Privacy Policy

Who We Are

GTAVIing ("we", "us", "our") operates gtaviing.online, an independent GTA 6 fan-intelligence platform: verified intel claims, interactive maps and dossiers, guides and PDF exports, the Money Board and its calculators, a Rep ladder with a public leaderboard, and The Fixer AI. GTAVIing is a fan project and is not affiliated with, endorsed by, or connected to Rockstar Games or Take-Two Interactive. For privacy inquiries: privacy@gtaviing.online.

Information We Collect

We collect the minimum needed to run the platform. Categories:

• Account data. Email address and a securely hashed password when you register, your chosen username, and (optionally) your country. Registration is optional; most of the site works without an account.
• Signing in with Google or Discord (optional). You can create or open your account with Google or Discord instead of a password. When you do, that provider tells us the email address on the account, the display name and profile picture on it, and a provider-specific account ID. We use the email address to create and identify your account, and the name and picture only to show you which account is signed in - we never see your password for those services, we cannot read your contacts, files, messages or any other content of those accounts, and we never post anything on your behalf. The sign-in exchange itself is handled by our authentication provider (see Third-Party Services).
• Public identity. Your username is public wherever Rep is shown, including the leaderboard and country lists; your country is public on those lists too. You can hide yourself from the public lists at any time in your Profile settings - your Rep keeps accruing privately. General account and preference data is never public.
• Bookmarks and preferences. Items you bookmark and the display preferences you save to your account, so they follow you across devices.
• Sign-in security log. Each time your account is created or signs in we record the time, the kind of event, the IP address and the browser's user-agent text. You can read this log yourself on your Profile; it exists so you can spot a sign-in that was not you.
• Rep, votes and badges. Your up/down votes on claims, the Rep your activity earns (visits, guide reads, dossier opens, votes, Fixer questions) and the achievement badges derived from your own usage, including a Kingpin account's founder number.
• Fixer AI usage. The queries you send to The Fixer AI and its replies (see Retention below), plus a per-account query counter used to enforce your plan's daily limits. A short wait-time record is kept in server memory only, to give paid plans their priority when the network is at capacity - it is never written to the database.
• Voice input. If you use the microphone, a short audio clip is sent to our AI provider for transcription (see Third-Party Services). We do not store the recording - only the transcribed text becomes part of the conversation, which is deleted after 24 hours.
• Image attachments. If you attach an image to a chat question, the image is sent to our AI provider to produce the answer. We do not store the attachment; it exists in memory for that request only.
• Correction reports. If you report a correction on a claim: the issue type and details you submit, the optional contact email you provide (used only to reply about your report), and technical data (IP address) for abuse prevention.
• Launch notifications. Your email address if you join the GTA VI launch-day notification list.
• Patrons page (opt-in). If you subscribe or donate and optionally give a display name, that name is published on the patrons page inside the next guide PDF. It is only ever published when you provide it; leave the field blank and nothing appears.
• Technical data. IP address and a random browser identifier used solely for rate limiting and fraud/abuse protection. Functional preferences (spoiler visibility, persona, accent/animation settings, checklist progress, easter-egg progress, whether you dismissed the countdown pill for the current tab session, and your saved-claims cache) are stored in your browser. See Cookies & Local Storage.
• Live presence. The homepage shows how many people are reading right now. To count it, each open browser tab makes a random marker that is kept in that tab's session storage and sent to us as a heartbeat roughly every 45 seconds while the tab is visible. The marker is not linked to your account, your email or your IP address, it is gone when you close the tab, and the server row behind it is deleted within 15 minutes of your last heartbeat. Hiding a tab or closing it stops the counting. See Cookies & Local Storage.
• Usage analytics. Aggregate page-view and traffic analytics from Google Analytics 4 and Vercel Analytics - timestamps, pages visited, referrer, approximate location derived from IP (city level), device/browser type, and a random client identifier. We do not use either service for advertising, and we do not run ad networks or sell data.
• Payment data. Cartel and Kingpin are sold through Link, Stripe's checkout service, which is the merchant of record for the purchase. To take the payment and work out the right tax, Link collects your name, email, card or other payment details, billing country and (where tax rules need it) billing address and phone number, and may offer to save them in a Link account for faster checkout next time. Donations are processed by Stripe directly. We never see or store your full card details. What we receive back is limited to what we need to run your plan: the Stripe customer and subscription identifiers, the plan, the billing period dates, whether the plan is set to cancel, and payment events such as a renewal, refund or dispute.
• Error reports. If the site crashes in your browser, it sends us the error message, the page path (never the query string or anything after a #), and the version of the site that was running, so we can fix it. Email addresses, tokens and keys are stripped from these reports before they are stored.

