Privacy Policy
Last updated: July 25, 2026
Staffly ("we", "us") provides staff-management tools for Discord and Roblox communities. This policy explains what data we collect, why, and the controls you have over it — including under the GDPR, UK GDPR, CCPA/CPRA, PIPEDA, LGPD, and other applicable privacy laws.
What we collect
- Account data: the username and password you sign up with (passwords are hashed and never stored in plain text).
- Linked account data: if you connect Discord and/or Roblox, we store the public profile info those platforms share with us (user ID, username, avatar) — never your password on those platforms.
- Community data: the communities you create or join, your role, shift history, and any moderation actions or applications you submit or review.
- Technical data: basic request logs (IP address, browser type) kept for security and abuse prevention.
How we use it
We use your data to operate the dashboard, tie actions to the right account, show your community's activity, and keep the service secure. We do not sell your data, and we do not use it for advertising.
Legal basis for processing
Where GDPR/UK GDPR applies, we rely on: performance of a contract (running the service you signed up for), legitimate interests (security, abuse prevention), and consent (optional analytics cookies — see our Cookie Policy).
Sharing
We share data with Discord and Roblox only as needed to complete the account-linking you initiate. We use Firebase (Google) for data storage and Vercel for hosting — both process data on our behalf under their own data processing terms. We do not share data with advertisers or data brokers.
Your rights and choices
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can:
- Export your data any time from Settings → Your data.
- Delete your account any time from Settings → Danger zone. Note: activity you're referenced in in a community's moderation or activity log may remain as historical record after your account is deleted, since that log belongs to the community, not to you individually.
- Manage cookie preferences any time via the link in our footer.
To exercise any right not covered by the tools above, contact us at the address below — we'll respond within the timeframe required by applicable law (typically 30 days).
Data retention
We keep account data for as long as your account is active. Community logs (shifts, moderation actions, applications) are retained by the community they belong to until a community Owner removes them or the community is deleted.
Children's privacy
Staffly is not directed at children under 13, and we don't knowingly collect personal data from anyone under that age. If you believe a child has provided us data, contact us and we'll remove it.
International data transfers
Our infrastructure providers (Google Firebase, Vercel) may process data in countries other than your own. Where required, we rely on standard contractual clauses or equivalent safeguards for these transfers.
Contact us
Questions or requests about this policy: privacy@staffly.app.
We may update this policy from time to time; material changes will be reflected in the "Last updated" date above.