This Privacy Policy explains what information is collected when you use the OCS Candidate Portal or interact with the OCS Command Center as a member of staff, why it is collected, who can access it within our community, how long it is kept, and what rights you have over it.
This Service is developed and maintained independently by a single developer as a project for the Roblox Infantry Corps (RIC) community. It is not operated by a registered company, and there is no formally appointed Data Protection Officer in the strict legal sense of the term. Throughout this document, "we," "us," and "the Operator" refer to the developer and the OCS staff members who operate the Service, acting collectively as the party responsible for the data described below.
This Policy is written to be accurate and specific to how the Service actually works, rather than to use generic legal language that does not reflect real practice. If any part of this Policy becomes inaccurate because the Service changes, we are committed to updating it.
This document does not constitute legal advice, and its existence does not by itself guarantee compliance with any particular law. It is our good-faith effort to be transparent and to handle your data responsibly.
The OCS Candidate Portal is used by members of the Roblox Infantry Corps (RIC) community who hold a minimum in-group rank (Warrant Officer or above) and have received a valid, single-use access code from OCS staff, in order to complete an official written evaluation as part of the officer candidacy process.
The OCS Command Center is an internal administration tool used exclusively by authorized RIC staff to create tests, review and grade candidate submissions, manage the question bank, log community events, and maintain officer conduct records.
This Service is intended for use within the context of the Roblox and Discord platforms and assumes that anyone accessing it is already a member of the associated Discord server and Roblox group.
We only collect information that is necessary to operate the candidate evaluation process, verify identity, maintain the integrity of the examination, and support the administrative functions of the RIC officer program. We describe each category below in plain terms.
We do not collect, see, or store your Roblox or Discord password at any point. Authentication is handled entirely by Roblox's and Discord's own systems; we only receive a token confirming your identity.
To protect the fairness and integrity of the evaluation process, the Portal records certain behavioral signals while you are actively taking your exam:
We want to be direct about this category: this telemetry is linked to your identity (your Discord and Roblox account) in our database for the duration the record is retained. We do not claim it is anonymous, and we do not attempt to argue that it falls outside the scope of personal data. It is collected for one narrow purpose only — detecting the use of unauthorized external assistance (such as another person or an AI tool answering on your behalf) during a timed, proctored examination — and it is not used for any other purpose, such as profiling you outside the context of the exam.
When authorized staff interact with the Command Center, certain actions are automatically logged for accountability and audit purposes, including:
These logs are sent to a private, internal Discord channel accessible only to OCS leadership, and are used solely to maintain accountability over who accessed or modified sensitive records.
Rather than describing access in vague terms, we want to be specific about which roles within our community can see what, based on how the system is actually configured.
| Role | What they can access |
|---|---|
| Academy Head (High Command) | Full administrative access: all candidate exam dossiers, all access codes, the full question bank, portal-wide settings, and the ability to permanently delete records. |
| Senior Instructor | Access to generate new tests and to review, score, and grade candidate exam submissions. No access to portal-wide settings or the ability to delete records. |
| Instructor | Access limited to the Officer Registry only — viewing and adding conduct notes about officers. No access to candidate exam data. |
| Event Logger | Access limited to submitting and viewing event/operation logs. No access to candidate exam data or the Officer Registry beyond what is needed to log an event. |
| Developer | Full technical access to the underlying infrastructure (database and hosting), as required for maintenance, debugging, and security. |
No other role or individual has access to candidate or personnel data. If a role is introduced in the future with data access, this Policy will be updated to reflect it before that role is granted access.
We do not sell, rent, or share your data with advertisers, and we do not use it for any purpose outside the operation of the RIC officer candidacy and personnel process.
We rely on the following grounds to process your information:
We do not use your data for marketing, advertising, or any purpose unrelated to the RIC officer candidacy and personnel processes described in this Policy.
We take the following measures to protect your data:
We do not hardcode or expose end-user passwords anywhere in our systems, because we never receive them in the first place.
We want to be transparent about the limits of these protections: like any small, independently operated project, our security relies substantially on correctly configured backend access rules and careful operational practice, rather than on a dedicated security team. We continuously work to identify and close gaps, but we cannot guarantee absolute security, and no online service can.
If you believe you have discovered a security vulnerability in this Service, please report it to us privately using the contact information in Section 11 rather than disclosing it publicly, so we can address it responsibly.
Your data is processed using the following third-party infrastructure providers, acting as our data processors:
These providers may process data on servers located outside of your home country, including in the United States. Where applicable, these providers maintain their own data protection safeguards (such as the EU-U.S. Data Privacy Framework or standard contractual clauses) as part of their standard infrastructure agreements. We rely on these providers' own compliance programs and do not independently audit their infrastructure.
We aim to keep data only as long as necessary for the purpose it was collected for. Where possible, retention is enforced automatically by our database rather than relying on manual cleanup:
You may request deletion of your data at any time, as described in Section 8, regardless of these default retention periods.
Regardless of where you are located, we extend the following rights to anyone whose data we hold, in the spirit of data protection frameworks such as the GDPR:
How we actually handle a deletion request, in practice: deletion requests are reviewed and processed by the Academy Head using a dedicated erasure tool built into the Command Center, which locates and permanently deletes the relevant records tied to your account (exam submissions, access codes, live session logs, event records, and officer notes) across our database in a single action. Requests are typically processed within 14 days, though most can be completed much sooner.
This Service is not directed at, and is not intended to be used by, children under the age of 13.
We want to describe our approach to this honestly rather than overstate it:
If we obtain actual knowledge, or have a reasonable basis to believe, that a candidate is under the age of 13, we will immediately and permanently delete all data associated with that individual, including identity data, telemetry, and exam records, and revoke their access.
If you are a parent or guardian and believe your child under 13 has used this Service, please contact us using the information in Section 11 so we can investigate and delete the relevant data promptly.
We do not claim full compliance with COPPA or any equivalent regulation solely on the basis of the measures above. These represent our good-faith, reasonable efforts as a community-run project, not a legal guarantee.
We may update this Privacy Policy from time to time as the Service evolves — for example, if we add new features, change our infrastructure providers, or adjust our data retention practices. When we make a material change, we will announce it in the official RIC Discord server. The "Last updated" date at the top of this document will always reflect the most recent revision.
Continuing to use the Service after a material change has been announced constitutes acknowledgment of the updated Policy. If you disagree with a change, you may stop using the Service and request deletion of your data as described in Section 8.
If you have any questions about this Privacy Policy, or wish to exercise any of the rights described in Section 8 (access, correction, deletion, or objection), please reach out through one of the following channels:
We will make a reasonable effort to respond to all legitimate requests in a timely manner.
This Privacy Policy was last reviewed in July 2026. It applies specifically to the OCS Candidate Portal and OCS Command Center operated by the Roblox Infantry Corps community, and does not apply to Roblox, Discord, or any other third-party platform, which maintain their own separate privacy policies.