This Privacy Policy explains what information ERLC Status collects when you visit the website, why we collect it, who we share it with, how long we keep it, and the rights you have. It applies to the website you are reading now and to the services it uses to run.
We have written it to be read by people, not just lawyers. Where we use a technical term we explain it. If anything is unclear, contact me using the details in the Contact section.
Who we are
ERLC Status ("we", "us", "our") is an independent website that publishes the live availability of the ERLC API and the ERLC website, together with a history of recent checks and incidents. It is run by an individual based in the United Kingdom.
We are the "controller" of the personal information described in this policy. That means we decide why and how it is used. You can contact me at [email protected].
We are not affiliated with, endorsed by or sponsored by Police Roleplay Community, Emergency Response: Liberty County (ER:LC), Roblox or Discord.
The short version
- You do not need an account to use ERLC Status, and we do not ask you for your name, email address or any other personal details to read the site.
- We use Cloudflare to deliver and protect the website. Cloudflare sees your IP address and basic request details as part of doing that.
- We use Umami, a privacy focused analytics tool that we host ourselves, to understand how the site is used. It only loads if you accept analytics in the cookie banner.
- Availability checks are about the ERLC services, not about visitors.
- A small group of trusted administrators can sign in with Discord to publish incident updates. Their sign in data and actions are recorded.
- We do not sell your information, we do not use it for advertising, and we do not make decisions about you using automated profiling.
- You have rights over your information, including access, correction and deletion. They are explained below.
What law applies
We handle personal information in line with the data protection laws of the United Kingdom, in particular:
- the UK General Data Protection Regulation (UK GDPR);
- the Data Protection Act 2018; and
- the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), which cover cookies and similar technologies, as amended from time to time.
Information we collect
Information collected when you visit
When your browser requests a page from ERLC Status, certain technical information is sent to us and to the services that deliver the site. This happens automatically and is needed for the website to work.
| Information | Why it is needed |
|---|---|
| IP address | To deliver the page to you, to prevent abuse and to keep the site secure |
| Date and time of the request | To operate the site and investigate faults or attacks |
| Page or file requested, and the response status | To operate the site and diagnose errors |
| Browser type and version, operating system and device type (the user agent) | To send content your browser can display and to detect automated abuse |
| The page that referred you (the referrer), where your browser sends it | To operate the site and understand where traffic comes from, where analytics is allowed |
| Request headers added by Cloudflare, such as the country your request appears to come from | To route requests and apply security rules |
This information is processed by Cloudflare and by the server that hosts the website. Server and network logs are kept for security and troubleshooting and are not used to build a profile of you.
Availability checks
Every minute, an automated process checks the ERLC API and the ERLC website. For each check we store:
- which service was checked (for example the API or the website);
- the result (operational, degraded or outage);
- how long the response took, in milliseconds;
- a short technical note about the result, such as an HTTP status code or "request timed out"; and
- the time of the check.
These records describe the ERLC services. They are not linked to any visitor and contain no personal information about you.
When a check shows a problem, the system may open an incident automatically and add status updates to it. Incidents and their updates are public, and they describe services, not people.
Analytics with Umami
If you choose "Accept all", or switch on "Analytics" in the cookie preferences, the website loads Umami, an open source analytics tool. We host Umami ourselves on infrastructure we control, so your analytics data is not sent to a third party analytics company.
Umami is designed to be privacy focused. According to its documentation it does not use cookies and does not store your full IP address. When analytics is on, Umami may record:
- the pages you view and the time of each view;
- the referrer, meaning the site or page you came from;
- your browser, operating system and device type;
- your screen size and language setting;
- the country, and in some cases region or city, worked out from your IP address at the moment of the request, after which the IP address itself is discarded; and
- an anonymous, rotating identifier built from technical details of your visit, used to count visitors and sessions without identifying you.
We use this information in aggregate to see which pages are used, how the site performs on different devices, and where to improve it. We do not use it to identify individuals, to target advertising, or to track you across other websites.
If you decline analytics, Umami is never loaded and none of this information is collected by it.
Your cookie choice
The first time you visit, a cookie notice asks you to accept all, customise or keep only necessary storage. Your answer is saved in your browser so we do not have to ask again. It records only whether you allowed analytics. You can change your choice at any time using "Cookie settings" in the footer.
Administrator sign in
The website has an administration area used only by the people who run it. It is not for the public and you do not need it to use ERLC Status.
Administrators sign in with their Discord account. When they do, Discord shares with us the account's Discord user ID, username or display name, and avatar image link. We do not ask for or receive an email address, password or messages. This information is used to confirm that the person is on our list of approved administrators and to show their name in the dashboard.
