Privacy Policy
What A.P.O.C collects when you play, sign in, trade or buy, why we collect it, how long we keep it, who else handles it, and how to get a copy of it or have it deleted.
Who we are
A.P.O.C is a FiveM game server for GTA V, run by its owner and a volunteer staff team. This policy covers the game server, the website at playapoc.xyz, the official A.P.O.C Discord server and its bot, and the A.P.O.C store. The A.P.O.C owner decides how your data is used here (the "controller", in GDPR terms). You can reach us at [email protected].
Cfx.re (for FiveM and your Cfx.re account), Discord and Tebex each handle your data under their own privacy policies as well. We link to them below.
What we collect
When you play
- Game identifiers. Your Cfx.re license (the ID FiveM gives your game account), your Discord ID if Discord is running when you connect, your FiveM display name and, for store purchases, your Cfx.re account ID. We don't read or store your IP address, hardware identifiers, Steam ID or Xbox ID. Staff tools can show your Steam and Cfx.re IDs while you're online, but those aren't saved.
- Your survivor. The character you create (name, in-game date of birth, appearance, background and answers in the creator) and everything that happens to it in the game: position, inventory, skills, stats, standing, vehicles, bases, journal, squad, scrip and Exchange wallet, play time, and when you were last seen. When a survivor dies for good or ends in a Last Stand, their file goes to the archive.
- Game activity records. Deaths and kills (who, what weapon, where), item and scrip transfers between players, combat logging, and Exchange listings, bids, buy orders, trades and sales. These exist so staff can investigate cheating, duping, griefing and real-money trading.
- Chat. In-game text chat isn't stored in our database. Messages appear in the server's console log, with the channel, your character name and your FiveM name. In-game voice chat is live only. It is never recorded or stored.
- Photos. Photos you take with the in-game camera are saved with the in-game place and time, your character name, the survivors in the frame and any caption you add.
- Questions to in-game terminals. Questions typed into the CANTOR terminal are saved with your character name.
- Reports and moderation. If you report a player in game, your report, your position and a screenshot of your screen at that moment are saved for staff. Staff can also view a live screenshot of a player's screen during an investigation. Those aren't saved. Warnings, bans (with your license, Discord ID and FiveM name) and staff actions are recorded.
- Anticheat. When the anticheat detects something, it records which check fired, your character and FiveM name, your license and the details of the detection. It doesn't take screenshots.
When you use this website
- Signing in with Discord. We ask Discord for the
identifypermission only. That gives us your Discord ID, username or display name, and avatar. It never includes your email address, your servers, your friends or your messages. Discord's access token is used once and then revoked. We store a session record: a hash of your sign-in cookie, your Discord ID, name and avatar reference, and when the session started and was last used. - Linking. When you connect to the game with the Discord app open, or use a link code, we record which Discord account belongs to which game license, with your Discord name and server roles. That's how the site shows you your own survivor and nobody else's.
- Exchange trades from the site are recorded like in-game trades, marked as made on the web by your Discord account.
- Technical data. Your IP address passes through the site to the game server so we can rate-limit abuse. It's held in memory only and never written to our database. Cloudflare tells us which country a request came from. We use that only in security alerts for the staff admin panel. If someone signs in to the admin panel, the owner gets an alert that includes the IP address and country of that sign-in.
- The Support page doesn't send anything. It builds a ticket in your browser for you to paste into the Discord.
- Cookies and local storage. Only what's needed to keep you signed in, plus a few display settings. The Cookie Policy lists every one.
When you buy from the store
- Tebex runs the checkout and collects your payment details, billing information and email. We never see your card details.
- From Tebex's purchase notifications, we keep the transaction ID, the package and quantity you bought, and the Cfx.re account ID you logged in with on the store. That's how a purchase finds your game account. We don't store your name, email, price paid or country from Tebex.
- We also keep what each purchase unlocked, gift codes (who bought one and who redeemed it), your credits name and whether it's shown, squad emblems you upload (with who uploaded and reviewed them), and a log of every grant, use, refund and chargeback.
On the Discord
- Discord itself processes everything you do there, under Discord's privacy policy.
- Our bot runs help-desk tickets. When a ticket closes, a transcript is posted to a staff-only log channel and sent to you by DM.
- For moderation, the bot logs deleted and edited messages, including what they said, to a staff-only channel.
- The bot keeps the roles you pick (including the optional age-group role) and a log of questions asked to CANTOR in the Discord.
- The game posts some events to the Discord: joins and leaves (with your FiveM and character name), deaths and kills, fallen survivors, boss kills, and, in staff-only channels, reports, staff actions and anticheat alerts. None of those posts include IP addresses.
What other people can see
- Leaderboards and the Hall of the Fallen show character names, never FiveM names, licenses or Discord IDs. Only established survivors appear (level 5 or higher with at least two hours played), and staff and test characters never do.
