Privacy Policy
Effective October 26, 2026
This policy explains what the Noyra x ConfussIed Activity Planner for the State of Firestone ("NCAPSF", "the Planner") collects, why, and how long it keeps it. The Planner is operated by Noyra for the State of Firestone Roblox community. It is not made, endorsed or run by Roblox Corporation.
The short version
- You can view the schedule and heatmap without signing in. Nothing about you is stored when you do.
- If you sign in, we store only your public Roblox identity and the SSUs you sign up for.
- SSUs and every sign-up attached to them are automatically deleted 7 days after the SSU ends.
- We never ask for your Roblox password, and we don't sell, rent or share your data for advertising.
What we collect
When you sign in with Roblox
Sign-in uses Roblox's official OAuth 2.0 / OpenID Connect system. You approve access on Roblox's own site, and we request only the openid and profile scopes. From that we receive your Robloxuser ID, username, display name and avatar image link.
Group roles
To decide what you can do (player, Community Management or Platform Administrator) and which departments you belong to, we check your role in the Roblox groups the Planner is configured to use. This uses Roblox's Open Cloud and public groups APIs. We only look at groups the Planner is configured for.
Activity on the Planner
- SSU sign-ups: your user ID, username, the SSU, and the department you chose (if any).
- SSUs you create or edit (Community Management and admins): your username is recorded as the creator or last editor, and you may be listed as host.
- Access lists (admins only): administrators may list Roblox usernames or user IDs as Platform Administrators or Restricted Users.
Technical data
The Planner runs on Cloudflare. Like any website, requests pass through Cloudflare's network, which may process your IP address and browser details to deliver the site and protect it from abuse. Our application logs record errors and may briefly include request details.
Cookies
We use one essential cookie, ncap_fs_session. It holds a random session ID, is HTTP-only (scripts on the page can't read it), and keeps you signed in. It's only set when you sign in or start signing in. There are no advertising or analytics cookies.
How long we keep it
| Data | Kept for |
|---|---|
| SSUs, their department slots, and all sign-ups (including cancelled SSUs) | Deleted automatically 7 days after the SSU ends |
| Withdrawn sign-ups | Deleted immediately when you withdraw |
| Your session (identity and cached role check) | Up to 7 days, or until you sign out |
| Cached Roblox group-role lookups | Up to about 25 hours |
| Administrator and restricted-user lists | Until an administrator removes the entry |
| Departments and settings (no personal data) | Until changed by an administrator |
How we use it
- To sign you in and keep you signed in.
- To enforce roles and restrictions (who can schedule SSUs or manage the Planner).
- To show attendance: your username and department appear on the SSU page, and sign-up counts feed the public heatmap.
Visible to everyone: sign-ups (username and department) are shown publicly on each SSU page, as are SSU hosts and creators.
Who we share it with
We don't sell or share personal data with third parties for their own purposes. It is processed only by the services the Planner runs on: Roblox (sign-in and group-role checks) andCloudflare (hosting, database and storage). We may disclose information if Roblox's rules or the law require it.
Your choices
- Withdraw from any SSU at any time. Your sign-up is deleted right away.
- Sign out at any time. Your session is deleted.
- Email legal@noyralabs.com to see or delete data about you before it's deleted automatically. You can also revoke the Planner's access in your Roblox account settings under authorized apps.
Children
Roblox is used by people of all ages. The Planner collects only the minimum public profile data Roblox provides through its sign-in system, and nothing beyond what's described here. Use of Roblox, including its sign-in, is also subject to Roblox's own Terms of Use and Privacy Policy.
Security
Sessions use HTTP-only cookies, every change is protected against cross-site request forgery, and permissions are checked on the server for every action. No system is perfectly secure, but we keep the data we hold small and short-lived.
Changes
If we update this policy, we'll change the effective date above. Significant changes will be announced in the community.
Contact
Questions or requests: email legal@noyralabs.com.