity service processes the activity lookups and commands. We do not sell personal information.

Your choices

You can stop using the site and sign out, which clears the session cookie in that browser. Ask a site administrator to remove an account. You can also ask what is held for your username. Some visit records are tied to an IP address rather than a name, so we may not be able to find every guest visit.