Privacy Policy

1. Who we are

AwareCAD is a web-based Computer-Aided Dispatch and Mobile Data Terminal (CAD/MDT) tool for roleplay communities that play Emergency Response: Liberty County ("ER:LC") on Roblox. AwareCAD is a product of Meridian Operations LLC, an independent third-party developer. Neither Meridian Operations LLC nor the AwareCAD service is affiliated with, endorsed by, or sponsored by Roblox Corporation, Police Roleplay Community, or the publishers of any game we integrate with.

The Service is provided and operated by Meridian Operations LLC (contact details in Section 17). We have no employees beyond the LLC's member(s) and no contractors. The third-party infrastructure providers we rely on are listed in Section 6. Those providers may in turn rely on their own sub-processors (for example, our database provider runs on Amazon Web Services); we rely on each provider's published sub-processor list and contractual safeguards rather than enumerating them here.

2. Information we collect

We collect only what we need to operate the Service. Specifically:

2.1 Account data (you provide directly)

• Email address — required for every account. Used for authentication (sign-in links and one-time codes), account recovery, and occasional service-critical notifications. AwareCAD does not use password-based sign-in; authentication is via single-sign-on or email magic links.
• Discord identity — if you sign in with Discord, Discord shows you a permissions screen and asks three things on our behalf: your username, your email address, and which roles you have on each Discord server you share with the AwareCAD application. The role list is what lets your community admins automatically grant you the right level of access (officer, dispatcher, etc.) based on your Discord role. We never see your Discord password, your full server list, your direct messages, or anything else from your Discord account.
• Display name — a free-text name you optionally enter during onboarding, visible to your community.

2.2 Roblox identity data (if you link Roblox)

If you choose to link a Roblox account via Roblox OAuth, we receive and store:

• Roblox user ID (a numeric identifier, public on Roblox).
• Roblox username (your @ handle, public on Roblox).
• Roblox display name (the cosmetic name on your Roblox profile, public on Roblox).

We do not receive your Roblox email address, age, payment information, friends list, private messages, or anything else that isn't already visible on your public Roblox profile. The Roblox sign-in screen tells you exactly what we're asking for before you approve it.

The temporary access pass Roblox gives us during sign-in is used once to read your ID and username, then immediately thrown away. When AwareCAD later needs your avatar picture or checks your group memberships, it uses the same public information that anyone visiting your Roblox profile would see — no special access required.

2.3 Community and roleplay data (you create)

• Civilian character records (a Roblox username or, in some communities, a roleplay name and basic biographical detail).
• Vehicle registrations (license plate, make, model, color).
• Citations, warrants, BOLOs, arrest reports, incident reports, field notes, and call logs that you or your community's officers create as part of roleplay.
• Notes you add to your civilian profile that are visible to officers in your community.

This is roleplay data, not real police data. AwareCAD is intended for use in fictional gameplay contexts only. Do not enter real personal data, real criminal records, or real incident information into AwareCAD.

2.4 Technical data (collected automatically)

• Sign-in cookies — when you sign in, your browser receives small cookies that prove to AwareCAD you are logged in. These are required for the Service to work and are not shared with anyone else.
• Last-community cookie — a cookie that remembers which of your communities you last used, so you don't have to pick again on every visit.
• Server logs — Cloudflare (which serves the Service) keeps short-term logs of basic request information (IP address, the URL you visited, your browser, the response code, how long the request took). These are used to diagnose problems and prevent abuse. We don't use them for marketing or analytics.

2.5 Payment data (when paid tiers are active)

Paid subscription tiers, when enabled, are processed by Stripe. Card numbers and other payment-instrument data are submitted by you directly to Stripe through a Stripe-hosted page; AwareCAD never sees, stores, or transmits your card data. After checkout, Stripe shares a customer ID, subscription identifier, plan identifier, subscription status, and current-period end date with us so we can apply your tier inside the Service. We do not receive your card number, expiration, CVC, or billing-address data.

2.6 Operator access

Meridian Operations LLC maintains a non-public administrative surface (operator console) that lets the Operator perform platform- level functions such as: viewing community and member counts for capacity planning, suspending a community for terms violations, force-signing-out a compromised account, and managing the closed-beta allowlist. Operator actions are recorded in an internal audit log. The Operator can read metadata across communities but cannot view your password (we have none), your Discord/Roblox tokens (we discard them), or your card number (Stripe handles that).

2.7 Pre-launch waitlist (archived)

Before AwareCAD opened to public signups, visitors could submit their email through a waitlist form on awarecad.com. We still hold those records (email, source, submission timestamp) for the people who signed up during the closed-beta period. The waitlist form is no longer active — public signup is open. If you submitted your email during the closed beta and want it removed, you can file a support ticket and we'll delete the entry.

2.8 Internal audit log

The Service writes an internal audit row for each significant action you take inside a community (creating a record, editing another member, etc.). Audit rows record your user ID, the action, the affected record, and a timestamp. Audit rows are visible to your community's admins and to the Operator; they are not visible to other members. We retain audit rows for the lifetime of the community.

