Privacy Policy

1. Data We Collect

When you create an account and use the Straw Hats Robotics website, we collect the following personal information:

• Full name
• Email address
• Member ID (admin-issued)
• Attendance timestamps (when you scan in at meetings)
• QR code token (a random, non-identifying token used for check-in)
• Chat messages, voice messages, and file uploads you send through the platform
• Device and browser information for security logging

2. How We Use Your Data

We use your data solely to operate the team's attendance tracking system, member management, and internal communication. Specifically:

• Authentication and account management
• Attendance tracking and reporting
• Internal team chat and file sharing
• Security logging and abuse prevention
• We do not sell, share, or use your data for advertising or any purpose beyond team operations.

3. Chat and Message Data

Messages you send through the chat system, including text messages, voice recordings, images, videos, and file attachments, are stored securely in our database. This data is:

• Only accessible to authenticated team members
• Subject to administrative review for moderation purposes
• Stored with the same encryption and security as all other platform data
• Retained for the duration of your account unless you request deletion

Voice messages are uploaded as audio files and stored in secure cloud storage. They are accessible only through the authenticated chat interface.

4. How Your Data Is Stored

Your data is stored in a Supabase (PostgreSQL) database with encryption at rest. File uploads (images, voice messages, documents) are stored in Supabase Storage with access controls. The website is served via Cloudflare, which provides HTTPS encryption in transit. Access to your data is restricted through Row Level Security (RLS) policies — only you can view your own profile, and only admin accounts can view member data.

5. Who Can Access Your Data

• You: Can view and update your own profile, messages, and uploads.
• Team Members: Can see your display name and Member ID in the chat system and team directory.
• Admins: Can view all member profiles and attendance records for team management purposes. Admins can also moderate chat content.
• No one else: We do not share data with third parties.

All admin actions (viewing profiles, marking attendance, moderating content) are logged in an audit trail for accountability.

6. Data Retention

We retain your data for as long as your account is active. Chat messages and file uploads are retained alongside your account. If you leave the team or request deletion, your personal data will be removed from our systems within a reasonable timeframe. Messages you sent may persist in other users' conversation history.

7. Your Rights

You have the right to:

• Request a copy of all data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Request deletion of specific messages or uploads you have sent.

To exercise any of these rights, contact the team admin through the website or email.

8. Children's Privacy

Some team members may be under 18. We take extra care to protect minors' data. We do not knowingly collect data beyond what is necessary for team operations. Parents or guardians may contact us to review or delete their child's data.

9. Security

We implement industry-standard security measures including:

• Encrypted data storage and transmission (HTTPS/TLS)
• Row Level Security (RLS) policies on all database tables
• Rate limiting on authentication and API endpoints
• Admin action audit logging
• Cloudflare Turnstile CAPTCHA protection on login/signup

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

10. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of the site after changes constitutes acceptance of the updated policy.

Last updated: July 25, 2026