Privacy policy
Effective 22 October 2026.
Metro is a Discord bot and web dashboard that runs an economy on Emergency Response: Liberty County (ER:LC) private servers. This policy explains what personal data Metro handles, why, who else processes it, how long it is kept, and what you can do about it. It covers the bot, the website and dashboard at metrobot.app, and in-game use on a server that runs Metro.
Who is responsible
The data controller is Sverre Sigurdssøn, an individual in Norway who runs Metro. Contact: legal@metrobot.app.
Metro is not affiliated with Roblox, the Police Roleplay Community (PRC) or Discord. They handle your data under their own privacy policies when you use their products.
Where the data comes from
- Discord, when you sign in to the dashboard or use a bot command. Sign-in asks only for the
identifyandguildsscopes, so Metro never receives your email address. - Roblox, if you link your Roblox account through Roblox sign-in: your Roblox user ID and username only.
- The ER:LC API, using the Server-Key a server owner gives Metro. This is how Metro sees who is on the server and what happens there, and it covers every player on that server, whether or not they have linked an account.
- In-game commands you type, such as
;verify. - top.gg, when you vote for Metro there, and Stripe, when a server buys Plus.
What we collect and how long we keep it
This is the complete list. If it isn't in this table, Metro doesn't store it.
| Data | Kept for | Why |
|---|---|---|
| Discord user ID, username and avatar link | Until you ask us to delete them | Signing you in to the dashboard and knowing who runs a bot command |
| Which Discord servers you are in, and your permissions there | Fetched when you use the dashboard, cached 5 minutes, not stored | Showing you only the servers you may manage or play on |
| Roblox user ID and username, and the link to your Discord account | While linked. Unlinking keeps a history row (for the 30-day switch cooldown) until you use "Delete my data" everywhere, which removes every link row, history included | Connecting what you do in game to your Metro account |
| In-game details from the ER:LC API: Roblox username and ID, team, staff permission, callsign, wanted level, vehicle | While the server uses Metro, or until deleted on request | Running the economy: pay, jobs, licences, fines, ranks |
| Live position in the game | 15 minutes | The live map, arrival checks for jobs and events, cameras |
| Raw copies of what the ER:LC API returned (includes the player list and positions) | 7 days | Fixing bugs and checking disputed events |
| Game events: joins and leaves, kill log, staff command log, mod calls, 911 calls including the text the caller typed | While the server uses Metro, or until deleted on request | Economy rules (fines, bounties, dispatch pay) and the staff accountability tools |
| Economy records: balances and transaction history, vehicles, licences, jobs, loans, fines, businesses, crews, achievements | While the server uses Metro, or until deleted on request | The server's economy and its audit trail |
| Notes and flags staff add about a player on their server | While the server uses Metro, or until deleted on request | Server moderation, by that server’s staff |
| Camera observations (a player or plate passing a camera the server placed) | 24 hours by default, up to 7 days if the server sets it. When a sighting is deleted, the fine record made from it keeps only the rule and outcome, without position or plate, except while an appeal of that fine is open; it is stripped at the next clean-up after the appeal is resolved | Camera rules such as speeding, licences, curfew and hotlists; evidence for appeals |
| Plate sightings from polls (where a spawned vehicle with a plate was, by postal, and who was driving it) | 7 days by default; the server can set from 1 hour up to 30 days | Plate lookups by that server’s police department |
| Address learning: for a place on the map, the street and building number players were seen at, with the Roblox IDs of the players who reported it | While the server uses Metro, or until deleted on request | Working out the real address of a place once at least three different players agree on it, so jobs can name it |
| Voice in a Metro Dispatch channel: what people say in the one voice channel a Plus server picked for its automated dispatcher | No recordings are kept. Each transmission is turned into text to act on, on Metro’s own server, and its audio is deleted as soon as it is heard. What the dispatcher then does, such as a status change or a note on a call, is saved in the CAD like any other CAD change | Answering units on the radio and keeping the CAD up to date for them |
| Camera search log (which staff member looked up whom) | 90 days | Letting the server see who searched its cameras |
| Election ballots | 30 days after the election, then only the totals | Recounts |
| Votes for Metro on top.gg (your Discord ID and the time) | Until you ask us to delete them | Paying vote rewards and sending vote reminders |
| Plus subscriptions: Stripe customer and subscription IDs, the server they cover, the Discord ID of the buyer, status and dates, and the checkout confirmations (immediate start, 18 or guardian permission) with their time | 5 years after the purchase, as Norwegian bookkeeping law requires | Providing Plus and keeping accounts |
| Help tickets: the subject and every message you and Metro staff write, where you opened it, and a snapshot taken then (the server and its plan, your Discord and linked Roblox name and ID, the server’s connection state and up to 10 recent error references, never error text) | Until deleted on request. A copy of the conversation is kept in a thread on Metro’s support Discord. The recent error references are kept 7 days before a ticket takes them | Answering your question without asking you for details we can look up |
| Suggestion board: your Discord ID, name and avatar link on what you post, your suggestions, comments and up to 3 pictures or a screenshot of the page you pointed at, your votes and reports, and whether you were told your suggestion shipped | Until deleted on request. Posts, names and avatars are public on metrobot.app/suggestions; votes and reports are not | Running the public board where players and owners suggest and vote on features |
| Backups of the database and of Redis, which hold a copy of everything above | Taken every night at 03:30 UTC. One copy per weekday is kept (7 days), plus one copy on the 1st of each month; how long monthly copies are kept is not yet set | Getting Metro back after a failure. Data you delete can stay in a backup until that backup is replaced |
| Technical data: IP address, browser, and request logs kept by our hosting providers | Per the providers’ log retention, typically days to weeks | Delivering the site, security and abuse prevention |
Metro does not collect email addresses, and never sees card numbers. Plus is sold through Stripe Managed Payments, with Link (part of Stripe) as the reseller and merchant of record: Stripe and Link collect your payment details, billing address and email directly, under their own privacy policies, and act as independent controllers for them.
