← Return to Shift Timings

Privacy Policy

Effective Date:

1. About this policy

Dk4Q's Koháu Shift Timings is a fan-made tool for viewing current, upcoming, and past shift information associated with the Roblox game and Koháu community. You can use the shifts site without making an account or giving the site your name, email address, phone number, password, Roblox login, or Discord login.

This policy explains what the shifts site does and does not collect, what information stays in your browser, what information is requested from Dk4Q services, what our web infrastructure may receive when it serves the site, what public host/shift/donor information may be displayed, and what happens when third-party services such as Ko-fi, Google Fonts, jsDelivr, Roblox, or Discord are involved.

2. Privacy at a glance: what we do not collect

When you are simply browsing the shifts site:

There are important exceptions to this simple summary. The page makes normal network requests to Dk4Q infrastructure, automatically loads Google Fonts, Font Awesome through jsDelivr, and the Ko-fi widget, and may load host avatars from an external HTTPS image provider if one is configured. Those services necessarily receive requests from your browser. The details are below.

3. Information stored in your browser

The shifts site uses browser Local Storage for a small number of user preferences. Local Storage is browser storage similar in effect to a persistent preference file; it is not the same thing as a server-side account.

These values normally remain in that browser until you change or clear the relevant setting, clear site data, use a reset/clear control where available, or the browser removes the storage. The current shifts-page code does not use Local Storage to save your selected host/day/time/visibility filters, past-shift date filters, pagination choice, or page view mode.

The current page code does not use Session Storage or IndexedDB for these preferences, and it does not set its own analytics or advertising cookies. A third-party service loaded by the page may use its own cookies or similar technologies under its own rules, as described below.

4. Local timezone, filters, and availability

The page asks the browser for its configured time-zone identifier using the browser's built-in internationalisation features. For example, a browser might report a time-zone name such as Europe/London or Asia/Singapore. The page uses that value locally to label and format shift times. The current shifts-page code does not send that browser-reported time-zone value to the Dk4Q shift API.

Availability times, shift filters, past-shift date ranges, sorting, pagination, and other viewing choices are applied locally to data already present in the page. Changing those controls does not create a form submission to Dk4Q. Some choices are kept only in page memory and disappear when the page is reloaded; the Local Storage exceptions are listed in Section 3.

Third parties loaded on the page may independently receive or infer technical information such as a time-zone or approximate location under their own privacy practices. That is separate from the shifts site's own local time-zone display.

5. Live shift data and automatic refresh

The shifts site is designed to stay current while it is open, so it makes repeated requests for schedule data. The current page requests:

When the page is visible, the shift and host data are currently refreshed roughly once per minute. When the page is hidden, the code is designed to reduce that to roughly once every three minutes, subject to browser timer suspension and page-lifecycle behaviour. When you return to a stale page, it may refresh promptly. The separate version file is checked roughly once per minute while the page is visible.

These repeated requests are for keeping the schedule and page version current; they are not Dk4Q analytics events. However, every request can appear in ordinary server, CDN, proxy, firewall, or security logs as described in Section 6.

6. Web requests and server/security logs

Every website needs technical information in order to send a page or API response back to your device. When your browser requests the shifts page, shift API data, host data, donor data, images, or other files from Dk4Q-controlled domains, the hosting, CDN, proxy, and security infrastructure handling those requests receives the network request.

Depending on the configuration of the service handling a request, standard access or security logs may include:

Dk4Q does not use these logs to reconstruct your local filter choices, build advertising profiles, or track you across unrelated websites. Logs may be used for security, abuse prevention, troubleshooting, reliability, capacity planning, and investigating technical problems.

The exact fields and retention periods of infrastructure logs can depend on the hosting, CDN, proxy, or security provider in use. We do not describe IP addresses as "masked" or promise a fixed log-retention period unless that is actually guaranteed by the relevant infrastructure configuration.

7. Dk4Q data and content services

The page requests data and media from several Dk4Q-controlled origins:

The page also uses browser preconnect hints for some Dk4Q and font-service origins. On browsers that support them, a preconnect hint can cause an early network connection to an origin before the later file or API request is made.

The Robux donation-option list is currently requested only when you open that donation section. The donor-board data behaves differently: the Ko-fi donor board is loaded when the donor-board component starts, and the Robux donor data is also loaded to build its preview.

8. Theme editor and clipboard

The shifts site includes a theme editor. Theme settings are stored in Local Storage as described in Section 3. Unlike the recipe site's URL-based theme-sharing feature, the current shifts site copies and pastes theme JSON through the clipboard.