- The live map never shows any player. Survivor numbers are counted in one-kilometer squares, only where at least three survivors are, from a sample that is always 10 to 20 minutes old.
- Squads. Public squads show their roster as online or away, never an exact last-seen time. Private squads never appear anywhere on the site.
- The Exchange shows seller and buy-order names, as the terminals do in game. Bidders and buyers are never named.
- Photos appear on the website or in the Discord only if you turned on posting your best photos and everyone else in the frame has it on too. A photo leaves the site within five minutes of anyone in it turning that off. Photos already posted in the Discord stay there unless staff remove them.
- Credits names and squad emblems appear only after staff approve them. You can hide your credits name at any time.
Why, and our legal bases
If you're in the EU, the UK or somewhere with similar laws, we have to tell you the legal reason for each use.
| What we do | Legal basis |
|---|---|
| Run the game and your survivor, sign you in, link your accounts, run the Exchange, and deliver what you buy | Performing our agreement with you (the Terms) |
| Anticheat, moderation, reports, bans, activity records, rate limits and security alerts | Legitimate interests: keeping the game fair and the service secure |
| Leaderboards, the Hall of the Fallen, public squads and the Exchange board | Legitimate interests: the shared, public world is part of the game, limited to character names |
| Posting your photos publicly, showing your credits name, and the optional Discord roles | Your consent, which you can withdraw at any time |
| Purchase, refund and chargeback records | Performing our agreement with you, and our legitimate interest in resolving payment disputes |
| Answering lawful requests from authorities | Legal obligation |
Where we rely on legitimate interests, you can object, as described under Your rights.
How long we keep it
| Data | How long |
|---|---|
| Website sign-in sessions | 30 days at most, or 14 days unused, then deleted automatically. Signing out deletes the session straight away. |
| An unfinished sign-in | 10 minutes |
| Deaths, kills, item and scrip transfers, combat logs | 30 days |
| Player reports, with their screenshot | Until resolved, then 30 days |
| Questions to the in-game CANTOR terminal | 30 days |
| Exchange trades, sales and their audit trail | About 6 months (183 days) |
| Staff actions and anticheat detections | 1 year |
| Photos | While a print of it exists in the game. A photo nobody holds is deleted after 14 days. Tearing up the last print deletes the image. A record that it existed is kept for staff. |
| Bans and warnings | For as long as they apply, and afterward as a record so staff can recognize repeat offenses |
| Your survivor, archived survivors, account links and store purchases | For as long as your account exists, or until you ask us to delete them (see Your rights). Purchase records may be kept longer where needed to handle refunds and disputes. |
| Server console logs (including chat) | Only as long as needed for moderation and security |
| Database backups | 14 days on the server, and 30 days in an offline copy |
A season reset clears the world, not your survivor, so character data carries over between seasons.
International transfers
Our providers run servers in the United States and other countries, so your data may be processed outside the country where you live, including outside the EU and the UK. Where the law requires it, these transfers rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
Security
The website talks to the game only through its own server, over an encrypted tunnel, using a secret your browser never sees. Sign-in cookies can't be read by scripts and only travel over HTTPS. The server stores only a hash of them, and every action that changes something needs a separate security token. The admin panel has its own locked-down session with two-factor sign-in. No system is perfectly secure, though. If you find a problem, please tell us privately (see Reporting a security problem).
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that's wrong;
- delete your data;
- restrict or object to how we use it, including anything based on legitimate interests;
- take it with you in a portable format;
- withdraw consent at any time, for example by turning off photo posting in the game or hiding your credits name;
- complain to your data protection authority.
How to ask. Email [email protected] or open a private ticket in #help-desk on the Discord. We'll need to confirm the account is yours, usually through the Discord account linked to it. We answer within 30 days. If a request is complicated, we'll tell you if we need longer.
Deletion. When we delete your account, we remove your survivor and archive, account links, sessions, photos, credits name and the rest of your game data. Some records are kept where we have a good reason: a ban record, so a ban can't be dodged by asking for deletion; purchase records needed to handle refunds and chargebacks; and short-lived security and moderation records until they expire on their normal schedule. Backups roll over within 30 days. Data you posted in the Discord is also controlled by Discord, and you can delete your own messages there.
Signing out from your survivor file ends a website session immediately, and Sign out everywhere ends every session for your Discord account.
Children
A.P.O.C is for adults. You must be 18 or older to play, sign in or buy, and nothing here is meant for children. If we learn that someone under 18 is using A.P.O.C, we remove their access and delete their data, apart from a record needed to keep them out. If you think a child has given us their data, contact us.
Changes
If we change what we collect or how we use it, we update this page and the date at the top. If the change is significant, we announce it in the Discord before it takes effect.
Contact
Questions or requests about your data: [email protected], or a private ticket in #help-desk on the Discord.