"While the server uses Metro" means records tied to a server stay while that server runs Metro, because its economy and audit trail depend on them. When a server removes Metro, Metro stops reading it and deletes that server's stored Server-Key at once; adding Metro back means entering the key again. The owner can also ask us to delete the rest of that server's data.
Why we use it: legal bases
- Contract: to provide the dashboard, the bot and Plus to you when you sign in, link an account, run Metro on your server, or subscribe.
- Legitimate interests: to run the economy a server owner chose for their community, which includes processing the in-game data of every player on that server; to keep Metro secure and prevent abuse; and to fix bugs. We weigh these interests against yours, keep the data to what the table lists, and you can object at any time (see "Your rights").
- Legal obligation: to keep payment records as Norwegian bookkeeping law requires.
Who processes it
Metro uses these services to run. They process data on our behalf, or, where they have their own relationship with you (Discord, Roblox, PRC, Stripe and Link), also as independent controllers.
| Service | What it does for Metro | Where |
|---|---|---|
| Vercel | Hosts this website and the dashboard; its server functions run in Frankfurt | Germany (functions), United States and global edge network |
| Servitro | Virtual server that runs the Discord bot, the service that reads the game, and Metro’s database (Postgres) and Redis | Frankfurt, Germany |
| Oracle Cloud (Object Storage) | Stores the nightly backups of the database and Redis | Oracle Cloud |
| Stripe and Link (Stripe Managed Payments) | Sells Plus as reseller and merchant of record: payment, tax, receipts and payment support | United States and EU |
| Discord | Sign-in, and the platform the bot runs on | United States |
| Roblox and PRC (ER:LC) | Roblox sign-in for linking; the ER:LC API is where game data comes from | United States |
| ILSRP (partner bot) | A partner bot for the ILSRP community. It reads Metro’s Discord-to-Roblox link stream, to check who is verified on its own server (see below) | Frankfurt, Germany (same server) |
Some of these services are outside the EU/EEA. Transfers to the United States rely on the provider's certification under the EU-U.S. Data Privacy Framework or on the European Commission's Standard Contractual Clauses.
Partner bots
The ILSRP community runs its own Discord bot, which uses Metro to check that a member has verified. For that, Metro announces every link and unlink on a Redis stream (metro:links) that only the ILSRP bot can read, through its own read-only login. Each entry holds your Discord ID, your Roblox ID and username, whether the account was linked or unlinked, how the link was made, and the time. The list keeps only the latest 10,000 entries. ILSRP decides what it stores from that on its own server, under its own rules.
What other people can see
- Staff and owners of a server can see the economy data, logs and camera records for that server in the dashboard and in Discord.
- Metro posts things like leaderboards, election results and profile cards in the server's Discord channels, showing Roblox usernames and in-game figures.
- If a server owner turns on a public server page, it can show Roblox usernames and in-game stats on the public web. You can hide yourself from every public page on your profile page in the dashboard.
We don't sell personal data, don't use it for advertising, and don't use it to train AI models. Each server's economy is separate: we don't combine your activity on different servers into one profile.
Cookies
This site sets only the cookies it needs to work. There are no analytics or advertising cookies: none of the cookies below is used to recognise you between visits, and the visit counts below use none.