How We Use Your Information

• To create and manage your account, bookmarks and preferences, and to show you your own sign-in security log
• To compute and display the community pulse on each claim (aggregates only), your Rep and your badges, and the public leaderboard you can opt out of
• To enforce fair-use limits (guests: 1 Fixer query per day; free accounts: 5 per day; Cartel/Kingpin: unlimited) and to order the queue so paid plans are admitted first when the network is busy
• To run The Fixer AI - your query (and any image or voice clip you attach) is sent to our AI providers and grounded with web results from our search provider
• To process and respond to correction reports and support requests
• To give your account the plan you paid for, keep it in step with renewals, switches, cancellations and refunds, and process donations
• To find and fix errors the site hits in your browser
• To send service emails (account confirmations, billing notices, launch-day notifications you opted into)
• To measure aggregate traffic and usage so we know which pages and tools are worth building on
• To protect the platform and its users from abuse, spam, and vote or Rep manipulation

Third-Party Services

We use the following processors, each bound by its own privacy policy:

• Supabase - authentication, database, and storage. Privacy policy
• Groq - AI inference for Fixer replies and voice transcription. Privacy policy
• Google (Gemini) - AI inference, image understanding and audio transcription failover. Privacy policy
• Tavily - web search that grounds Fixer answers in sources. Privacy policy
• Resend - transactional and notification email delivery. Privacy policy
• Link (by Stripe) - merchant of record for Cartel and Kingpin: checkout, tax, receipts and payment support. Privacy policy
• Stripe - payment processing for donations, the billing portal and subscription records. Privacy policy
• Text-to-speech (ttsmp3.com, Google) - when you press read-aloud, the text being read is sent to a speech service to make the audio. Only that text is sent - never your account or email. If those services are unavailable your own device's voice is used instead.
• GitHub - runs our automated checks and keeps an encrypted nightly backup of the database for 14 days. The backup is encrypted before it leaves our systems and cannot be read without our key.
• Vercel - web hosting, serverless functions, and cookieless aggregate analytics. Privacy policy
• Google Analytics - aggregate traffic measurement (see Cookies & Local Storage for the cookies it sets and how to opt out). Privacy policy

Data Retention

• Account data: retained while your account is active. You can delete your account at any time; we delete your profile, bookmarks, security log and usage meter shortly after. Copies in the encrypted backups expire within 14 days.
• Billing records: the payment provider keeps transaction records for as long as tax and financial law requires. On our side, the plan and subscription identifiers stay on your account while it exists.
• Error reports: kept only as long as we need them to diagnose and fix the fault.
• Fixer AI conversations (Street and Cartel): older than 24 hours are permanently deleted by an automated job that runs nightly. After 24 hours we keep no record of what you asked The Fixer or what it replied.
• Fixer AI conversations (Kingpin): kept for as long as your Kingpin plan is active, so you can return to an old thread instead of starting again. If you leave Kingpin, those conversations fall back under the 24-hour rule and are deleted on the next nightly pass. You can delete any conversation yourself at any time, and leaving your account deleted removes them immediately.
• Voice clips and image attachments are never stored at all - only the text that comes out of them. That text follows the same rules as above.
• Priority queue data: held in server memory for the life of a request only.
• Votes & Rep: retained while the related claim or ladder entry is live, to keep the community pulse and Rep stable and auditable. Guest vote identifiers and IP-derived rate-limit data are rotated automatically (guest rate-limit rows are deleted after 30 days) and are not used to identify you.
• Correction reports: retained for a reasonable period (typically up to 12 months) so repeated or abusive reports can be identified; contact emails are used only to follow up on the report.
• Launch-list emails: retained until the launch notification is sent or you ask us to remove you, whichever comes first.
• Patrons page names: retained while the patrons ledger is live; ask us and we will remove your name from future guides.
• Analytics: retained by the analytics providers according to their own retention settings (Google Analytics is configured for the shortest available retention window).
• Live presence: a row is deleted within 15 minutes of that tab's last heartbeat, and the marker itself lives only in the tab that made it - closing the tab removes it. There is no presence history to retain.

