Effective Date: 01 July 2025
Version: 2.0
Contact: msurobotic1@gmail.com
Team: FRC Team 3843 – RoboRacers, Murray State University
1. Purpose & Scope
We collect, use, and safeguard personal data in support of our regional FIRST Robotics Competition program. Although not a public‑school district, we voluntarily align with Kentucky Senate Bill 181’s emphasis on traceable, review‑able student communications. Our practices also incorporate requirements and best‑practice guidance from COPPA, Kentucky’s data‑breach statute.
2. Key Definitions
- Personal Information (PI): data that identifies or can reasonably identify an individual.
- Traceable System: a platform that logs, archives, and allows parental review of every message (e.g., Discord audit logs).
- Mentor: any adult volunteer, alumnus, or staff member who interacts with students.
3. Legal & Regulatory Alignment
| Framework | Status | How We Address |
|---|---|---|
| SB 181 (KY) | Voluntary – adopted as a best‑practice standard, not legally mandated | All mentor–student communications are logged on Discord; any off‑platform contact requires written parental consent; unauthorized contact is reported to leadership and parents. |
| COPPA | Voluntary – we adopt best-practice standards for collecting data from children under 13, consistent with COPPA requirements | Parental consent as a best practice, with child PI retained only as necessary for safety and compliance. |
| Kentucky Data‑Breach Law | Mandatory | We notify affected individuals without unreasonable delay after discovering a security breach, consistent with law‑enforcement needs. |
| Kentucky One‑Party Consent | Mandatory | Participation in the Team voice channel constitutes consent to recording; parents are informed in the consent form. |
4. What We Collect & Why
| Category | Examples | Purpose |
|---|---|---|
| Information You Provide | names, e‑mail addresses, school, emergency‑contact phone & relationship, medical/dietary notes, T‑shirt size, mentor screening status, donation amounts & sponsor contact info | membership, safety, event logistics, fundraising records |
| Engineering Assets & Repositories | CAD models, design documents, GitHub or Onshape usernames, commit history, code comments | robot design collaboration & archival reference |
| Automatically Collected | IP address, browser type, Google Analytics cookies (_ga, _gid) | site security & usage analytics |
| Discord Logs | channel messages, voice recordings & transcripts | safety oversight & compliance |
| Photos & Media | images or videos submitted by parents or captured at team meetings or events | marketing, award submissions, historical archives, website and social channels |
We retain PI only as long as necessary for the purposes above and then securely delete or anonymize it.
Media Release & Parental Opt‑Out
By signing our team participation or FIRST standard media‐release form, parents/guardians grant Team 3843 permission to photograph or video their student during team activities, build sessions, and competitions. These images and clips may appear on our website, social‑media channels, newsletters, and promotional materials. To withhold consent for your child’s likeness, please contact us at msurobotic1@gmail.com; we will flag their profile and refrain from using their images.
5. Discord Communication Rules
- Channels – Student‑only, Parent‑only, Mentor‑only, and a single mixed Team channel (text & voice).
- Voice Channel – Activates when ≥ 2 participants join; automatically recorded. Recording notice appears in the channel topic and consent form.
- Direct Messages – Discord cannot be centrally disabled; members are instructed to turn off “Allow DMs from server members,” and AutoMod blocks or flags residual DMs. Residual risk is disclosed in the consent form.
- Retention – Text logs: retained as long as needed for safety/compliance; raw audio: 30 days; transcripts: 1 year.
Parents may request read‑only roles or exported logs at any time.
6. Data Retention & Secure Disposal
| Data Type | Retention | Deletion Method |
|---|---|---|
| Consent forms | student tenure + 1 yr | secure deletion |
| Medical/dietary notes | student tenure + 1 yr | secure deletion |
| Mentor screening records | 1 yr after last volunteer season | secure deletion |
| Discord text logs | until safety/compliance objective met, then purged | secure deletion |
| Raw voice files | 30 days | automated deletion |
| Photos & media | retained indefinitely unless a removal request is received | best‑effort removal from website, social media, and internal archives |
| CAD & code archives | retained indefinitely unless a participant requests removal | deletion of any PI related to student work |
| Donation & accounting records | 7 yrs (IRS requirement) | secure deletion |
7. Third‑Party Services
Social‑Media Presence & SB 181 Good‑Faith Controls
Our official Facebook, Instagram, LinkedIn, X, and YouTube pages are intended as broadcast‑only channels. Consistent with our voluntary alignment to Kentucky SB 181, we disable or restrict direct‑messaging features wherever the platform allows. Parents and guardians should understand that these platforms may still permit followers to initiate private messages outside our control. We therefore encourage families to monitor their students’ personal social‑media activity and use each platform’s built‑in privacy settings.
If a student or mentor receives an unsolicited direct message related to team business, they must immediately notify a mentor so the communication can be moved to a traceable, logged channel or reported, per our “Unauthorized Contact” protocol.
Social Login & Auto‑Posting Apps (Facebook, Instagram, LinkedIn, X)
We operate first‑party API apps on these platforms for two purposes:
- Social Login: letting mentors or parents sign in to our WordPress site using their existing social‑media credentials.
- Auto‑Posting: automatically publishing team news from WordPress to our official social pages.
When you connect your account, we receive the minimum data each platform permits—typically name, e‑mail, profile picture, and an access token. Tokens are encrypted at rest and used only to authenticate you or publish content you have authorised. We do not pull friend lists, messages, or other extended scopes.
Revoking Permissions / Data Deletion – You may disconnect at any time via the privacy settings of the social platform or by e‑mailing us. Upon revocation we delete the stored token and any associated login record within 30 days.
We use standard WordPress plugins (such as Site Kit, Super Socializer, and Social Media Auto Publish) and cloud services like GitHub and Google Drive. Each provider’s own privacy policy governs any data it processes. A current list of key providers is available on request.
8. Cookies & Tracking
We use necessary and analytics cookies only. Google Analytics (_ga, _gid) tracks page visits; you can opt‑out via https://tools.google.com/dlpage/gaoptout. Your browser lets you clear or block cookies.
9. Security Measures
- Access Control – admin Gmail secured with TOTP 2FA; passwords stored in an encrypted vault.
- Transport Security – all web traffic forced over HTTPS.
- Content Filtering – bots filter “DM,” phone numbers, e‑mails.
- Periodic Assessments – we run vulnerability checks as resources allow.
- Breach Notification – if a breach occurs, affected individuals are notified without unreasonable delay.
10. Sharing & Disclosure
We do not sell personal information. We share PI only with:
- FIRST Robotics, Sponsors, & Grantors – roster, impact metrics.
- Emergency Services – to protect life/safety.
- Legal Compliance – when lawfully compelled.
- Service Providers – the Third‑Party Services section, bound by confidentiality.
- Media Distributors – images/videos may be shared with FIRST, media partners, and sponsors for promotional and competition‑reporting purposes, consistent with FIRST’s media‐release policies.
11. Your Rights
- Access & Correction – request a copy or correction of your PI.
- Personal Information Deletion – Deletion requests are honored subject to safety/compliance needs.
- Image Removal Requests – to remove a specific photo or video from our site or feeds.
Submit requests via the e‑mail to msurobotics1@gmail.com. Include your name and a description or URL of the data or content you want access to, removed, or changed. Under normal circumstances we will respond within 30 days.
12. Changes
We update this policy periodically. Material changes are announced on our website banner and in Discord #announcements, with a new Effective Date.
© 2025 Team 3843 – RoboRacers. All rights reserved.