While they are signed in, secure cookies are used to keep them signed in and to protect the sign in from forgery. When administrators sign in, sign out, or change incidents and their updates, we record an entry in an audit log. Each entry holds the administrator's Discord user ID and name, what they did, which incident it related to, a short description, and the time.
If someone signs in with a Discord account that is not on the approved list, they are sent back to the home page without being given access, and we record the attempt in the audit log with the Discord user ID and name that Discord supplied, so that we can spot misuse.
Messages you send us
If you email us, we receive your email address, any name you include, and the content of your message. We use it only to read and reply to you and to keep a record of the conversation. We do not add you to a mailing list.
What we do not collect
To be clear, ERLC Status does not:
- ask you to create an account to view the site;
- collect payment or financial details, because nothing on the site is for sale;
- run advertising or advertising trackers;
- use social media tracking pixels or embed third party widgets that follow you around;
- deliberately collect special category data (such as health, ethnicity or religious beliefs) or data about criminal convictions; or
- load web fonts, scripts or images from third party servers when you browse the public site. Fonts and images are served from the site itself.
Cookies and local storage
Cookies are small files that a website stores in your browser. "Local storage" is a similar browser feature that stores small pieces of information on your device. We use both only where described here.
Under PECR we need your consent before storing or reading information on your device, unless it is "strictly necessary" to give you a service you have asked for, such as security or remembering your cookie choice.
| Name or purpose | Type | What it does | Lifetime | Consent needed |
|---|---|---|---|---|
erlc-status-consent | Local storage | Remembers your cookie choice, including whether you allowed analytics | Until you clear your browser data or change your choice | No, strictly necessary |
erlc-admin-sidebar | Local storage | Remembers whether the admin sidebar is collapsed. Used only by administrators | Until cleared | No, only set in the admin area |
| Administrator session cookie | Cookie, HttpOnly | Keeps an administrator signed in | Up to 30 days, or until sign out | No, strictly necessary, administrators only |
| Sign in security cookies | Cookies, HttpOnly | Protect the Discord sign in from forgery and pass its short lived state | Minutes, or until the sign in finishes | No, strictly necessary, administrators only |
Cloudflare security cookies, for example __cf_bm or cf_clearance | Cookies | Added by Cloudflare to tell humans from bots and to protect the site from attacks. Only set when Cloudflare needs them | Usually minutes to hours, up to about a year for cf_clearance | No, strictly necessary for security |
| Umami | None by default | Umami counts visits without using cookies. It only loads if you allow analytics | Not applicable | Yes, loaded only after you accept analytics |
You can delete cookies and local storage at any time in your browser settings. If you do, we will ask for your cookie choice again on your next visit. Blocking strictly necessary items may stop some features from working.
How we use information and our lawful bases
Under the UK GDPR we must have a lawful basis for using personal information. Ours are:
| What we do | Information involved | Lawful basis |
|---|---|---|
| Deliver the website and keep it secure and available | IP address, request details, user agent, Cloudflare data | Legitimate interests: running a reliable, secure website and defending it against abuse |
| Remember your cookie choice | Cookie choice stored on your device | Strictly necessary under PECR, and legitimate interests under the UK GDPR |
| Measure how the site is used with Umami | Page views, device details, approximate location, anonymous identifier | Consent, which you can withdraw at any time |
| Run the administrator area and keep an audit log | Discord user ID, name, avatar, actions and times | Legitimate interests: keeping the service accurate and secure and being able to account for changes |
| Record denied administrator sign in attempts | Discord user ID and name, time | Legitimate interests: detecting and preventing unauthorised access |
| Reply to your messages | Email address, name, message content | Legitimate interests: answering the people who contact us |
| Meet legal obligations, and establish or defend legal claims | Any of the above, where needed | Legal obligation, or legitimate interests |
Where we rely on legitimate interests, we have considered whether they are outweighed by your rights and expectations. The information involved is limited, is not used to profile you, and is used in ways you would reasonably expect from a website like this one.
We do not carry out solely automated decision making that has legal or similarly significant effects on you.
Who we share information with
We do not sell personal information. We share it only with the following, and only as far as needed:
- Cloudflare, which delivers and protects the website. See Cloudflare.
- Our hosting provider, which runs the server and storage the website and its database live on. They act on our instructions.
- Our self hosted Umami, which runs on our own infrastructure. Analytics data does not go to any outside analytics provider. See Umami.
- Discord, but only for administrators. When an administrator signs in, Discord handles the sign in under its own privacy policy and tells us the details listed above.
- Professional advisers, insurers and authorities, if we are required to, for example by law, a court order or a lawful request from the police or another authority, or to protect our rights and the safety of others.
- A successor, if the site is ever transferred to someone else. We would make sure the information is handled in line with this policy.
Where a company handles personal information for us, we use providers that give appropriate commitments about how that information is protected.