2.9 What we do NOT collect

• We do not collect government identification documents.
• We do not collect payment card information directly (Stripe handles all payment data on its own infrastructure — see Section 2.5).
• We do not collect biometric data.
• We do not collect precise geolocation data.
• We do not use advertising trackers, analytics SDKs, or behavioral profiling.
• We do not sell personal data. We have never sold personal data and have no plan to.
• We do not use your data to train any machine-learning model, including any large language model.

3. How we use information

We use the data described in Section 2 only to:

• Authenticate you and keep you signed in across our subdomains.
• Display your identity (username, avatar) to officers and other authorized members of communities you join.
• Enforce community-level access (officer / dispatcher / admin permissions) and Roblox-group-based auto-enrollment if your community has configured it.
• Operate roleplay features (calls, citations, BOLOs, etc.) within the communities you participate in.
• Communicate service-critical notices (security incidents, scheduled maintenance, terms changes).
• Investigate and respond to abuse, fraud, or violations of our Terms of Use.
• Comply with legal obligations.

We do not use your data for advertising, profiling, or training machine-learning models.

4. Why we're allowed to process your data (Europe / UK)

If you live in the European Economic Area, the United Kingdom, or Switzerland, GDPR requires us to tell you which of its legal bases each piece of processing relies on:

• To deliver the Service you signed up for (GDPR Article 6(1)(b), "performance of a contract").
• To keep the Service running safely and prevent abuse (GDPR Article 6(1)(f), "legitimate interests").
• Because you chose to opt in — for example, connecting your Roblox account. You can withdraw consent at any time by unlinking the integration or deleting your account (GDPR Article 6(1)(a)).
• Because the law requires it — for example, responding to a valid court order (GDPR Article 6(1)(c)).

5. Disclosure to third parties

We do not sell, rent, or trade personal data. We share data only:

• Within your community. Officers, dispatchers, and administrators of a community you join can see civilian profiles, citations, warrants, BOLOs, and incident reports scoped to that community. This is the core purpose of the Service.
• With your community's configured webhooks. If your community admin has set up Discord webhooks for recruitment, event notifications, or dispatch outbound (see Section 2.3), AwareCAD will send relevant event payloads to the URL configured by your admin. Only your community's admin chooses these URLs.
• With infrastructure providers. See Section 6 for the full list. They process data on our behalf under contractual confidentiality obligations.
• With the Operator's administrative staff. As described in Section 2.6, Meridian Operations LLC personnel can access community metadata for platform-operations purposes (capacity planning, abuse response, support).
• When required by law. If we receive a valid legal request (subpoena, court order, etc.), we may disclose data to the extent legally required. We will notify you unless legally prohibited from doing so.
• To protect rights or safety. If we believe disclosure is reasonably necessary to prevent harm, fraud, or violation of our Terms.
• In a business transfer. If Meridian Operations LLC is sold, merged, or its assets are acquired, your data may be transferred to the successor entity, subject to this Privacy Policy (or a successor policy materially equivalent).

6. Subprocessors and third-party services

We rely on the following third-party services to operate. Each processes data on our behalf:

Each provider has its own privacy policy and acts as a processor on our behalf under contractual confidentiality and security obligations. Stripe and Sentry are listed here for transparency; they are activated only when the corresponding feature is in use (paid subscriptions; error reporting). We do not engage marketing or analytics vendors. We will give 30 days' notice before adding a new processor that materially changes how your personal data is handled.

7. Cookies

AwareCAD only sets cookies that are needed for the Service to work. We don't set advertising, analytics, or social- media tracking cookies, and we don't let any third party set cookies through AwareCAD.

The cookies we use:

• Sign-in cookies — used to keep you signed in. Without these, every page would log you out. They're sent only to AwareCAD's own domains (e.g. mdt.awarecad.com) and your browser hides them from any JavaScript on the page, so they can't be stolen by a malicious script. They auto-refresh while you're active and expire when you sign out.
• Last-community cookie — remembers which community you most recently used so we drop you back into the right one on your next visit. Lasts a year unless you clear it.
• Sign-in-flow cookies — set briefly (about 10 minutes) while you're going through a Roblox or Discord sign-in screen, so we can verify when you come back. They're deleted as soon as the sign-in finishes.

8. Data retention and deletion

We retain your data only as long as your account is active or as needed to provide the Service. Specifically:

• Account data — retained while your account exists. Removed from active systems within 30 days of account deletion.
• Records you own (civilian profiles you registered, vehicles, weapons attached to those civilians) — deleted when you delete your AwareCAD account.
• Records you authored about others (citations you issued, BOLOs, warrants, arrest reports, field notes, calls you created, community audit entries) — retained by the community. When you delete your account, your name is unlinked from those records (the "authored by" field becomes null) but the underlying records continue to exist for the community's historical reference. This is necessary so the rest of the community's records do not disappear when one author leaves.
• Discord / Roblox identifiers — deleted when you delete your account or when you unlink the integration.
• Server logs — retained by Cloudflare per their standard retention (typically days to weeks).
• Inactive accounts — accounts with no sign-in activity for 24 consecutive months may be deleted at our discretion, after a 30-day email warning to the last known email on file.
• Backup data — our database provider maintains automatic backups (currently a 7-day point-in-time recovery window plus daily snapshots) for disaster recovery. Deleted data may persist in backups for up to 30 days before being purged.

