Privacy Policy

What the FRS Portal stores about you, why, and what you can do about it.

Last updated 12 November 2026

Who runs the portal

The portal is run by the owner of the Fort Red Sand Roblox group, M4ksimsz, on a privately run server. It's a hobby project for the group's members, not a business.

What we store

Your Roblox user ID, username, display name and avatar picture.
Your memberships and roles in Fort Red Sand's Roblox groups, and when they changed.
Your group record, such as rank and position history, events, leave, qualifications, awards, evaluations, applications, transfers, discipline and any cases you're part of.
Your course results, including grades and spot reports, and what the Fort Red Sand game reports about your Basic Training, such as stations you've passed or failed and who assessed you.
What you enter yourself, such as applications, reports, comments and signatures.
Your Discord user ID and username if you link Discord, and any tickets you open with our Discord bot.
If you're in one of our Discord servers without linking, your Discord user ID when our bot sends you a one-time reminder to link, so you never get it twice.
Your email address if you add one, which kinds of email you've turned off, and the emails waiting to be sent to you. Senior ranks have to add an address. Sent emails are cleared from the portal after 30 days.
A sign-in session, your browser's user agent, and your two-factor secret and recovery codes if you use them. Session tokens are stored only as a hash and two-factor secrets are encrypted.
Your browser's time zone, such as America/New_York, so times in the portal and in notices, emails and DMs are on your own clock.
A record of actions taken in the portal, in the audit log.
Documents you add to the library: the link, its title and group, and who added it. The files themselves stay in Google Drive, owned by the group's Google account once you hand them over.
If you link a Google account to make documents from templates: its address and Google's ID for it. Nobody else in the portal can see it, and Google gets it only as the editor of documents you make.
Personnel Action Reports: when you're promoted, reduced in rank, appointed, relieved or separated through the portal, a report with your username, Roblox ID, rank and the reason is written to the group's Google account. Only you and leaders who could discipline you can read it.

We don't ask for your real name or your Roblox password. Signing in goes through Roblox, which only shares your account ID and public profile with us. Your IP address is held briefly in memory to limit automated use of the personnel search, and isn't saved.

Why we use it

We use this information to sign you in, show your record, run the group's ranks, units and events, keep the portal secure, and hold people accountable for what they do with it. Where privacy law asks for a legal basis, this is our legitimate interest in running the group and the portal.

We don't sell your information, show adverts, or use analytics or tracking cookies.

Who can see it

Anyone can look up a member's username, avatar, rank and assignments through the public personnel search. Recent promotions and awards appear on the honours page, and the chain of command shows who holds each command's leading roles and how many members each group and rank has.
Other members and leaders see what their role in the group allows.
The Fort Red Sand game can read your Basic Training progress, so that you can carry on where you left off, and your rank, position and unit for your name tag.
Misconduct reporters are hidden from reviewers. Only the group owner can see who made a report.
If you leave a division or unit without a transfer, or leave Fort Red Sand while serving in one, your leaders are told and it may be posted in a staff channel on our Discord servers.
Your email address isn't shown to anyone else in the portal, and it's only used to send you the portal's own emails.
Roblox, Discord and Cloudflare handle data as part of running the portal, under their own privacy policies. Roblox receives rank and role changes, and our Discord bot asks it whether you own an item when a server gives a role for one, which it only answers for inventories set to Everyone. Discord receives messages if you link your account, the email service we send through receives your address and each email sent to you, Google holds the documents in the library, and all visits pass through Cloudflare, which processes your IP address.
Roblox, Discord, Google and Cloudflare are based in the United States, so what they handle may be processed there, under their own safeguards for transfers outside the EU.

Cookies and storage in your browser

The portal only stores what it needs to work, or what you asked it to remember. There are no analytics, advertising or tracking cookies, and nothing from other sites runs in the portal, so there's nothing to agree to. A short note says so once, the first time you visit.

Name	What it's for	How long
__Host-frs_session	Keeps you signed in. It holds a random token, and the portal stores only a hash of it.	Seven days, or until you sign out
__Host-frs_oauth, frs_discord_oauth, frs_google_state	Protects signing in with Roblox and linking Discord or Google, so nobody else can finish it for you.	Ten minutes
frs_theme	Remembers the light or dark theme you chose.	A year, set only when you choose one
frs_announcement_seen	Remembers which announcement banner you closed, so it doesn't come back.	A year, set only when you close one
frs_cookie_notice	Remembers that you closed the note about cookies, so it only shows once.	A year, set only when you close it
frs_tz	Your browser's time zone, so times show on your own clock.	Until you close the browser
Form drafts (session storage)	Keeps what you typed into a form if the portal sends it back, so you don't lose your work.	Used within two minutes of sending, and gone when you close the tab

Cloudflare, which protects the site, may set its own security cookies, such as __cf_bm, to tell people from automated traffic. Avatar pictures load from Roblox's image servers, so your browser asks Roblox for them directly, as it does on Roblox itself.

How long we keep it

Sessions end after seven days. Ninety days after you leave Fort Red Sand, or after your last sign-in if you never joined, we delete your email address, sign-ins, two-step setup and Discord and Google links. Your group record, such as ranks, awards, training and discipline, stays because it's the group's history, unless you ask for it to be deleted and nothing requires keeping it. A Discord user ID kept for a link reminder is deleted when you link, or after 90 days. Audit entries can't be changed or removed. Database backups are kept on the same server until newer ones replace them.

Your choices

You can change or remove your email address and choose which emails you get on your account's Email page, and every email has a link to stop that kind. Emails about your account itself, such as confirming a new address, always go out. You have the right to see what we hold about you and take a copy, to have it corrected, to ask for it to be deleted, to object to how we use it, and to complain to your data protection authority. We answer requests within a month. We may keep audit entries and disciplinary or case records where they're needed for security or to protect others, and we'll tell you when that's the reason.

Signed in, open Your data under Account to download a copy of your data at any time, or to ask for a correction or deletion. You can also message the group owner through the Fort Red Sand group on Roblox, which works without an account.

Children

Roblox has many young players. The portal doesn't ask for your age and collects no more from younger members than from anyone else. If you're a parent or guardian and want a child's information removed, contact the group owner as above.

Changes

We'll update this page if any of this changes, and the date at the top shows the latest version.