Community Pulse & Content You Submit

Voting and reports are public in aggregate, and your username is public on the Rep ladder unless you opt out. The pulse you see on a claim (▲ up / ▼ down) is the sum of community votes - it is not a Rockstar or editorial verdict and never affects the claim's source-derived status. Do not include personal information about yourself or others in report details, chat messages, uploaded images or any content you submit.

Your Rights

Depending on your location you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any right, email privacy@gtaviing.online from the address on your account. We respond within 30 days.

Australian Privacy Act

GTAVIing complies with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). If you are in Australia and believe your privacy has been breached, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

GDPR / UK (EEA, UK & Switzerland Visitors)

Our legal bases for processing are: performance of a contract (account, bookmarks, subscriptions), legitimate interests (security, the sign-in log, rate limiting, abuse prevention, error reports, priority queueing, product improvement), and consent (launch notifications, optional contact details on reports, optional patrons-page name). Analytics is served by Google Analytics and Vercel Analytics; you can refuse or clear analytics cookies in your browser at any time without losing access to the site. You may lodge a complaint with your local supervisory authority.

US State Privacy (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information, and we do not run advertising cookies or cross-site advertising trackers. We do use aggregate analytics (Google Analytics and Vercel Analytics) as described in this policy, and you can block those cookies in your browser.

Cookies & Local Storage

The short version: no advertising cookies and no cross-site trackers. Analytics is off until you say otherwise - it starts denied, and the only thing that can turn it on is you pressing Accept on the note at the bottom of the site. Decline, or never answer, and the platform works exactly the same.

What we store, and why

• Keeping you signed in. If you tick "stay signed in", your session is kept in this browser so you are not asked for a password on every visit. If you do not tick it, the session lives only in the tab you are using and disappears when that tab closes.
• Remembering your settings. Your spoiler-visibility preference, Fixer persona, voice and answer-mode choices, display accents and animation level, your saved-claims cache, your own checklist, tool and easter-egg progress, whether you dismissed the install-the-app suggestion, and the record that you already answered the analytics question. All of it stays in this browser; none of it is sent anywhere. Your plan is never read from here - it is checked with our server every time.
• Keeping the site safe. A random, non-identifying browser marker is used to rate-limit abuse and spam. It is not linked to your name, email or account.
• Showing the live reader count. The homepage counter needs one thing in your browser: a random per-tab marker in session storage, so a reload is still one reader and a closed tab is forgotten. It is not a cookie, it is not shared with anyone, and it is never joined to your account. Blocked storage simply means you are not counted - the counter still appears, it just measures one tab fewer.
• Counting visits - only after you accept. Vercel Analytics is cookieless and anonymous: it counts page views without placing an identifier on your device. Google Analytics 4 runs in consent mode: while analytics is denied it sends a cookieless ping and sets no cookie, and only an Accept lets it set its own first-party cookies so visits can be counted properly. Advertising features and data sharing with Google's ad products are never enabled, and you can opt out at any time with Google's browser add-on or by blocking cookies for this site.
• Taking payments. Checkout happens on Link's and Stripe's own pages under their own privacy policies and cookies. We never see or store your card details.

Changing your mind is a browser action, not an email to us: clearing this site's data removes everything above, brings the analytics question back, and signs you out. The platform works with storage blocked - you simply lose the conveniences listed here.

If you want the itemised detail, two names are worth knowing: _ga / _ga_* (Google Analytics 4, set only after you accept) and gv_analytics_consent (our own record of your answer, kept in this browser).

Children

GTAVIing is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us personal data, contact privacy@gtaviing.online and we will delete it.

Changes to This Policy

We may update this Privacy Policy as the platform evolves. Material changes are emailed to registered users before they take effect. The "Last updated" date at the top reflects the most recent revision.

Contact

GTAVIing is operated by an individual trading as GTAVIing, based in New South Wales, Australia. That person is the data controller for the information described in this policy, and is who a privacy request, objection or complaint should be addressed to.

Privacy questions or requests: privacy@gtaviing.online. Support questions: support@gtaviing.online.