Star Cap Bot links your Discord account to your Roblox account so league staff can confirm that the player in a match is who they say they are. It also tracks team rosters against the league's star limits. It stores two ID numbers, a username, and the league records staff create about you.
What we collect
From linking your Roblox account
| Data | Source | Why |
|---|---|---|
| Discord user ID | Discord | Identifies the account being linked |
| Roblox user ID | Roblox OAuth (sub) | The linked account |
| Roblox username | Roblox OAuth (preferred_username) | Shown to staff so they can identify players |
| Link timestamp | Generated | Audit trail |
League records created by staff
| Data | Source | Why |
|---|---|---|
| Player star rating, 1 to 5 | Assigned by league staff | Roster balance |
| Rating change history | Generated | Old value, new value, which staff member changed it, and when |
| Team role registrations | Discord | The ID, name, and color of roles registered as teams |
| Staff permission list | Set by the league owner | Who may edit ratings |
Star ratings, rating history, and team data are league competition records. They are created by staff inside Discord and are not obtained from Roblox.
What we never collect
- No Roblox password or credentials. You sign in on Roblox's own site. The bot never sees what you type there.
- No email address, from either platform.
- No Discord message content. The bot does not have the Message Content intent, so it cannot read your messages.
- No payment information. The service is free.
- No advertising or analytics trackers. There are none on this site or in the bot.
- Nothing else from Roblox. No friends list, no inventory, no game history, no anything beyond your user ID and username.
How the Roblox connection works
Linking uses Roblox OAuth 2.0. You approve it yourself on Roblox's site, and you can decline at any point.
- Scopes requested:
openidandprofile. Nothing more. These return only your Roblox user ID and username. - Authorization codes are protected with PKCE using the S256 method.
- Access tokens are never stored. The token is exchanged, used once to read your user ID and username, then discarded. It is never written to the database or to a log.
- No refresh token is requested, so the bot cannot reach your Roblox account later. The authorization is a single read at the moment you link.
- A single-use state token, valid for 10 minutes, ties each authorization to the Discord user who started it. It is held in memory only. This is what stops someone linking an account they don't control.
- One Roblox account can be linked to one Discord account, enforced by a uniqueness constraint in the database.
How we use it
Only to run the league:
- Confirming a player's Roblox identity
- Granting a verified role in the Discord server
- Counting team rosters and summed star ratings against league limits
- Alerting league staff when a team goes over a roster or star limit
- Messaging a player, along with their team's Athletic Director and Head Coach, when an unverified player is added to a team
It is not used for advertising, profiling, automated decisions with legal effect, or anything outside the league.
Where it's stored, and who else touches it
- Database: Supabase (PostgreSQL), hosted on AWS in US East (us-east-1)
- Application: a Google Cloud virtual machine in the United States
- Transport: all traffic travels over HTTPS/TLS
- Web server logs: standard for any website — IP address, timestamp, and requested URL — kept briefly for security and troubleshooting
If you are in the EU or UK, note that your data is transferred to and processed in the United States.
Your data is never sold, rented, or licensed. It goes to no advertisers and no data brokers. The only companies that handle it do so to run the service: Supabase for the database, Google Cloud for the application, and Discord and Roblox as the platforms themselves. We would disclose data otherwise only where the law requires it.
How long we keep it, and deleting it
Your Discord-to-Roblox link is kept until it's removed. You can remove it yourself at any time with /unverify in Discord, which deletes the record outright. League staff can also remove a link if you ask them to.
Star ratings and rating change history are league competition records and are kept while the league operates.
For anything else — a full deletion request, or a copy of what's held about you — email rahyulty@gmail.com.
Your choices
- Linking is voluntary. Nothing is stored unless you complete Roblox's authorization screen yourself.
- See what's stored about you with
/viewstarplayer. - Delete your link with
/unverify. - Request full deletion or a copy of your data at rahyulty@gmail.com.
Age
Discord and Roblox both require account holders to be at least 13, and older in some countries. This service is not directed at children under 13 and does not knowingly collect their data. If you believe a child under 13 has linked an account, email us and we'll remove the record.
Changes, and getting in touch
If what we collect or why ever changes, this page changes with it and the date below updates. Material changes are announced in the Discord server before they take effect.
Questions about any of this: rahyulty@gmail.com.