Last updated November 1, 2026

Security

This is LCGrid's written security program: how we keep the data we hold safe, who's responsible, and what we do if something goes wrong. It covers everyone's data, including anything about players under 13.

Who's responsible

LCGrid's owners run this program. They decide who can reach LCGrid's systems, review this page at least once a year and after any incident, and answer at legal@lcgrid.xyz.

Collecting less

• We ask Discord only for your basic profile, never your email or messages.
• We don't store IP addresses, only a rough city and country per sign-in.
• We don't store birth dates. The age check keeps only the result.
• Live game data isn't stored, and what is kept expires on the schedule in the Data Retention policy.

How data is protected

• Hosting: LCGrid runs on Cloudflare, and its database is encrypted at rest by Cloudflare.
• In transit: every connection uses HTTPS.
• Sign-in: only through Discord. LCGrid never sees or stores a password.
• Sessions: kept in an encrypted cookie your browser can't read or change, and only sent over HTTPS. You can end any session, or all of them, from Settings.
• Forged requests: anything that changes data has to come from lcgrid.xyz itself, so other sites can't act for you.
• Secrets: ER:LC server keys are encrypted before they're stored. Bot tokens and keys live in Cloudflare's secret storage, never in code.

Who can see what

• Every request is checked on our side against the person's roles and permissions in that server, not only in the page.
• Signing in is limited to the LCGrid team while LCGrid is being built.
• Direct access to the database and Cloudflare is limited to LCGrid's owners, who must use two-factor sign-in.

Services we rely on

We only pass data to the services LCGrid runs on or connects to: Cloudflare, Discord, Roblox, and Police Roleplay Community (the maker of ER:LC). Each one gets only what it needs for the job, and we pick services that keep data secure.

If something goes wrong

1. Contain it: shut off the affected access and change any exposed keys.
2. Find out what happened and whose data was involved.
3. Fix the cause and check that the fix works.
4. Tell the people affected, and the authorities where the law requires it, without unnecessary delay.
5. Write down what happened and update this program.

Found a security problem? Email legal@lcgrid.xyz. Please don't test against other people's data.

Contact

Questions or help: support@lcgrid.xyz. Legal, privacy and data protection requests: legal@lcgrid.xyz.