9. Security

We take reasonable steps to keep your data safe:

• Encryption in transit. Every page you load and every API call is encrypted with modern HTTPS. Someone watching your network traffic can't read it.
• Per-community access checks at the database. The database itself enforces who can see what. Even if a bug in our app code tried to load another community's records, the database would refuse the request.
• Sign-in tokens shielded from page scripts. Your sign-in cookies are configured so that JavaScript running on a page cannot read them, which protects you from a class of attacks where a malicious script tries to steal your session.
• Sign-in flow protected from interception. When you sign in with Roblox or Discord, the handshake uses a one-time code that's bound to your browser. Even if someone intercepted the code in flight, they couldn't use it to sign in as you.
• Roblox access pass thrown away immediately. The temporary key Roblox issues during sign-in is used once to read your ID and username, then discarded. We never store it.
• Secrets kept out of code. Sensitive credentials (database passwords, OAuth client secrets) live in Cloudflare's encrypted secret store, not in our source code or in anything we ship to your browser.

No system is perfectly secure. By using the Service you accept that, despite our reasonable efforts, data could still be compromised by an attacker, an insider, or one of our infrastructure providers. See Section 14 of our Terms of Use for the formal warranty disclaimers.

10. Your rights

Depending on where you live (the European Union, the United Kingdom, California, Texas, Virginia, Colorado, Connecticut, Utah, and most other U.S. states with a comprehensive privacy law), you have the following rights over your data:

• Access — Request a copy of the personal data we hold about you.
• Correction — Ask us to correct inaccurate data.
• Deletion — Ask us to delete your data. You can self-serve at /settings/data after signing in, or email us.
• Portability — Request a machine-readable export of your data.
• Objection / Restriction — Object to or restrict processing based on legitimate interests.
• Withdraw consent — Where processing relies on consent, withdraw it.
• Non-discrimination — We will not discriminate against you for exercising any of these rights.
• Lodge a complaint — EU/UK residents may complain to their local supervisory authority. California residents may contact the California Attorney General.

To exercise these rights, file a support ticket. We will respond within 30 days (or sooner where required by law). We may need to verify your identity before fulfilling a request.

11. Children's privacy

AwareCAD is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you are under 13, do not use the Service or provide any data to us. If we learn that we have collected data from a child under 13 without verifiable parental consent, we will delete it.

If you are a parent or guardian and believe your child has provided us with personal data, please file a support ticket.

Note: while the Roblox platform itself is accessible to users under 13, AwareCAD is a separate third-party tool intended for community administrators and roleplay participants, and is not designed for children. Communities that knowingly enroll members under 13 are responsible for ensuring they have any required parental consent under applicable law.

12. International data transfers

Our subprocessors are located in the United States. If you access the Service from outside the United States, your data will be transferred to, stored, and processed in the United States, which may have data-protection laws different from those of your country.

For EU/UK/Swiss residents: transfers rely on the Standard Contractual Clauses (SCCs) or equivalent safeguards offered by each provider (Supabase and Cloudflare both publish SCCs and DPAs).

13. State-specific disclosures (United States)

California

If you live in California, you can ask to see, correct, or delete the personal information we hold about you, and ask us to limit how we use any sensitive information. We do not sell your personal information, and we do not share it for cross-site advertising. Section 2 lists exactly what categories of data we collect.

Texas

If you live in Texas, you can ask us to confirm what data we have, get a copy of it, correct it, or delete it. You can also tell us not to use your data for targeted ads, to sell it, or to profile you — though AwareCAD doesn't do any of those things to begin with. File a support ticket to make a request. If we say no and you disagree, reply within 30 days and we'll review the appeal. If we still say no, you can contact the Texas Attorney General.

Other states (Utah, Virginia, Colorado, Connecticut, Oregon, Tennessee, and more)

Most U.S. states with a comprehensive privacy law give you the same rights described in Section 10. To exercise them, file a support ticket. If we deny a request, you can appeal by replying to our response within 30 days.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated by email (to your account email) or via a prominent in-app notice at least seven days before they take effect. Your continued use of the Service after the effective date of any change constitutes acceptance.

15. AwareCAD is not real law-enforcement software

AwareCAD is a fictional-gameplay tool for hobbyist roleplay communities. It is not intended for use by real police, sheriff, EMS, fire, or other public-safety agencies. It does not meet any of the standards real public-safety software has to meet (for example, the FBI's CJIS rules for criminal-justice information systems). Do not use AwareCAD to store, process, or transmit real criminal-justice data, real arrest records, or any data about actual people.

16. Severability

If any provision of this Policy is held to be invalid or unenforceable, the remainder shall remain in full force and effect.

17. Contact

For any privacy questions, requests, or complaints, contact:

Meridian Operations LLC
Operator of AwareCAD
Email: support@awarecad.com

Meridian Operations LLC is the sole data controller for the data described in this Policy. We do not have a designated Data Protection Officer; the email address above is the responsible contact for all data-protection matters.