Legal · Version 0.2 · 28 Oct 2026
Privacy notice
What we collect when you use this site, why, how long we keep it, and what you can do about it.
Your account holds your Discord ID, username, display name and avatar, your nickname in the [MAD] Discord and whether you are in it, the site nickname you choose, your Cfx.re ID and username if you link it, the game IDs sent when you connect (Rockstar licence ID, Steam ID if Steam is running, IP address), and what you do here: your application, support tickets, forum posts and reports, poll votes and login sessions.
Who we are
[MAD] Roleplay is run by a private individual, who is the controller of the personal data described here. Contact: [email protected].
What we collect
From Discord, when you log in
We ask Discord for two things only:
- identify: your Discord user ID, username, display name and avatar.
- guilds.members.read: your nickname and roles in the [MAD] Discord server, so the site can match your roles.
We do not ask for your email address, and we cannot see your messages, your password or the other servers you are in.
From Cfx.re, if you link it
Your Cfx.re user ID and username, so the server can recognise you in the city and you can log in with Cfx.re. We ask Cfx.re for your session info only and delete the access key straight away.
From the game server
When you connect, the server checks your Cfx.re and Discord IDs with this site to see whether it is your turn in the queue. It also sends your Rockstar licence ID, your IP address and, if Steam is running, your Steam ID. The site keeps these on your account so staff can spot ban evasion and shared accounts, and a game account tied to a banned account is refused. If you play, the site reads your characters' names and achievements from the game, read only, and shows them to you. Staff also see your characters, play time, recent sessions and in-game staff notes on your account, to handle reports and appeals.
From Steam, when you link it
Your Steam ID, public profile name and, if your profile shows it, the date your account was made. Staff use these when they review applications and to spot shared accounts. You sign in on Steam, so we never see your password. You need a linked Steam account to join the city. You can unlink it on your account page, but you cannot join again until you link one.
What we record
- Staff decisions about you: application outcomes and reasons, warnings, suspensions and bans, and notes staff keep about you.
- A security and audit log: what was done, by which account, when, from which IP address and browser, and the IP address you last logged in or joined the queue from.
- Your cookie choice, with the date and the policy version.
Why, and on what basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Answering your emails | What you write to us, your email address and name | Legitimate interest, Art. 6(1)(f): replying to you; contract where it is about your account |
| Your account, the forum, polls, applications | Discord profile, what you post, your votes, your application | Contract, Art. 6(1)(b) |
| Moderation, ban records, preventing ban evasion | Sanctions, reasons, linked accounts | Legitimate interest, Art. 6(1)(f): keeping the community safe |
| Security and abuse prevention | Audit log, IP address, browser, Rockstar licence ID and Steam ID | Legitimate interest, Art. 6(1)(f): protecting accounts and the site |
| Embedded YouTube video | Loaded only after you agree | Consent, Art. 6(1)(a) |
| Visitor statistics (Cloudflare Web Analytics) | Cookieless, aggregated page views, referrer, browser type and load times | Legitimate interest, Art. 6(1)(f) |
We weighed our interests against yours for each legitimate interest above. You can object at any time, see your rights. A person reviews every sanction and every application, except early adopters' applications, which are accepted automatically. The one automatic refusal is at connect, when your game account is tied to an account staff banned; ask staff to review it if you think it is wrong.
How long we keep it
| Data | Kept |
|---|---|
| Account and profile | Until you delete your account, then 30 days |
| Applications | 12 months after the decision |
| Support tickets | 12 months after the ticket is closed, or until you delete your account |
| Support emails | 12 months after the conversation is closed |
| Forum posts | Until deleted, then 30 days. When you delete your account they stay, shown as "Deleted user" |
| Reports of forum posts | 12 months after staff handle them, or until you delete your account |
| Poll votes | Removed with your account; totals stay |
| Audit log | 12 months; IP addresses removed after 90 days |
| IP addresses from logins and game connects | 90 days |
| Rockstar licence ID and Steam ID | Until you delete your account |
| Staff notes | Until you delete your account |
| Ban records | Up to 2 years after the ban ends |
| Backups | 30 days, rolling |
Who else sees it
- Cloudflare (network, security, visitor statistics and receiving email) and Amazon Web Services (hosting the site and sending our email, EU region Frankfurt) process data for us under a data processing agreement.
- Discord handles the login and shows your avatar: the picture loads from Discord's image server, which sees the viewer's IP address. Discord is responsible for its own processing.
- Google / YouTube receives your IP address and can set cookies, but only once you choose to play an embedded video.
- Tebex, if we open a store, processes payments as the merchant of record.
We do not sell your data or share it with advertisers.
Outside the EU
Cloudflare, Amazon, Discord and Google are US companies. Transfers rely on the EU-US Data Privacy Framework, or on the European Commission's standard contractual clauses where a company is not certified.
Your rights
You can ask to see, correct, delete or restrict your data, to receive a copy (data portability), and object to processing based on legitimate interest. Withdraw consent at any time under "Cookie settings" in the footer.
On your account page you can download your data and delete your account yourself. For anything else, email [email protected]. We answer within one month.
If you are unhappy with how we handle your data, you can complain to the data protection authority where you live.
Minimum age
The site and the server are for people aged 18 and over. If we learn an account belongs to someone younger, we delete it.
Security
Logins go through Discord or Cfx.re, so we store no passwords. Connections are encrypted (HTTPS). Staff tools are limited by permission, and every staff action is logged.
Changes
When this notice changes we update the version and date at the top. If the change matters, we tell you on the site or on Discord first.