This policy explains what information TK Interactive collects, why we collect it, and the choices you have. It describes exactly what this website does.
Who we are
This website is run by TK Interactive, based in England and Wales. We're responsible for the personal information on this site (in data-protection terms, we're the "controller"). You can contact us through our Discord server.
What we collect
- Your account: your username and password, plus your Discord username and a short bio if you choose to add them. If you connect your Discord account (or sign up with Discord), we also store its Discord user ID and username. We never get your email address or password from Discord. Passwords are stored as a one-way scrambled "hash", so nobody (including us) can read them.
- Applications: your answers when you apply for a role (which may include your Roblox and Discord usernames, age, portfolio links and availability), any images you upload, our staff's decision and message to you, any notes and interview scores (1 to 5) our staff write about your application and, if you're accepted, which getting-started steps have been ticked off.
- Bug reports: what you tell us about a bug (the game, what happened, how to make it happen, your device and, if you add it, your Roblox username), any screenshots you upload, our staff's questions and messages, your replies, and a history of each step (such as when it was confirmed or fixed). You can report a bug on our website or with the /bugreport command in our Discord server: what you type in the Discord form comes to us through Discord, and is saved with your account just like a report made on the website. Your username and how many of your reports staff have confirmed are shown on our Top bug hunters list, and as a badge once you have enough. Once our staff confirm a bug, its short title may be shown to other players who start reporting the same thing (never who reported it or any details), so it isn't reported twice.
- Interviews: if staff invite you to an interview and you book a time on our website, the time you picked, how long it is, which staff member it's with and where it happens (for example a Discord voice channel). Old interview times are deleted 30 days after they happen.
- Games you follow: which of our games you follow, so we can DM you when they launch, get an update or go under maintenance. You can unfollow on the game, in Account settings, or with the button in the DM.
- Our team page: if you're on our staff, the name, job title, Roblox username, Discord username, short bio and photo shown on the Team page. We only list people who agree to it.
- Our partners page: the name, logo, short description and links of the studios, communities and creators we work with, listed with their agreement.
- Staff activity: if you're on our staff, a log of the changes you make in the staff tools (for example "accepted application #12"), so admins can see who changed what, and counts of the decisions you make on applications (shown to staff as review statistics). If you're an admin, we also note the devices you log in from (like "Chrome on Windows") and roughly where from (your network address with the last part removed), so the team is warned when an admin account is used on a new device.
- Cookies: a few small cookies that make the site work (see below).
We don't ask for your real name, address, phone number or payment details on this website.
How we use it
| Why | What we use | Legal basis (UK/EU GDPR) |
|---|---|---|
| To run your account and keep you logged in | Account details, login cookie | Providing the service you signed up for (contract) |
| To review your application and reply to you | Your answers and images | Steps you've asked us to take, and our legitimate interest in recruiting |
| To look into bugs you report and tell you when they're fixed | Your bug report and screenshots | Our legitimate interest in fixing our games |
| To show who's on our team | Team page details | The listed person's consent, which they can withdraw at any time |
| To keep the site secure and stop abuse | Account details, security cookie | Our legitimate interest in a safe website |
| To keep track of changes made by staff | Staff activity log | Our legitimate interest in running the site responsibly |
We don't sell your information, use it for advertising, or make automated decisions about you. Every application is reviewed by a person.
Who can see it
- Anyone: your username, join date and the bio you add appear on your public profile. Team page details are public.
- Our staff and admins: your Discord username (if you add one), your applications, your bug reports and the images you upload. Uploaded images can only be opened by you and our staff. Staff notes about an application are only shown to staff on the site, but they're included when you download your data.
- Our web host: the company that hosts this website stores its data for us.
- Discord, if you connect it: we use Discord to log you in, and our Discord bot sends you DMs about decisions on your applications, interviews you book (with a reminder an hour before), updates to your bug reports, news about games you follow (including staff's messages and questions to you, with a button to reply), and password reset links you ask for. These messages go through Discord, whose privacy policy applies. You can turn the DMs off or disconnect Discord at any time in Account settings.
- Our staff Discord (bug reports): when you report a bug, the game, the report's title, your username and your device are posted in a private staff channel on Discord, and staff are told there when you reply. The details, your replies and screenshots are not posted there.
- Roblox: we look up public information about our games, groups and team members from Roblox. Images from Roblox are passed through our own server, so your browser doesn't contact Roblox when you view our pages. Links to Roblox, Discord and our partners take you to their websites, which have their own privacy policies.
- If the law requires it: we may share information with the authorities when we're legally required to.
Cookies
| Cookie | What it does | Lasts |
|---|---|---|
sid | Keeps you logged in | 30 days, or until you log out |
csrf | Security: stops other websites submitting forms as you | 1 year |
flash | Shows one-off messages like "Saved" | 1 minute |
oauth, dsu | Only while you log in or sign up with Discord: makes sure the answer from Discord is really for you | 10–15 minutes |
tfa | Only while you type your two-step login code | 5 minutes |
lang | Remembers the language you picked | 1 year |
did | Admins only: recognises the device you log in from, so the team is warned about logins from a new device | 2 years |
If you start filling in an application while logged in, your typed answers are also saved in your own browser (not sent to us) so you don't lose them. They're removed when you send the application or log out.
These are all strictly necessary for the site to work, so we don't need to ask for consent. We don't use analytics, advertising or tracking cookies, and our pages don't load anything from other websites: fonts and images are served from our own server.
How long we keep it
- Your account: until you delete it.
- Applications and their images: deleted automatically 1 month after staff make a decision, or straight away if you delete your account or an admin deletes the application.
- Bug reports and their screenshots: deleted automatically 1 month after staff mark them fixed or closed, or straight away if you delete your account or an admin deletes the report.
- Review statistics: counts and dates (when an application arrived, when staff replied, the outcome and which staff member decided) are kept after an application is deleted, without any answers or anything that identifies the applicant.
- Login sessions: expire after 30 days.
- Staff activity log: 12 months.
- Backups: we keep daily backups for 14 days, so deleted information is gone from backups within 14 days.
- Team page details: until the person is removed from the page.
Your rights
- Get a copy of your information: Account settings → Download my data.
- Correct it: edit your details in Account settings, or ask us.
- Delete it: Account settings → Delete my account removes your account, your applications and your bug reports.
- Object, restrict or withdraw consent: contact us and we'll respond within one month.
- Complain: in the UK you can contact the Information Commissioner's Office (ico.org.uk); in the EU, your local data protection authority. We'd appreciate the chance to sort it out first.
Children
You must be 13 or older to create an account. If you're under 18, please talk to a parent or guardian before applying for a role. If we find out an account belongs to someone under 13, we'll delete it. Parents and guardians can contact us with any concerns.
Keeping it safe
Passwords are hashed, two-step login keys and other secrets are stored encrypted, uploaded files are checked to make sure they're real images, application images and bug report screenshots are only visible to the person who sent them and staff, and only staff and admins can see applications. No website is perfectly secure, but we take reasonable steps to protect your information.
Changes to this policy
If we change this policy we'll update the date at the top, and post an announcement for any significant change.
Contact
Questions about privacy: ask us in our Discord server.