Because "Paste Theme" reads the current text clipboard when you invoke it, unrelated clipboard text may briefly be read by the page code if it happens to be on your clipboard at that moment. The current shifts-page code does not send copied or pasted theme text to Dk4Q, the shift API, or an analytics service.

9. Ko-fi donation widget

Ko-fi is the most significant third-party integration on the shifts page, so it is explained separately.

The Ko-fi widget currently loads automatically. After the page has loaded, the site schedules a request for Ko-fi's floating donation-widget script from storage.ko-fi.com. You do not have to press the Donate button before that first connection to Ko-fi happens. The Ko-fi-controlled script may then make additional requests needed to render or operate the widget.

This means Ko-fi or the infrastructure serving its widget receives a direct network request from your browser. Ko-fi's current Privacy Policy says its Technical Data can include IP address, browser type and version, time-zone setting and location, browser plug-in information, operating system/platform, device ID, and information about how Ko-fi is used. Ko-fi also describes its use of cookies and similar technologies. The exact cookies, identifiers, or follow-on requests used by the embedded widget may vary over time, browser, region, and Ko-fi's own implementation, so we do not claim that every category in Ko-fi's policy is used on every visit.

If you choose to support Dk4Q through Ko-fi, additional information is involved. Ko-fi says creators receive a supporter's chosen display name and email address, and may receive a support message. Its help documentation also explains that connected payment providers can expose further normal merchant/transaction information to the creator: PayPal may show a supporter's legal name and email address, while Stripe may make a legal name, email address, card-linked address information, and other payment information available to the connected Stripe account.

Dk4Q does not receive your full payment-card number through the shifts webpage itself. Ko-fi, PayPal, Stripe, and any other payment option presented by Ko-fi handle their parts of a transaction under their own terms and privacy notices. Ko-fi also states that creators are responsible for how supporter information made available to them is used.

Ko-fi's current Terms state that a person must be at least 18 years old to register as a Supporter or use the Ko-fi platform. If you are under 18, do not use the Ko-fi donation feature.

For more information, see Ko-fi's Privacy Policy, Ko-fi's Terms, Ko-fi's supporter-information help page, PayPal's privacy information, and Stripe's Privacy Policy.

10. Robux donation options and donor boards

The shifts page contains Robux donation links and public donor-board features. The page itself does not ask for your Roblox password or payment-card details.

A donor entry can show a display name or handle, an associated platform such as Roblox, Discord, or Ko-fi, an amount, a ranking, and an optional avatar. Information that may be visible to Dk4Q through Ko-fi, PayPal, Stripe, Roblox, or another transaction system, such as an email address, legal name, billing address, or payment-account details, is not automatically published on the donor boards merely because a donation occurred.

If a public donor entry refers to you and you would like it corrected, anonymised, or removed, contact us using Section 19. Removing something from a public board does not necessarily require deletion of separate transaction, accounting, security, fraud-prevention, refund, or dispute records that still need to be kept.

11. Fonts, icons, images, and other third-party assets

The shifts page automatically uses some externally hosted visual resources:

12. Roblox, Discord, the status page, and other external links

The shifts site links to the Koháu Roblox experience, Roblox user profiles, the Koháu Discord server, Dk4Q's status page, Dk4Q contact pages, donation destinations, and other external pages. These are not visitor-account integrations: the shifts page does not read your Roblox or Discord login cookies, passwords, private messages, friends list, or account history.

When you choose to open another service, that service receives the visit and handles it under its own privacy and security rules. Depending on the link, browser configuration, and destination, the destination may receive normal request information such as your IP address, browser headers, and referrer information.

You can review Roblox's Privacy and Cookie Policy and Discord's Privacy Policy.

13. Host, shift-history, and public recognition information

The purpose of the shifts site requires it to process and display information connected with people who host, update, or support shifts. This can be personal information even though it relates to public-facing Roblox or Discord identities.

The current host directory is designed to handle fields such as a Roblox username or display name, nickname, rank and rank abbreviation, avatar URL, Roblox profile URL, old or incorrect username aliases, and Discord user IDs used to resolve Discord-style host references. Some fields may be downloaded to the browser for matching even when they are not printed visibly on the page.

Shift records can include scheduled start/end times, host assignments, prior and updated host assignments, manual or bot-generated update states, update notes or update types, and information indicating whether or when an associated Discord activity/shift post was seen. Past shifts can remain visible as schedule history.