Cloudflare
We use Cloudflare to deliver the website. Cloudflare sits between your browser and our server. It provides DNS, a content delivery network that serves pages from locations close to you, caching, protection against attacks and abuse, and bot detection.
To do this, Cloudflare processes your IP address and the details of each request, and may set the security cookies listed above. It may also show a security check before letting a request through. Cloudflare acts as a processor for us in this respect and, for its own security and network purposes, may also act as an independent controller.
Cloudflare's own information about how it handles data is in its privacy policy at https://www.cloudflare.com/privacypolicy/ and its data processing terms. We do not use Cloudflare to track you for marketing, and we have not enabled third party advertising features.
Umami
Umami is open source web analytics software. We run our own copy of it, so the information it collects stays on our infrastructure. Umami is loaded only after you accept analytics, as described above. We do not combine Umami data with any other data to identify you.
You can learn more about the software at https://umami.is. Because we host it ourselves, Umami's company does not receive your visit data.
Transfers outside the United Kingdom
Our own systems are located in the United Kingdom or elsewhere within the services our hosting provider uses. Cloudflare operates a global network, so your request may be handled in data centres in other countries, including outside the UK, and Cloudflare and its service providers may process data in countries such as the United States.
When personal information is transferred outside the UK, we make sure it is protected by an appropriate safeguard. This may be a UK adequacy decision, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or an equivalent lawful transfer mechanism that the provider has put in place.
How long we keep information
We keep personal information only as long as we need it for the purposes above, then delete or anonymise it. We review what we hold from time to time.
| Information | How long we keep it |
|---|---|
| Availability check records | Up to 120 days, then deleted automatically |
| Incidents and their updates | Kept as a public history of service issues. They contain no personal information about visitors |
| Server, Cloudflare and network logs | For the short periods set by our hosting provider and Cloudflare, usually days to weeks, unless needed longer to investigate a security issue |
| Umami analytics data | Only as long as it is useful for understanding use of the site, after which we delete or anonymise it |
| Audit log entries | As long as needed for security and record keeping. We review them and delete entries that are no longer needed |
| Administrator session cookies | Up to 30 days or until the administrator signs out |
| Your cookie choice | Until you clear your browser data or change your choice |
| Emails you send us | For as long as needed to deal with your message, and a reasonable time afterwards in case of follow up or a dispute |
How we keep information secure
We take reasonable technical and organisational steps to protect information, including:
- encrypting connections to the website with HTTPS;
- limiting administrator access to approved Discord accounts, and checking access on every request;
- keeping administrator sessions in encrypted, HttpOnly cookies and protecting sign in requests against forgery;
- keeping secrets, such as keys, out of the public code;
- recording administrator actions in an audit log; and
- keeping software up to date and using Cloudflare's protection against attacks.
No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will act quickly to contain it and, where the law requires, tell the people affected directly.
Your rights
Under UK data protection law you have the right to:
- be informed about how your information is used, which is the purpose of this policy;
- access a copy of the personal information we hold about you;
- have it corrected if it is inaccurate or incomplete;
- have it erased, in certain circumstances, sometimes called the right to be forgotten;
- restrict how we use it, in certain circumstances;
- data portability, meaning to receive information you gave us in a common format, where we use it based on consent or a contract and by automated means;
- object to us using your information based on legitimate interests, and we will stop unless we have compelling reasons to continue or need it for legal claims;
- withdraw consent at any time, where we rely on consent. You can do this through "Cookie settings" in the footer. Withdrawing consent does not affect use before you withdrew it; and
- not be subject to solely automated decisions with legal or similarly significant effects. We do not make any.
These rights are not absolute and some only apply in particular circumstances. We will explain if we cannot meet a request.
How to use your rights
You can contact me at [email protected] and tell us what you would like us to do. To protect your information we may need to confirm who you are before acting. We will usually respond within one month. That can be extended by up to two further months for complex or numerous requests, and we will tell you if so.
There is no charge, unless a request is clearly unfounded or excessive, in which case we may charge a reasonable fee or refuse it and explain why.
Because analytics data is anonymous and we cannot tell which visits are yours, we may not be able to find information about you in it.
Complaints
If you are unhappy with how we have used your information, you can contact me at [email protected] and we will look into it and do our best to put it right.
Children
ERLC Status is a general audience website and is not aimed at children. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, please contact me and I will delete it.
Links to other websites
The website links to other websites and services, including the ERLC website, the ERLC API documentation, erlc.js and Discord. We do not control them and are not responsible for their privacy practices. Please read their policies before giving them information.
Changes to this policy
We may update this policy when our practices, the services we use or the law change. The date at the top shows when it was last changed. If we make a significant change, we will take reasonable steps to bring it to your attention, for example with a notice on the site.
Contact
If you have questions about this policy, want to use your rights, or want to report a concern, you can contact me at [email protected].
