Privacy Policy

We collect what is needed to run staff activity tracking for the Creama Roblox group: who you are on Roblox, how long you spend in our game, and the leave requests you file. We do not collect anything about your life outside the group.

We count how many chat messages you send. We never store the contents of your messages.

From Roblox, when you sign in

Signing in uses Roblox's official OAuth with the openid profile scope. Roblox tells us your user ID, username, display name and avatar picture. We separately read your rank and role in the Creama group from Roblox's public group API.

We never receive your Roblox password, email address or payment details.

From the in-game tracker

• Minutes played in the Creama game.
• The number of chat messages you sent — a count only, never the text.
• Session records: start and end time, and which game, place and server you were in.
• Your group rank at the time, so historical records stay accurate after a promotion.

Nothing is recorded in private servers, and nothing is recorded for days covered by an approved leave of absence.

From Discord, only if you link it

Linking Discord is optional and uses the identify scope. We store your Discord user ID and display name so the bot can send you direct messages. We cannot read your Discord messages, servers or friends, and we do not store your Discord email.

What you give us directly

• Leave of absence requests: the dates and the reason you write.
• Your notification preferences.
• Announcements you post, if you are management.

What management records about you

• Private notes on your staff profile, with who wrote them and when.
• Decisions on your leave requests, including any reason given and notes attached.
• Weekly quota results recorded as a snapshot at the end of each week.

Every piece of the above exists to run the staff programme: to show you your own progress, to work out whether weekly playtime requirements were met, to process leave fairly, and to give management an accurate and consistent record instead of guesswork. We do not use your data for advertising, we do not profile you for anything beyond staff activity, and we do not sell it.

• You — your own profile, full activity history, session history and leave history.
• Other staff — your username, avatar, rank, badges, leaderboard position and basic profile.
• Management (staff at or above the management rank) — everything above, plus your full activity and leave history and any private profile notes.
• Whoever maintains the dashboard — technical access to the database in order to operate and fix it.

We do not share your data with anyone outside the Creama staff team, except the service providers in the next section.

• Roblox — authenticates your sign-in and provides your public profile and group rank.
• Supabase — hosts the database where all of the above is stored.
• Our web hosting provider — serves the dashboard and processes requests.
• Discord — receives a direct message addressed to you, but only if you have linked your account and enabled that notification.

Each of those handles data under its own privacy policy.

We use a small number of strictly functional cookies. There are no analytics, advertising or third-party tracking cookies on this site.

• A session cookie that keeps you signed in. It is signed, HTTP-only (JavaScript cannot read it), and expires after 7 days.
• Short-lived cookies used only during the sign-in handshake to protect against request forgery. They are discarded as soon as sign-in finishes.

Your light/dark theme choice is saved in your browser's local storage. It stays on your device and is never sent to us.

Activity records, session history, leave records and management notes are kept for as long as they are useful as a staff record — this is what makes history pages and past quota results work. They are not automatically deleted when you leave the group, because past records remain part of the group's history.

If you want your data removed, ask management. We will remove what we can while keeping any records the group is required to retain for its own administration, and we will tell you what was kept and why.

• Unlink your Discord account at any time from Settings — this stops all Discord messages and deletes the stored link.
• Turn individual Discord notifications on or off from Settings.
• See everything recorded about your activity and leave from your own profile.
• Ask management to correct a record you believe is wrong, or to remove your data.
• Stop activity tracking entirely by leaving the staff team — tracking is tied to holding a staff rank.

Roblox is used by people of all ages, including under-13s. This dashboard is designed so that it never needs personal information beyond what is already public on your Roblox profile plus your activity inside the Creama game. We do not ask for your real name, age, address, phone number, email or photo, and you should never post any of those in a leave reason or anywhere else on the site.

If you are a parent or guardian and want to know what is held about your child, contact management through the group's Discord.

Sign-in is handled by Roblox, so no passwords are stored here. The session cookie is signed and HTTP-only. The database is not reachable from the public internet with the keys used by your browser — all access goes through the server. Management actions are written to an audit log so privileged changes can be traced.

No system is perfectly secure. If you find a security problem with the dashboard, report it to management privately rather than posting it publicly.

This policy may change as the dashboard changes; the date at the top shows the last update. For any question about your data, contact a member of Creama management through the group's Discord server.

Creama is not affiliated with, endorsed by, or sponsored by Roblox Corporation or Discord Inc.