Privacy policy

Who handles your information

GTASpots is the independent fan project at gtaspots.com. It is operated by GTASpots. It is not Rockstar Games or Take-Two Interactive. Contact: [email protected]. You can send the team a data request using the form below.

What you choose to share

When you join the update list, we store your email address, a random referral code, an optional referring code, the time you joined and the version of the consent wording you accepted. Your email address is not made public. A referral code is not derived from your email.

When you submit a discovery, we store your public handle, chosen region, discovery category, description, optional evidence link, submission time and publication agreement. Submissions start in a private review queue. Only approved discoveries are displayed publicly. The information you write in a public handle or description can identify you, so please avoid sharing sensitive or private information.

A privacy request contains your email, request type, optional message and the time it was submitted. Do not include passwords, identification documents or payment information.

Why we process it

We use your update-list details on the basis of the consent you give to send GTASpots product and availability updates. You can withdraw that consent. Joining records your interest; it does not purchase access, guarantee a release date or send a confirmation email automatically.

We use discovery submissions to review and publish the contribution you requested under our community terms. We use privacy-request details to respond to your request and meet applicable data-protection duties. We process limited connection information for the legitimate purpose of preventing spam and keeping the service secure.

Security and service providers

The site is hosted on a DigitalOcean server in London, United Kingdom, and delivered through Cloudflare. These providers process network information such as IP addresses and connection details to deliver and protect the service, under their own service terms and privacy information. Network processing may take place in more than one country.

The application uses an irreversible keyed value derived from a connection address for short-lived rate limiting. Rate-limit records expire after at most an hour and are removed by routine cleanup. The application does not write form contents or raw connection addresses to its request logs. We do not sell your information or send submissions to ViceMap, Rockstar, advertisers or a third-party form service.

Cloudflare provides aggregate infrastructure and delivery measurements. If you allow visitor analytics, GTASpots records page paths without query strings, time, referring domain or campaign label, device category and random browser and session identifiers. The server stores keyed versions of these identifiers, not raw IP addresses, form contents or fingerprinting data. Browser identifiers last up to 30 days, a session restarts after 30 minutes without activity, and analytics records are retained for up to 90 days. Aggregate reports are available to the same owner through the protected CheatCode administration panel. Identities are kept separate between the two websites. Advertising cookies and Google Analytics are not enabled on GTASpots. You can withdraw analytics consent in Cookie settings; Do Not Track and Global Privacy Control are respected. Fonts are hosted on this website. Read our cookie policy for browser storage and security cookies.

How long information is kept

Update-list entries are retained for up to one year from signup unless removed earlier following a verified request. Pending and rejected discoveries are retained for up to 90 days. Approved public discoveries remain available until they are removed following review or a verified request. Privacy requests are retained for up to 90 days.

We keep up to seven rolling database backups on the hosting server, normally made daily. Information removed from the active database can remain in these restricted backups until they rotate out. Restoring a backup requires applying relevant deletion requests again. These limits describe our application storage; infrastructure providers apply their own retention rules to their service records.

Your choices and rights

Depending on applicable law, you may ask to access, correct, erase or restrict the use of your information, object to processing, request portability, or withdraw consent. We may need to confirm that you control the email address or contribution before disclosing or changing information. Sending a request records it for review; it does not immediately erase another person's data.

You can also raise a concern with the data-protection authority where you live. This site is intended for adults. Please do not submit information about children or other people without permission. Material changes to this policy will be reflected in the review date and, where needed, a new consent request.

Send a privacy request

Use the address you signed up with. For a discovery, include its reference or public handle so the team can locate it.

News, videos and local collections

The news feed retrieves public publisher material on our server. Reading a news cover does not connect your browser to its original publisher. Opening the original story connects you to that publisher. Pressing Play loads an optional YouTube player and shares connection and playback information with Google under its own privacy policy. Your intel collection is saved locally in this browser for up to 180 days; it is not uploaded to GTASpots. See the video and storage details.