Privacy Policy

1. Who We Are

The KovaHub Staff Portal is operated by Kova, a Roblox community and game studio. References to "Kova", "we", "us", or "our" in this policy refer to Kova and its authorised administrators. This Platform is an internal staff management tool and is not publicly accessible.

2. Information We Collect

We collect and store the following information when you use the Platform:

Information you provide or that is linked to your account:

• Discord username and user ID — collected via Discord OAuth when you sign in.
• Discord profile picture and display name — pulled from Discord to display your identity within the Platform.
• Roblox username and user ID — entered by an administrator or verified via Roblox OAuth if you choose to connect your account.

Information recorded by administrators:

• Staff role and join date — your position within Kova and the date you joined the team.
• Payout records — accumulated and historical Robux figures associated with your account.
• Activity log entries — including warnings, promotions, demotions, notes, commendations, and status changes.
• Status — your current staff status (active, on leave, terminated, resigned, or blacklisted).
• Permissions and group assignments — the permission groups and individual access settings applied to your account.
• Notes — any additional notes added by administrators about your account.

Information generated through your use of the Platform:

• Task logs and points — tasks you submit, their quantities, points, review status, and quota progress within each task period.
• Applications — answers you submit when applying for a staff position, along with reviewer votes and feedback.
• Leave of absence (LOA) requests — the dates, reason, and status of any LOA you request.
• Robux requests — payout requests you submit, including amount and reason.
• Training and policy records — your progress and scores on training modules, and a record of policies you have read and signed, including timestamps.
• Notification preferences — your choices about which direct messages you receive from the bot.
• Modmail conversations — if you message staff through the bot's modmail feature, the contents of that conversation are stored as a log.
• Reminders — the text and timing of any reminders you create through the bot, stored until they are delivered.

Kova Mail (only if you have been given a mailbox):

• Mailbox details — your @kovahub.org address, the name people see on your email, your signature, and which staff member the mailbox belongs to.
• Your email — the emails you send and receive, including attachments, the people you email, and folders, read status, and stars.
• Alert records — a short list of which recent emails you have already been sent a Discord alert about, so you are not alerted twice.
• Sending totals — a count of email sent outside Kova each day, kept for all of Kova together rather than per person.

Kova Academy and Kova Certifications (if you take a course):

• Course progress — which courses you have started, the lessons you have finished, the last lesson you opened, your practice quiz scores, and when you started and finished.
• Exam attempts — the questions you were given, your answers, your score and result, when you started and finished, and how many times you left the exam tab during the exam.
• Certificates — the certification, its ID, dates and status, and the Roblox account it was issued to (user ID, username, display name and avatar), refreshed from Roblox from time to time.
• Learner invitations — if you are invited from outside staff, your Discord ID and username, which certifications you can take, any note an administrator added, and who invited you.

Information collected automatically:

• Session data — authentication tokens managed by NextAuth to keep you securely logged in.
• Access timestamps — records of when accounts were created or modified in the database.

3. How We Use Your Information

The information we collect is used solely for the purpose of operating the KovaHub Staff Portal. Specifically, we use it to:

• Authenticate you and verify that you are an authorised member of Kova staff.
• Display your profile, role, and statistics within the Platform.
• Track and manage Robux payout records on your behalf.
• Maintain an activity log for administrative and accountability purposes.
• Operate the task, application, leave of absence, training, and policy systems, including tracking submissions, points, completions, and signatures.
• Send you direct messages through the connected Discord bot for staff notifications, announcements, updates, request statuses, and reminders you create, in line with your notification preferences.
• Operate the modmail feature so you can communicate with staff, and retain those conversations for administrative reference.
• Operate Kova Mail: store, send, and deliver your email, filter spam, alert you on Discord when new email arrives, and switch off and delete mailboxes when staff leave Kova.
• Run Kova Academy and Kova Certifications: show courses and remember your progress, present and mark exams, keep exams fair, issue, sign and revoke certificates, and let anyone check a certificate is genuine on its public verification page.
• Verify your identity by matching your Roblox account to your staff profile.
• Generate payout CSV exports for processing on Roblox.
• Identify accounts that appear to belong to the same person, so that points, rewards, and payouts are earned fairly. This compares information we already hold — such as linked Roblox accounts, invite records, and ticket activity — and any account identified this way is reviewed by an administrator before any action is taken.

We do not use your information for marketing, advertising, or any purpose unrelated to Kova staff management.

4. Roblox OAuth Data

If you choose to connect your Roblox account via Roblox OAuth, we access and store the following data from Roblox:

• Roblox user ID and username — used to verify your identity against your staff profile.
• Roblox group membership data — we check your membership and rank within the official Kova Roblox group (ID: 13510248). You must be a member of this group to complete verification. Your group role name and rank number are stored and displayed on your profile.
• Roblox avatar headshot — a 150×150 pixel avatar image is fetched from Roblox's thumbnail API and stored to display on your profile and in the staff directory.

We do not store Roblox OAuth access tokens or refresh tokens beyond the initial verification request. Your group rank may be refreshed automatically when you visit your profile page to reflect any changes. Connecting your Roblox account is optional and you may disconnect it at any time from your profile page, which will remove the verified status but retain your Roblox username and ID on your staff record.

Discord bot verification. Our Discord bot also offers Roblox account verification directly within our Discord servers (via the /verify command or a verification panel). This uses the same official Roblox OAuth2 consent flow. Before you can verify or update through the bot, you are shown a consent notice and must explicitly agree once per server; we record that you consented, together with the date. Once verified, we store the link between your Discord and Roblox accounts (your Discord ID, Roblox ID, username, and display name) and use it to assign Discord roles and set your server nickname based on your Roblox group standing. This linking is available to any member of our servers, not only staff. You can remove this link at any time with the /unlink command, and you may decline consent, in which case the bot will not access your Roblox information or modify your roles or nickname.

5. Kova Mail

If you have an @kovahub.org mailbox, the following applies to your email:

• Where it is stored. Your email is stored on Kova’s own mail server, which runs on the same private server as the Platform. Email between two @kovahub.org addresses stays on that server.
• Sending outside Kova. Email you send to addresses outside Kova is passed to Brevo, an email delivery service, which delivers it to the recipient. Brevo processes those messages under its own privacy policy.
• Discord alerts. When new email reaches your inbox, the bot can DM you the sender’s name and address and the subject line. The body of the email is never included. These alerts pass through Discord. You can turn them off under DM Notifications on your dashboard.
• Who can see it. Kova does not routinely read staff email, and the Platform does not let administrators open other people’s mailboxes. The owner or an authorised administrator with access to the mail server may access a mailbox when needed to investigate a security problem or a suspected breach of our Terms or the Email Policy, to keep Kova business running after someone leaves, or where the law requires it.
• Your login. Mailboxes have no password you need to remember. You sign in to the Platform with Discord, and each mailbox’s login is generated at random and stored encrypted.
• Email content. Incoming email is cleaned before it is shown to you, and images from the web stay hidden until you choose to load them, so senders cannot track when you open their email.

6. Data Storage and Security

Your data is stored securely in a MongoDB Atlas database hosted on cloud infrastructure, and Kova Mail email is stored on Kova’s private server. We implement the following measures to protect your data:

• All connections to the database are encrypted using TLS.
• Access to the database is restricted by IP allowlisting and strong credentials.
• Authentication is handled via industry-standard OAuth2 protocols through Discord.
• Session tokens are encrypted using a secure secret key.
• The Platform is served exclusively over HTTPS.
• The mail server’s management interface is only reachable from the server itself, and email to and from other mail servers is encrypted in transit where the other server supports it.

While we take reasonable steps to protect your data, no system is completely secure. You use this Platform at your own risk.

7. Data Sharing

We do not sell, trade, or share your personal information with any third parties, except in the following limited circumstances:

• Service providers — we use a virtual private server from Pebblehost to host the Platform and the Kova Mail server, MongoDB Atlas for data storage, Brevo to deliver email sent from Kova Mail to addresses outside Kova, and Discord and Roblox for authentication (OAuth). The connected Discord bot delivers messages to you through Discord, which means the content of those messages — including notifications, announcements, updates, modmail replies, and reminders — passes through Discord. These services may process your data as part of providing their service, subject to their own privacy policies.
• Legal requirements — we may disclose information if required to do so by law or in response to valid legal requests.

Certificate verification. Each certificate has a public verification page on kovahub.org. Anyone with its ID can see the certification, its dates and status, and the holder’s Roblox display name, username, user ID and avatar. Your Discord account and exam answers are never shown there. Verification pages ask search engines not to index them.

Within the Platform, your profile information and log entries are visible to authorised administrators and the owner. Log entries marked as hidden are not visible to other staff members.

8. Data Retention

We retain your data for as long as your staff profile exists on the Platform. If you are removed from the Platform, your data may be retained for a reasonable period for administrative record-keeping purposes. You may request deletion of your data by contacting a Kova administrator.

Certificates are kept for as long as they need to be verifiable, including after you leave Kova, so that anyone you have shown one to can still check it. Exam attempts are kept with them for administrative records. You can ask a Kova administrator to delete a certificate, which removes its verification page.

Kova Mail is different. Your mailbox is only kept while you are a member of Kova staff. If you are marked as terminated, resigned, or blacklisted, your mailbox is switched off straight away, and 30 days later the mailbox and every email in it is permanently deleted from the mail server, unless an administrator decides to keep it. Copies may remain in server backups for a short time until they are overwritten. An administrator can also delete a mailbox earlier.

9. Your Rights

Depending on your location, you may have certain rights regarding your personal data, including:

• Right to access — you can view your own profile data by logging into the Platform.
• Right to correction — if any information is inaccurate, contact an administrator to have it corrected.
• Right to deletion — you may request deletion of your data by contacting a Kova administrator.
• Right to disconnect — you may disconnect your Roblox account at any time from your profile page.

To exercise any of these rights, please contact a Kova administrator via the official Kova Discord server.

10. Cookies and Session Storage

The Platform uses cookies solely for authentication purposes. A session cookie is stored in your browser when you sign in, which allows you to remain logged in across page loads. We do not use tracking cookies, advertising cookies, or any third-party analytics cookies.

11. Children's Privacy

The Platform is not intended for individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has accessed the Platform, please contact a Kova administrator immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect when the most recent changes were made. Continued use of the Platform after any changes constitutes your acceptance of the updated policy.

13. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please contact a Kova administrator via the official Kova Discord server.