Legal
Privacy Policy
What Trace collects, why, who it is shared with, and your rights.
This policy explains what Trace collects when you use the Trace website, dashboard and scanner, why, who it is shared with, and the rights you have over it.
What we collect
When you create an account
- Email and password: your email address, an optional name, and your password stored only as a secure one-way hash. We can never read your password.
- Google sign-in: your Google account ID, email, whether Google verified it, your name and profile picture.
- Discord sign-in: your Discord user ID, username and avatar. Never your email, servers or messages.
- Account activity: when the account was created and last signed in, your role, and the licences linked to it.
When you buy a licence
- Your plan, billing term, seats, licence key, the email you gave at checkout and Stripe's reference IDs for the purchase and subscription.
- Card details are entered on Stripe's own page and never reach Trace.
When a player runs the scanner
The scanner reads only:
- Names, paths and hashes of resources loaded by FiveM
- Hashes of FiveM and CitizenFX client files
- Process names and module lists for processes attached to FiveM
- Game build number and scanner version
- Windows execution records for the scanned session (Prefetch and Amcache), to show when a flagged binary ran
It never touches:
- Browser data, cookies and saved passwords
- Your documents, downloads and any file outside FiveM and the execution records above
- Screen, webcam, microphone and clipboard
- Keystrokes and the memory of unrelated programs
- Network traffic other than one upload of the finished report
When you visit the site
- Our servers log requests, including your IP address, to keep the service running and secure. Your IP is also used briefly to slow down repeated failed sign-ins.
- We count visits to the website ourselves, without cookies and without any third party: the page, the site that linked you, the country Cloudflare reports, and your device and browser type. Your IP address is not stored for this; it's combined with your browser and the date into a code that changes every day, so a visit is counted once without us being able to recognise you later. These records are deleted after 13 months.
- If you choose Accept all in the cookie banner, the page also reports how long it was open and how far you scrolled. Nothing is stored on your device for this, and it stops if you choose Necessary only.
- When you sign in or create an account we record the time, the method (email, Google or Discord) and your country, to keep sign-in secure and to understand how Trace is used.
- The cookies we set are listed in the Cookie Policy.
Why we use it
- To run your account and licences: signing you in, showing your licences, and stopping licence sharing and fraud.
- To produce scan reports for the server that asked the player to run the scanner.
- To take payments and keep the records accounting law requires.
- To keep Trace secure: detecting abuse, preventing fraud and investigating misuse.
We don't sell personal data, and we don't use it for advertising.
Scan reports and server owners
A scan report belongs to the server whose staff requested it. That server's owner decides why players are scanned and what happens with the report; Trace processes the report on their behalf.
| Report contents | Flagged artifacts, hashes and timestamps. No screenshots and no file contents. |
|---|---|
| Retention | 30 days to one year depending on plan, then deleted. |
| Deletion | A server owner can delete any report at any time. Players ask the server owner. |
| Access | Only staff holding the viewer role on that server. Every view is logged. |
| Transport and storage | TLS 1.2 or newer in transit, encrypted at rest. |
| Scanner binary | Code-signed, SHA-256 published in the docs. Runs for seconds, exits, leaves nothing installed. |
Players who want a report removed should ask the owner of the server that scanned them.
Who we share it with
Only the services needed to run Trace, each for its own part:
- Stripe processes payments.
- Google and Discord, if you choose to sign in with them.
- Our hosting and network providers, including Cloudflare, which carry the site's traffic.
- jsDelivr, a content network that serves an animation library the site loads. Your browser connects to it directly.
We may also disclose data when the law requires it.
How long we keep it
- Accounts: until you delete yours (Settings → Delete account) or we close it. Licences stay valid and can be linked to a new account.
- Scan reports: 30 days to one year depending on the plan, then deleted.
- Purchase records: as long as tax and accounting law requires.
Security
Traffic is encrypted with TLS 1.2 or newer, data is encrypted at rest, passwords are stored only as hashes, and forms are protected against cross-site request forgery. Only staff with the viewer role on a server can open its reports, and every view is logged.
Your rights
You can ask to access, correct, export or delete your personal data, or object to how it is used. Most of this you can do yourself in Settings; for anything else, contact us. If you think we've handled your data wrongly, you can also complain to your local data protection authority.
Children
Trace accounts are for server owners and staff, not children. If you believe a child has created an account, contact us and we'll remove it.
Changes
We'll update this page when what we collect or why changes. The date at the top shows the latest version.
Contact
Questions about this document go to Trace in our Discord.