Privacy policy

1. Data controller

The data controller is the publisher of the site, identified in the legal notice. For any question or request about your data: gta6universeofficial.media@gmail.com.

2. Data processed, purposes and legal bases

Browsing the site, without an account. To serve pages, the host (Vercel) and the data provider (Supabase) receive the technical information of each request: IP address, browser, requested page, date and time. It is used to provide the site and protect it from abuse, on the basis of the publisher’s legitimate interest (GDPR article 6(1)(f)), and is kept only in these providers’ technical logs, for a limited time.

Audience measurement. Vercel Web Analytics and Vercel Speed Insights measure traffic and site speed: page viewed, referring site, country, device and browser type, performance metrics. No cookie is set; a visit is recognised by a fingerprint computed from the request and deleted after 24 hours, and statistics are only viewed in aggregate. Legal basis: legitimate interest in understanding how the site is used. You can object at any time from the cookie policy; your browser’s Global Privacy Control signal is honoured.

Storage on your device. Your language, found secrets, notes and map filters are saved in your browser, without an account. They stay on your device, and you can erase them by clearing the site’s data in your browser.

YouTube videos. Some map entries offer a video hosted by YouTube. Nothing is loaded from YouTube until you click “Play the video”: the thumbnail shown before that click is fetched by the site and served from its own domain, so your browser does not contact YouTube to display it. The player is then served from youtube-nocookie.com (privacy-enhanced mode) by Google Ireland Limited, which receives your IP address and your browser’s technical information, and may store data in it during playback. Google acts as a separate controller, under its own privacy policy. Legal basis: your consent, given by starting the video; to avoid it, simply do not start it.

User account (optional). Email address, username, site language at sign-up (to write to you in that language), password (stored encrypted, never readable), progress, personal notes, annotations drawn on the map, creation and sign-in dates; for administrators, a second authentication factor. Purpose: creating and running your account, and sending the necessary emails (sign-up confirmation, password reset). Legal basis: performance of the terms of use you accept (GDPR article 6(1)(b)). No newsletter or marketing is sent.

Login with Google or Discord (optional). If you choose “Continue with Google” or “Continue with Discord”, that service authenticates you, then sends the site your account identifier on that service, your email address (with whether it has verified it), your display name and the address of your profile picture. This information is stored with your account by the authentication provider (Supabase); the site neither displays nor uses that name or picture: your username is the one you choose. An address verified by that service and already used by an account on the site is attached to that account instead of creating a second one; an unverified address is refused. No other data from these accounts is requested (no contacts, messages or servers). Purpose: logging you in, creating or finding your account. Legal basis: performance of the terms of use (GDPR article 6(1)(b)). Google Ireland Limited and Discord Inc. process the login to their service as separate controllers, under their own policies: Google, Discord.

Security. To limit abuse, the site counts actions per account or per IP address over short periods; these counters are deleted after one day. When this protection is enabled, the sign-in and sign-up forms use Cloudflare Turnstile, which analyses technical browser signals to tell humans from bots. Legal basis: legitimate interest in securing the site.

Advertising. The site shows no ads today. Before it does, this policy will be updated to name the ad network and its partners, and no advertising cookie will be set without your prior consent.

3. Recipients and processors

Your data is never sold or rented. It is only accessible to the publisher and to the technical providers acting on its behalf, bound by a processing agreement compliant with GDPR article 28:

• Vercel Inc. (United States): site hosting, audience and performance measurement;
• Supabase, Inc. (United States): database, authentication and image storage;
• Sendinblue SAS — Brevo (France): sending account emails (sign-up confirmation, password reset, verification code); receives your email address and the content of these messages, whose delivery it tracks (see below);
• Cloudflare, Inc. (United States): bot protection on account forms, when enabled.

Brevo adds an invisible image to these emails and routes their links through a redirect before they reach the site: it can thus tell that a message was opened or a link followed. This information is only used to check that the site’s emails are delivered: no audience measurement, no profiling, no marketing. To keep opening from being recorded, turn off automatic image loading in your email app.

Google Ireland Limited (YouTube) is not a processor of the site: it only receives data if you start a YouTube video, as a separate controller (see above).

Neither are Google and Discord Inc.: they are only involved if you choose to log in with their service, as separate controllers (see above).

It may also be disclosed to an authority that requests it within the framework provided by law.

4. Transfers outside the European Union

Brevo is based in France. The other providers are based in the United States. Transfers rely on the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for certified companies, including Vercel and Cloudflare, and on the European Commission’s standard contractual clauses for Supabase. Data received by YouTube when a video is started may be transferred to Google LLC (United States), which is also certified.

5. Retention periods

• Account, progress, notes and annotations: as long as the account exists. Deleting it, from the My account page, erases them immediately and permanently.
• Identifier, email address, name and picture address sent by Google or Discord: as long as the account exists; erased with it. An account created with one of these services confirms its deletion by logging in again with it.
• Audience measurement visit fingerprint: 24 hours. Aggregated statistics: Vercel’s retention period, with no link to any person.
• Brevo’s email delivery records (sent, opened, clicked): retention period set by Brevo.
• Anti-abuse counters: one day.
• Providers’ technical logs: a limited period set by each provider, for security purposes.
• Data stored in your browser: until you erase it.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, the right to object to processing based on legitimate interest, and the right to set instructions for what happens to your data after your death. Several can be exercised directly on the site: changing your username or password, exporting your progress and notes, deleting your account, refusing audience measurement.

For other requests, write to gta6universeofficial.media@gmail.com. You will receive an answer within one month; proof of identity may be requested in case of reasonable doubt.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr) or with the data protection authority of your country of residence.

7. Minors

Accounts are for people aged 15 and over; under 15, opening one requires the consent of the holder(s) of parental authority (article 45 of the French Data Protection Act). A parent who finds that an account was created without this consent can ask for its deletion at gta6universeofficial.media@gmail.com.

8. Security

The site is served over HTTPS only. Passwords are encrypted by the authentication provider and never readable by the publisher; administrative access requires two-factor authentication; each account can only read and change its own data, a rule enforced by the database itself.

9. Automated decisions

No decision producing legal effects concerning you is based solely on automated processing, and no profiling takes place.

10. Changes to this policy

This policy is updated whenever processing changes (new provider, advertising, new feature). The date of the last update is shown at the top of the page.