Donor-board information is described separately in Section 10. If a host, shift-history, or public-recognition entry refers to you and is inaccurate, unnecessarily identifying, or should be reviewed for removal, contact us using Section 19. We will review requests in light of the site's schedule/history purpose, the source and accuracy of the record, applicable privacy rights, and any legal, security, accounting, dispute, or recordkeeping need that may require some information to remain.

14. Children and younger visitors

This is a Roblox-related fan site, so we recognise that children and teenagers may visit it. Ordinary shift browsing does not ask visitors for their age, real name, email address, phone number, Roblox login, or Discord login.

We do not knowingly ask children under 13 to submit personal information directly to Dk4Q through the shifts page. The site's schedule, host, and donor datasets may refer to public-facing Roblox or Discord identities. If you are a parent or guardian and believe that a child's personal information has been provided directly to Dk4Q or is unnecessarily included in a public dataset or board, contact us so we can review it and take the action required by applicable law.

The Ko-fi donation service is separate from ordinary shifts browsing and, as explained in Section 9, Ko-fi's current Terms require users of the platform to be at least 18 years old.

15. Your privacy rights

Privacy rights depend on where you live, what information is involved, and whether a particular law applies to this site or activity. Depending on those circumstances, laws such as the EU GDPR, UK GDPR, California privacy law, or other national or state privacy laws may give you rights over personal information Dk4Q controls.

Where applicable, those rights can include asking for access to personal information, correcting inaccurate information, requesting deletion, restricting or objecting to certain uses, receiving portable data, withdrawing consent where processing is based on consent, opting out of a sale or legally defined sharing where relevant, and complaining to a privacy regulator.

Some privacy laws apply only to organisations that meet particular location, business, revenue, or data-processing thresholds. We do not claim that every privacy law applies to this fan site, and we do not claim that a law is irrelevant simply because visitors do not have accounts.

Dk4Q does not currently sell ordinary shifts-site visitor data or use it for cross-context behavioural advertising. If the site's practices change in a way that creates a legally required opt-out or consent mechanism, the site and this policy should be updated accordingly.

16. Lawful bases, third parties, and international processing

If EU or UK data-protection law applies to a particular Dk4Q-controlled activity, Dk4Q is responsible for personal data where Dk4Q decides why and how that data is used. Examples include Dk4Q infrastructure logs, host/shift records maintained by Dk4Q, and public donor-recognition information maintained by Dk4Q. Ko-fi, Google, jsDelivr, Roblox, Discord, PayPal, Stripe, external avatar hosts, and other third parties are separately responsible for processing they control.

For Dk4Q's own processing, purposes are limited to operating and securing the site, keeping schedule information current, presenting host and shift history, responding to requests, maintaining public recognition records, troubleshooting, preventing abuse, and meeting legal, accounting, or dispute-related obligations where they apply. Where a privacy law requires a lawful basis, the basis must match the particular activity. Examples include legitimate interests in operating and securing the service or maintaining an accurate schedule, consent or permission where appropriate, and compliance with a legal obligation where required.

Web infrastructure and third-party services can process network or account information in countries other than the country where you are located. The relevant provider's privacy notice explains the international-transfer mechanisms and safeguards it uses for information it controls.

The shifts page does not make solely automated decisions about ordinary visitors that produce legal or similarly significant effects. Its automated sorting, filtering, countdowns, and schedule-status logic are display functions.

17. How long information is kept

18. Security and practical privacy choices

We take reasonable steps to limit access to information Dk4Q controls and to use it only for the purposes described above. No website, API, hosting provider, CDN, third-party widget, or payment service can guarantee perfect security, so this policy does not make that promise.

You can remove the shifts site's saved Local Storage by using the site's relevant reset/clear controls or by clearing site data in your browser. You can avoid using the theme-paste function if you do not want the page to request access to clipboard text. Browser privacy tools can also block third-party requests, although blocking Google Fonts, jsDelivr, Ko-fi, external avatar hosts, or other required resources may change how the page looks or works.

You can contact us about a host, shift-history, donor, or other public entry that refers to you. You can also choose not to follow external donation, Roblox, Discord, or other third-party links.

19. Contact

If you have a privacy question, want to exercise a right that applies to you, or want a host/shift/donor/public entry corrected or reviewed for removal, contact:

20. Changes to this policy

We update this policy when the shifts site's features, integrations, data sources, storage, or data practices change. If a change materially affects what visitors or people named in site data should know, the effective date above should be updated as well.