Privacy Policy

Introduction

This Privacy Policy explains what information is collected when you use the OCS Candidate Portal, the Officer Hub, or interact with the OCS Command Center as a member of staff, why it is collected, who can access it within our community, how long it is kept, and what rights you have over it.

This Service is developed and maintained independently by a single developer as a project for the Roblox Infantry Corps (RIC) community. It is not operated by a registered company, and there is no formally appointed Data Protection Officer in the strict legal sense of the term. Throughout this document, "we," "us," and "the Operator" refer to the developer and the OCS staff members who operate the Service, acting collectively as the party responsible for the data described below.

This Policy is written to be accurate and specific to how the Service actually works, rather than to use generic legal language that does not reflect real practice. If any part of this Policy becomes inaccurate because the Service changes, we are committed to updating it.

This document does not constitute legal advice, and its existence does not by itself guarantee compliance with any particular law. It is our good-faith effort to be transparent and to handle your data responsibly.

1. Who This Service Is For

The OCS Candidate Portal is used by members of the Roblox Infantry Corps (RIC) community who hold a minimum in-group rank (Warrant Officer or above) and have received a valid, single-use access code from OCS staff, in order to complete an official written evaluation as part of the officer candidacy process.

The OCS Command Center and Officer Hub are internal administration and career progression tools used by authorized RIC officers and staff to create tests, review and grade candidate submissions, submit rank-up projects, log community events, and maintain officer conduct records.

This Service is intended for use within the context of the Roblox and Discord platforms and assumes that anyone accessing it is already a member of the associated Discord server and Roblox group.

2. Information We Collect

We only collect information that is necessary to operate the candidate evaluation process, verify identity, maintain the integrity of the examination, and support the administrative functions of the RIC officer program. We describe each category below in plain terms.

2.1 Identity and Authentication Data

• Roblox User ID and Roblox Username, obtained through Roblox's official OAuth authentication flow.
• Discord Username, obtained through Discord's official OAuth authentication flow.

We do not collect, see, or store your Roblox or Discord password at any point. Authentication is handled entirely by Roblox's and Discord's own systems; we only receive a token confirming your identity.

2.2 Examination, Project, and Evaluation Data

• The written answers you submit during your examination.
• System-generated timestamps marking when you started, paused, and completed sections of the exam.
• The final score, pass/fail result, and any written remarks entered by the evaluator who reviewed your submission.
• The specific set of questions assigned to your test (drawn from our question bank).
• Rank-up projects, external document links, and Leave of Absence (LOA) notices submitted by commissioned officers.

2.3 Anti-Cheat Behavioral Telemetry

To protect the fairness and integrity of the evaluation process, the Portal records certain behavioral signals while you are actively taking your exam:

• Typing speed, expressed as words per minute (WPM), calculated per question.
• The timing intervals between individual keystrokes.
• The number and duration of pauses while typing.
• The number of times you switch away from the exam tab or window.
• Whether and how often you exit fullscreen mode during the exam.
• Attempts to copy, paste, cut, right-click, print, or open browser developer tools during the exam.

We want to be direct about this category: this telemetry is linked to your identity (your Discord and Roblox account) in our database for the duration the record is retained. We do not claim it is anonymous, and we do not attempt to argue that it falls outside the scope of personal data. It is collected for one narrow purpose only — detecting the use of unauthorized external assistance (such as another person or an AI tool answering on your behalf) during a timed, proctored examination — and it is not used for any other purpose, such as profiling you outside the context of the exam.

2.4 Administrative Activity Logs

When authorized staff interact with the Command Center, certain actions are automatically logged for accountability and audit purposes, including:

• Which staff member accessed a given candidate's dossier or officer record.
• Navigation between sections of the Command Center.
• Actions such as generating a test, evaluating a submission, grading a rank-up project, adding an officer conduct note, or modifying the question bank.

These logs are sent to a private, internal Discord channel accessible only to OCS leadership, and are used solely to maintain accountability over who accessed or modified sensitive records.

2.5 Event and Officer Conduct Records

• Notes describing your participation in community events, trainings, or practical exams, entered manually by staff or officers.
• Entries in the Officer Registry — observations, warnings, or incident reports — entered manually by an Instructor or Senior Instructor as part of routine personnel management.
• Any image submitted as visual proof of an event or project (e.g., a screenshot), which is uploaded to a linked Google Drive folder.

3. Who Can Access Your Data

Rather than describing access in vague terms, we want to be specific about which roles within our community can see what, based on how the system is actually configured.

No other role or individual has access to candidate or personnel data. We do not sell, rent, or share your data with advertisers, and we do not use it for any purpose outside the operation of the RIC officer candidacy and personnel process.

4. Why We Process Your Data

• Consent — before starting your examination, you are asked to confirm that you have read and agree to this Privacy Policy and the applicable Terms of Service.
• Legitimate operational necessity — processing your identity, project, and exam data is required to deliver the evaluation and progression service you are requesting access to.
• Legitimate interest in program integrity — our community has a reasonable interest in ensuring the fairness, security, and credibility of its officer selection process, which is the basis for collecting anti-cheat telemetry.

5. Data Security

• All data in transit is encrypted using TLS/SSL.
• All data at rest is stored using our infrastructure provider's standard encryption (Google Cloud Firestore).
• Access to administrative functions is restricted based on role, as described in Section 3.

We do not hardcode or expose end-user passwords anywhere in our systems, because we never receive them in the first place.

6. Where Your Data Is Stored and Processed

• Google Firebase / Cloud Firestore — primary database for identity, exam, project, and administrative data.
• Vercel and/or Firebase Hosting — hosting for the Candidate Portal, Officer Hub, and Command Center web applications.
• Google Apps Script and Google Drive — used to receive and store image files submitted as event or project proof.
• Discord — used for authentication and to receive internal administrative audit logs.

7. How Long We Keep Your Data

• Live activity logs (used only during an active exam session) are automatically deleted 7 days after creation.
• Access code records are automatically deleted 90 days after issuance.
• Completed exam dossiers, including your answers, score, and behavioral telemetry, are retained as part of our recruitment history for 12 months from the date of submission, after which the record is automatically deleted.
• Officer Registry and Project entries are reviewed periodically by staff and removed when no longer relevant to an individual's active status in the community, or sooner upon a valid deletion request under Section 8.

8. Your Rights (GDPR)

Regardless of where you are located, we extend the following rights to anyone whose data we hold, in the spirit of data protection frameworks such as the GDPR:

• Right of access — you may request a copy of the data we hold about you.
• Right to rectification — you may request that we correct inaccurate information.
• Right to erasure ("right to be forgotten") — you may request that we permanently delete your identity data, exam answers, telemetry, and any associated records.
• Right to restrict processing & object — you may object to processing based on our legitimate interest grounds.

How we handle a deletion request in practice: deletion requests are processed using a dedicated global erasure tool built into the Command Center, which locates and permanently deletes the relevant records tied to your account across all database collections in a single action within 14 days.

9. Children's Privacy

This Service is not directed at, and is not intended to be used by, children under the age of 13. If we obtain actual knowledge that a candidate is under the age of 13, we will immediately and permanently delete all data associated with that individual and revoke their access.

10. Changes to This Policy & Contact Us

If you have any questions about this Privacy Policy, or wish to exercise any of the rights described in Section 8, please reach out through one of the following channels:

• Discord: turca2807
• Email: robloxinfantrycorpsocs@gmail.com