- A sign-in session cookie, and short-lived cookies that protect the Discord sign-in against forgery.
metro_ref, for 30 days, if you arrive through a server's referral link, so the invite can be credited to that server.metro_src, for 30 days, if you arrive from a "Get Metro" link on a Metro card or from a Metro link posted on a site such as YouTube, TikTok or top.gg. It is used only to count which card or site brought a server to Metro.metro_via, for 90 days, if you arrive through a creator's link (?via=). It holds the creator's handle, so a server added from that visit can be credited to the creator.metro_optout, for one year, only if you use the switch under "Opting out" below. It says nothing except that this browser is to be left out of the visit counts.
Visit counts
To see which sites, videos and countries bring people to Metro, and how far they get, we count visits on metrobot.app in our own database. We use no third-party tracker and nothing is stored in your browser for it. For each visit we keep: the page you landed on, the site that linked you (or the tags in the link, such as the video it came from), whether you clicked Add to Discord, and your country as our host estimates it from your connection.
- No IP address is stored. To count one person once a day, your IP address and browser details are mixed with a secret key that changes every day, and only the result (a hash) is kept. The key is deleted when the day ends, so that hash cannot be recreated or matched to the next day's.
- When you click Add to Discord, the click is given a random ID that travels through Discord's screen and back, so we can tell which video or link added a server. It is kept with the server, not with a profile of you.
- If you are signed in, or you add Metro to a server, your Discord ID is stored with those events and with that server's record, so an owner's steps (added, set up, first job, Plus) are counted once.
- For each server we count how many different players were online and how many jobs were finished each day. These are numbers only, not a list of players.
- Visits to the admin pages, the server dashboards (
/g) and your own pages (/me), and by Metro's operators, are kept apart and not counted. - Kept: each event for 90 days, then only daily totals for 13 months. A server's record of where it came from is kept while it uses Metro and removed on request.
We do this because we have a legitimate interest in knowing which of our videos and links work, and it is counted without profiling you.
Opting out
You can leave your browser out of the visit counts. Nothing is recorded about you after that, not even that you opted out. The choice is the metro_optout cookie, so it applies to this browser only.
Checking this browser…
Without scripts, open metrobot.app/?optout=1 to leave out, or metrobot.app/?optout=0 to count again.
Your rights
Under the GDPR you have the right to access your data, correct it, have it deleted, restrict how it is used, get a copy in a portable format, and object to processing based on legitimate interests. To use any of these, email legal@metrobot.app and tell us your Discord or Roblox username. We may ask you to confirm the request from that account, and we answer within one month.
Some things you can do yourself, straight away:
- Unlink your Roblox account with the
unlinkoption of/verifyin Discord, or on the Verify page of this site. Unlinking alone keeps a history row of the link. - Download my data on the My data page (under "Me"): a JSON file with what Metro holds about you, for one server or for all of them.
- Delete my data on the same page, for one server or everywhere. It replaces your name in the ledger, audit log and camera search log with "deleted-user", deletes your camera sightings and plate sightings, any camera message about you that is still waiting to be sent, and the position and plate in the fines made from them (a fine with an open appeal keeps them until the appeal is resolved), and takes your Roblox ID out of the address-learning tallies. "Everywhere" also deletes every Roblox link you have had, history included, and your Metro user record. Balances and amounts stay, so the server's accounts still add up. Your help tickets and suggestions are not part of it: email us to have those deleted.
- Delete everything the cameras recorded about you on a server, from that server's Cameras page under "Me".
- Hide yourself from public server pages, on your profile page.
When we delete your data from a server's economy, we may keep its transaction history in a form that no longer identifies you, so that the server's accounts still add up. Payment records we must keep by law are kept until that period ends. Data you delete can remain in a backup until that backup is replaced (see the table above).
If you think we have handled your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or to the data protection authority where you live. We'd appreciate the chance to fix it first.
Age
You must be at least 13 to sign in to Metro or use it through Discord, the same minimum age as Discord's (older where your country requires it). We don't knowingly let anyone younger link an account or use the dashboard, and we delete such an account when we learn of it.
Many ER:LC players are young. A server that runs Metro sends Metro the in-game data of everyone on it, as described above, including players who never use Metro directly. We keep that to the table above. A parent or guardian can ask us to delete a child's data by emailing us with the child's Roblox username and the server.
Security
Data is encrypted in transit. Server-Keys are encrypted with a key that only the game-reading service holds, and are never shown again once entered. Access to the database and servers is limited to the operator. See the security page to report a vulnerability.
Changes to this policy
We will update this policy when Metro changes what it collects or how. The effective date at the top changes with it, and significant changes are announced before they apply.
Contact
Sverre Sigurdssøn, Norway: legal@metrobot.app.