← Back to ROCLUG.org
Official App & Website Privacy Policy

Privacy Policy for ROCLUG Companion & ROCLUG.org

Effective Date: November 1, 2026 • Last Updated: November 1, 2026

Application & Developer Scope:
This Privacy Policy applies specifically to the ROCLUG Companion mobile application for Android (Google Play package ID: com.roclug.companion) and iOS/iPadOS (Apple App Store bundle ID: org.roclug.companion), as well as the official club website at https://roclug.org, operated by the Rochester LEGO Users Group (ROCLUG) (“ROCLUG”, “we”, “us”, or “our”).

ROCLUG is a community-run Recognized LEGO® Fan Community based in Greater Rochester, New York. We are committed to protecting your privacy and handling any data you choose to provide transparently, securely, and strictly for club community functions.

1. Information We Collect and How We Collect It

You can browse upcoming club meetings, public LEGO® displays, venue addresses, approved photo galleries, and live meeting accessibility captions in ROCLUG Companion without signing in or providing any personal information. We only collect information when you voluntarily use interactive features:

  • Account & Authentication Information (Optional Sign-In): If you choose to sign in using Google Sign-In (OAuth 2.0) or Sign in with Apple to submit event photos or access Steering Committee tools, we collect your display name, email address, authentication provider identifier, and assigned club role (Community Uploader, Steering Committee, or Admin).
  • User-Contributed Event Photos & Videos: When you use the Add Photos feature to share photos or videos of LEGO® builds from a ROCLUG event, we collect the media files you explicitly select from your device's system photo picker, along with the optional builder credit name, caption, and associated event identifier. Before upload, the app resizes media for bandwidth efficiency and strips sensitive GPS/location EXIF coordinates before public gallery display.
  • Microphone Audio & Speech Recognition (Steering Committee Presenters Only): The RECORD_AUDIO / Microphone permission is requested only when an authenticated Steering Committee officer actively starts Live Mic mode to broadcast real-time accessibility captions during a club meeting. Spoken audio is processed in real time by the device's speech recognition engine into text captions. Raw audio is never recorded, stored, or retained on ROCLUG servers. Regular members and visitors reading live captions never need to grant microphone access.
  • Push Notification Tokens (Optional): If you opt in to receive notifications (such as live caption broadcast alerts or Steering Committee photo review notifications), the app collects your device push registration token and notification preference settings.
  • Basic Technical Request Data: When the app communicates with our API over HTTPS, standard network metadata (such as IP address, HTTP user-agent, and request timestamps) is processed transiently by our edge hosting provider (Cloudflare) for security and content delivery.

2. How We Use Your Information

We use the collected information exclusively for the following app and club functions:

  • Event & Gallery Publishing: Displaying ROCLUG event schedules, venue details, and approved community LEGO® build photos and videos with creator attribution.
  • Authentication & Role Management: Verifying your identity when you upload media, tracking the moderation status (In Review vs. Approved) of your submitted photos, and authorizing Steering Committee officers to manage events and moderate submissions.
  • Live Meeting Accessibility Captions: Streaming real-time speech-to-text captions during in-person club meetings so hard-of-hearing attendees and members in noisy rooms can follow along on their devices, and generating post-meeting text transcripts when published by the Steering Committee.
  • Opt-In Notifications: Sending push notifications you have enabled (e.g., when a meeting starts live captioning or when new community photos await Steering Committee moderation).

No Advertising or Cross-App Tracking: ROCLUG Companion contains no third-party advertising SDKs, does not build behavioral profiles, and never tracks you across other apps or websites.

3. How We Share User Data & Types of Parties We Share It With

We do not sell, rent, trade, or share your personal data with data brokers, advertisers, or marketing networks. Data is shared only in the limited contexts below:

Data Category Type of Party Shared With Purpose of Sharing
Approved Event Photos/Videos, Captions & Builder Credit Name Public App & Website Visitors Once approved by the ROCLUG Steering Committee, your uploaded build photo/video, caption, and builder credit name are displayed publicly in the event gallery. Your email address is never displayed publicly.
Pending Photo Uploads & Uploader Account Name/Email ROCLUG Steering Committee Moderators & Admins Authorized club officers review pending media submissions to verify they depict LEGO® builds or club events before public approval.
App Data, Media Files, Database Records & Transcripts Cloud Infrastructure Provider (Cloudflare, Inc.) Hosted on Cloudflare Workers, Cloudflare D1 (database), and Cloudflare R2 (object storage) strictly to store and deliver app content over encrypted HTTPS connections.
OAuth Sign-In Requests, Push Tokens & Speech Recognition Platform Providers (Google LLC & Apple Inc.) Used strictly to authenticate your Google or Apple sign-in, deliver push notifications via FCM/APNs, and perform system speech-to-text transcription when Live Mic is active.
Legal Compliance Disclosures (If Required) Law Enforcement / Legal Authorities Disclosed only if strictly required by applicable law, subpoena, or valid legal process.

4. Data Security & Retention

  • Encryption in Transit & Secure Storage: All communication between the ROCLUG Companion app, ROCLUG.org, and our Cloudflare backend is encrypted via HTTPS/TLS. Authentication session tokens on your device are stored using platform-encrypted storage (Android Keystore / Keychain).
  • Rejected Media Automatic Purge: Any uploaded photo or video that is declined during Steering Committee moderation is automatically and permanently purged from our database and storage within 24 hours.
  • Retention of Account & Approved Gallery Data: Account records and approved event gallery photos are retained for as long as the club archive operates or until you request deletion.

5. Your Rights: Account & Data Deletion

You have the right to access, update, or permanently delete your ROCLUG account and associated personal data at any time:

  • Instant In-App Deletion (Android & iOS): Open the ROCLUG Companion app, tap the Account / Settings icon in the top-right corner of the Events screen, and select Delete Account & Data. This immediately revokes your session, deletes your user profile and push tokens, and removes your pending uploads.
  • Deletion via Email Request (No App Access Needed): You may also request full account and photo deletion at any time by emailing rochesterlug@gmail.com or info@roclug.org from the email address associated with your account. We process all deletion requests within 7 days.

6. Children's Privacy

Public browsing in ROCLUG Companion is family-friendly and collects no personal data. Account sign-in and photo uploading are intended for individuals aged 13 and older (or with verifiable parental involvement at family club events). We do not knowingly collect personal information from children under 13 without parental consent. If you believe a child under 13 has submitted personal data without consent, please contact us at rochesterlug@gmail.com and we will promptly delete it.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect app improvements or regulatory requirements. Any updates will be posted at this permanent URL (https://roclug.org/privacy) with an updated effective date.

8. Contact Us

If you have any questions or concerns about this Privacy Policy or how ROCLUG Companion handles your data, please contact the Rochester LEGO Users Group Steering Committee: