Privacy policy

Last reviewed: 14 November 2026

In brief

You can read this website without creating an account. We do not use advertising, visitor profiles, tracking pixels or embedded social feeds. Site search runs in your browser; the search words you type are not submitted to our search server. The public cookie panel explains essential cookies and lets you save or forget your cookie-choice preference. It does not enable optional tracking or require you to accept our terms.

Anonymous page-request totals

We count successful public page requests by UK date and page path so Trust administrators can see website usage. Reloads and automated requests are included; these totals do not identify unique visitors. The counter does not store IP addresses, user IDs, cookies, search terms, referrers or browser fingerprints. Daily aggregates are automatically removed within 31 days. CMS and Staff Hub pages, assets, errors and redirects are excluded.

Website publishing and operations

Trust administrators can publish website announcements. Their messages, optional links and selected publication dates are public while an announcement is live. Drafts remain private. The CMS records the staff Roblox ID, action, time and record identifier for the latest 100 announcement changes and website health runs, and keeps the latest ten health reports. Private copies of announcements before new changes, including deletion, are retained with those activity entries so Trust rank 255 can revert an action. These copies are removed when their activity entries leave the latest 100 events. A minimal identifier and version can remain to prevent replay. Reports do not include passwords, API keys or provider error bodies.

Who is responsible?

Lowry Community Academies is an independent online education roleplay community on Roblox. This notice covers this website, including Staff Hub authentication. This website is operated under the name Lowry Community Academies. You can reach the community team through our Discord server. For privacy enquiries, ask how to contact the website operator privately; do not share personal information in public channels. Discord may require an account. It does not cover activity on Roblox or any separate community applications or records, which need their own privacy information where applicable.

Information used to deliver the website

When your browser requests a page or image, our hosting provider, Cloudflare, processes connection and request information. This can include your IP address, requested URL, request time, browser information and security signals. This is used to deliver the requested content and protect the service.

We do not save search histories or write visitor information to application logs. Staff Hub sign-in uses Roblox OAuth. We receive your Roblox user ID and check your trust and school group memberships, roles and numeric rank on the server. We do not receive your Roblox password or request your email.

Staff Hub sessions

For restricted staff access we store your Roblox user ID, eligible school group memberships and roles, your selected site / centre, trust role and rank, verification and expiry times, last activity time, and session security values in Cloudflare Durable Objects. Sessions end after 30 minutes of inactivity or eight hours after sign-in. Signing in again ends the account's older browser session. Active session details are removed on logout, expiry or a failed eligibility check; a reason-only expiry record can remain for ten minutes to explain why sign-in is needed. A hashed current-session reference is retained until its original eight-hour expiry to prevent older sessions from becoming active again. Eligibility is checked on a protected request once the last check is five minutes old, and before changing sites or making administrative changes. School eligibility also depends on the trust-approved school configuration. Access to a school is blocked if its membership verification is unavailable. Temporary sign-in records expire after ten minutes. Expiry alarms remove active records; provider backups and security records may have separate retention. Roblox tokens are used temporarily to verify identity, then revocation is requested; they are not stored in sessions or sent to your browser.

Search and information you enter

Public website search downloads a list of public pages and matches your words on your device. Search terms stay in the current page and are not added to the address bar, cookies or browser storage by this site. Avoid entering private information into search. There are no contact, registration or payment submission forms on the public website.

Restricted school directories use Roblox group roles, user IDs, usernames and display names. Directory searches are processed on the server and appear in the page URL. Student profiles and SEN and Behaviour notes are available only to the selected school's staff. SEN and Behaviour notes, their authors' Roblox IDs and creation times are stored in Cloudflare Durable Objects, scoped to the school, linked Roblox group and student. They are not included in public school profiles.

School staff notices store announcement text, the author's Roblox ID and role at publication, publication time and pin settings in Cloudflare Durable Objects. When you acknowledge a notice, your Roblox ID and acknowledgement time are recorded for that school and linked group. School staff can read notices; associates and administrators can see acknowledgement totals.

Homepage quotes are published by Trust administrators. Names, roles, quotes and cut-out portraits in that section are public. Entry content, portraits and administrator update details are stored in Cloudflare Durable Objects.

Roblox product licensing stores the Roblox Group ID, product, licence status, optional school link, configured school branding and administrative change history. The public status endpoint returns a group's licence status and the configured product module asset ID; it does not prove the caller owns that group. No school licence keys or Roblox secrets are collected. Former experience IDs are archived internally on migrated records; retired credential hashes are removed. Verification responses are not cached.

Academy funding requests store the requested Robux amount, purpose, objectives, signer's name, drawn signature, requester's Roblox ID, submission time and Trust review decisions in Cloudflare Durable Objects. These records are private to authorised academy staff and Trust administrators.

Purpose and lawful basis

Request information is used for website delivery and security. The operator must confirm and document the applicable UK GDPR lawful basis before finalising this notice. We do not treat visiting the site as consent to tracking or other optional processing.

Network-error reporting on the live domain

The live hosting configuration was observed sending Cloudflare Network Error Logging instructions on 25 September 2026. Compatible browsers may send diagnostic reports about network failures to Cloudflare. Disabling this optional host-level reporting remains outstanding. See the cookies policy for details.

Providers and international processing

Cloudflare provides hosting and network security. Its global infrastructure may process information outside the UK. The operator must confirm its applicable processing agreement, transfer safeguards and account settings. See Cloudflare's privacy information.

Public website images, fonts and scripts are local resources or system fonts. Restricted student pages also load Roblox avatar headshots from the Roblox image service, without sending the profile page address as a referrer. Roblox and Discord links are not embedded feeds. Choosing Staff Hub login redirects you to Roblox and causes our server to contact Roblox authentication and group APIs. Their own policies apply on their websites.

How long information is kept

Search words are held only in the current page's memory. The application does not persist them. After you choose Use essential cookies or Save preferences, the first-party __Host-lowry_cookie_choice cookie stores only v1.essential for up to 180 days to remember your request. It contains no visitor identifier, timestamp or browsing history, is not used for analytics, and is sent only with requests to this website. You can remove it through Forget saved choice in Cookie settings. The school Staff Hub motivation quote uses tab-session storage for a quote number only. The Cloudflare log-retention setting for this website is 24 hours, as confirmed by the website operator. This period applies to the logs covered by that setting; it does not establish a retention period for any separate Cloudflare security records or browser-held network reporting policies.

Children and young people

We do not ask visitors for their age, school, address, location or other personal details. We do not use profiling, personalised advertising or geolocation. If you need help understanding this notice, ask a trusted adult. Any future account, community or pupil service will need its own privacy assessment and appropriate notice.

Your rights and complaints

Depending on the circumstances and lawful basis, you may have rights to access and correct your personal information, request deletion or restriction, object to processing, and receive portable data. Where consent is used, you may withdraw it. These rights have conditions and exceptions.

You can complain to the Information Commissioner's Office. See our cookies policy for information about storage technologies.