Privacy policy

GTA Debrief (gtadebrief.com) is an independent fan site run by Rafael Bueno, the controller of the personal data described here. For anything in this policy, write to rafael.zbueno@gmail.com.

• You can read everything without an account.
• Google Analytics runs only if you accept it in the cookie banner. Until then nothing from Google loads.
• We show no advertising, use no advertising cookies and do not sell or share your data.
• We do not run a newsletter or send marketing email.
• What you send through the submission and correction forms is stored in our database and read by our editors.

Our hosting provider, Vercel, receives the technical data every website receives to deliver a page: your IP address, browser and device type, the page you asked for and when. Vercel uses it to serve the site and protect it from abuse, and keeps it in short-lived logs. Our own code does not store IP addresses; see below for the one hashed exception when you send a form.

When you open a page we set one cookie, gtad_lang, which remembers the language you last read in so that gtadebrief.com/ opens in it. If you close the "also available in…" bar, your browser's local storage remembers that you did. Neither identifies you. We rely on our legitimate interest in running the site in the language you chose.

When you search, the words you type travel in the address of the results page. We do not store them, but like any page address they appear in Vercel's request logs and, if you accepted analytics, in the page address Google Analytics receives.

We use Google Analytics 4 to learn which pages help and which do not. It is controlled by Google Consent Mode: every signal is denied by default, and the Google Analytics script is not loaded at all until you press Accept.

When you accept, we grant analytics storage only. Advertising storage, advertising user data and ad personalisation stay denied. Google then sets its _ga, _ga_RFNVCF4PJ3 cookies and receives which pages you view and these events:

• page_view: a page was opened.
• outbound_server_click: you followed a link from a roleplay server profile (which server and which link).
• correction_sent: you sent a correction (which page). The text of your message is not sent.

The legal basis is your consent. You can withdraw it at any time with "Cookie settings" in the footer: we then tell Google that consent is withdrawn and delete the _ga, _ga_RFNVCF4PJ3 cookies from your browser. Your choice is stored in the gtad_consent cookie. Every cookie we use

The forms on the Submit and Corrections pages send what you type to our database:

• A roleplay server: its name, description, language, region, client, roleplay style, access type, minimum age, website and Discord links, and, if you give it, your email address.
• A creation: its title, the creator name and profile link, game, type, access and source link, and, if you give it, your email address.
• A correction: the page, your message, an optional link to evidence, the page language and, if you give it, your email address.

Submissions arrive as unpublished drafts that only our editors can see. An editor may publish the details of a server or creation after checking them; your email address is never published and is used only to follow up on your submission. The forms also carry a hidden field that stops automated spam; it collects nothing about you.

To stop one connection from flooding the forms, each submission records a salted one-way hash of your IP address and the form you used, never the address itself. The hash cannot be turned back into your IP address; it is kept for up to a day and then deleted. A correction is also linked to the guide, Intel entry, trophy, server, creation or briefing its page shows, so that record can show how many corrections are open.

We rely on your consent when you send a form, and on our legitimate interest in running an accurate directory and correcting our pages.

Only our editors have accounts, to manage content in the admin. We store their name, email address, role and languages, and a sign-in cookie keeps them logged in for two hours.

Each provider processes data on our behalf under its data processing terms, which include safeguards for transfers outside Brazil and the European Union. We do not sell personal data or share it with anyone for advertising.

• gtad_lang: one year from when it was set or last changed.
• gtad_consent: six months, then we ask again.
• _ga, _ga_RFNVCF4PJ3: up to two years in your browser, or until you withdraw consent. Google keeps analytics data for the retention period set in our Google Analytics property.
• Submissions and corrections: in our database until an editor deletes them. Ask us and we will delete yours.
• Hashed IP for rate limiting: up to one day.
• Request logs: kept by Vercel for its own short retention period.

Under Brazil's LGPD, the EU and UK GDPR and similar laws you can ask us to confirm whether we hold data about you, give you a copy, correct it, delete it, move it, stop or limit using it, and you can withdraw consent at any time. Write to rafael.zbueno@gmail.com; we answer within 15 days.

You can also complain to a data protection authority: in Brazil the ANPD (Autoridade Nacional de Proteção de Dados), in the EU or UK the authority where you live.

GTA Debrief is about games rated for adults and is not directed at children under 13. We do not knowingly collect their data. If you are under 18, ask a parent or guardian before you send us anything.

The site is served only over HTTPS. Submissions, corrections and email addresses are visible only to signed-in editors, and images attached to unpublished content are not available to the public.

When we change what we collect or who processes it, we update this page and its date first. We will ask again for consent if a change needs it.