Privacy Policy

Scope

This policy covers the Roosevelt High School student information portal, its connected Roblox campus, and its Discord bot. It covers information handled when you sign in, attend school, carry out staff duties, link Roblox and Discord identities, or receive school notices.

Roblox, Discord, Bloxlink, and the school's hosting and data service providers operate their own services under their own privacy policies. We do not control how those companies process information in their systems.

Information we handle

Roblox identity and membership

We may receive or look up your Roblox user ID, username, display name, avatar, public profile, group membership, group role, and rank. Roblox user ID is the stable account identifier. A separate random six-digit student ID is used inside the SIS.

Website sign-in

Website sign-in requests only the Roblox openid and profile permissions. The resulting access token is used to read your Roblox identity and is not saved by the portal. The portal saves a one-way hash of a random session token, your Roblox user ID, display name, and session expiration time. A normal session lasts eight hours. “Keep me signed in” lasts up to 30 days.

Discord and Bloxlink

The bot may handle your Discord user ID and tag, whether you are in the Roosevelt Discord server, your Bloxlink-confirmed Roblox user ID, verification time, notification choices, and nickname-sync status. It also records delivery status, Discord message identifiers, and errors for notices it sends. The bot does not request Discord’s Message Content intent and does not read ordinary server messages.

School records

Depending on your role, the SIS may contain student and staff names and titles, enrollment and guardian links, classes, attendance, grades, assignments and submissions, schedules, groups, announcements, messages, fees, forms, discipline records, administrative actions, settings, and audit history. Authorized users may add or correct these records through the website or Roblox experience.

Technical information

Our hosting and security providers may process IP addresses, browser and device details, request times, and error or security logs when you use the website. The website uses necessary cookies for sign-in, security, view selection, and guardian access.

How we use information

• Authenticate users and apply role-based access.
• Maintain enrollment, classes, schedules, attendance, coursework, groups, and school records.
• Match Discord members to Roblox accounts through Bloxlink and keep rosters current with the configured Roblox group.
• Send requested or role-relevant Discord notices, including school, classroom, group, attendance, and discipline notices.
• Detect errors, prevent misuse, enforce permissions, recover records, and maintain an audit history of important changes.
• Operate, troubleshoot, and improve the service.

When information is shared

We share information only as needed to operate school services. Our hosting and data service providers maintain the portal and its records. Roblox provides identity and group information, Discord delivers bot messages, and Bloxlink confirms Roblox-to-Discord links. Each provider receives the information needed for its part of the service.

SIS records are visible to users whose assigned role and relationship permit access. For example, students can see their own records, guardians can see approved linked students, teachers can see their classes, and administrators can access records needed for school operations. Administrative impersonation is logged.

We may disclose information to comply with law, respond to a valid legal request, protect users or the service, or investigate abuse. We do not sell personal information, use it for targeted advertising, or use it to train advertising or generative AI models.

Discord notices and choices

The bot sends direct messages only for the SIS functions described in this policy. Attendance notices can be enabled or disabled with the bot’s /notifications command. Discipline and urgent school notices may remain enabled while an account is linked because they support school operations.

You can stop future bot direct messages by leaving the Roosevelt Discord server, unlinking the applicable identity, or asking a System Administrator to remove the Discord link. Discord may still retain messages in your account under Discord’s own policies.

Retention and archiving

Website sessions expire after eight hours or, when selected, 30 days. Signing out revokes the active session. Verification links and bot delivery records are kept while needed for identity matching, delivery, abuse prevention, and troubleshooting.

SIS records are usually archived instead of overwritten so authorized administrators can recover changes and review audit history. Leaving the Roblox group withdraws an active enrollment or employment record and removes the person from current rosters, but the archived school record can be used again if the person returns. We do not currently promise a fixed deletion date for archived SIS records.

When a verified deletion request applies to Discord API data, we will delete or de-identify that data unless limited retention is reasonably necessary for security, an active dispute, or a legal obligation. Retained data is limited to that purpose and is not used for ordinary service features.

Security

We use HTTPS, restricted server-side credentials, hashed website session tokens, role-based access, database access controls, audit records, and request limits. Sensitive credentials are not sent to Roblox clients or web browsers.

No system can guarantee perfect security. Report a suspected account compromise, mistaken disclosure, or security issue promptly to a Roosevelt System Administrator.

Access, correction, unlinking, and deletion

You may ask to see, correct, unlink, or delete information associated with your account. Contact a Roosevelt System Administrator in the official Discord server or email jcollins@rhs.esd.org. Include your Roblox username and describe the request. Never send a password, OAuth code, bot token, or API key.

We may ask you to verify control of the relevant Roblox or Discord account. Some SIS record corrections require administrator review. We will explain if a record cannot be deleted immediately because a limited copy is needed for security, audit integrity, or an active dispute.

Account eligibility and confidential information

The Discord bot is not directed to children under 13. Discord users must meet Discord’s minimum age. Roblox requires a 13+ account to authorize an OAuth application, so users who cannot authorize Roblox OAuth cannot use website sign-in. Use of the Roblox experience is also subject to Roblox’s age and parental-control requirements.

Use only the information assigned or approved for your school profile in student, guardian, medical, support, and billing records. Personal account passwords, government identification numbers, payment card details, and unrelated private information must not be entered into the SIS. Access to confidential school records is limited to authorized personnel.

Changes and contact

We may update this policy when the service or its data practices change. The effective date at the top identifies the current version. Material changes will be announced through the portal or official Discord server when practical.

Questions and privacy requests may be sent to a Roosevelt System Administrator in the official Discord server or to jcollins@rhs.esd.org.

Third-party policies: Roblox Privacy Policy, Discord Privacy Policy, and Bloxlink Privacy Policy.