How we collect, use, share and protect your information across the Rift Networks forums, Rift Arena and Rift Roleplay.
Rift Networks ("Rift Networks", "we", "us" or "our") operates an online Grand Theft Auto V community. This Privacy Policy explains what information we collect about you, how we use and share it, how long we keep it, and the rights and choices you have. It applies to all of the following (together, the "Services"):
The Services are provided to you subject to our community rules. By creating an account or using the Services you acknowledge that we process your information as described in this policy. If you do not agree with it, please do not use the Services.
This policy does not cover Discord, FiveM (Cfx.re), Rockstar Games, Steam or any other third-party platform you use to reach the Services. Those platforms have their own privacy policies, and we encourage you to read them (see section 14).
The Services are operated by the Rift Networks staff team, who together decide how and why your personal data is processed and are the "data controller" for the purposes of the EU and UK General Data Protection Regulation ("GDPR") and equivalent laws. Rift Networks is an independent, community-run project. It is not affiliated with, endorsed by or connected to Rockstar Games, Take-Two Interactive or Cfx.re.
You can reach the person responsible for privacy at Rift Networks using the details in section 16.
We collect information in three ways: information you give us directly, information generated automatically when you use the Services, and limited information we receive from the third-party platforms you connect to your account. The table below summarises each category.
| Category | What it includes | Source |
|---|---|---|
| Account data | Username, password (stored only as a salted bcrypt hash — we never store or see your plain-text password), account creation and last-login dates, rank or staff role, VIP status, and whether your account is whitelisted for Rift Roleplay. | You |
| Contact and security data | Your email address (required to create an account from 30 August 2026, optional for accounts created before then), which we confirm with a one-time code and use only for account security and recovery; your two-factor authentication secret and recovery codes if you enable 2FA; and hashed "remember this device" tokens with a device label and expiry date. | You |
| Linked platform identifiers | Your Discord user ID and username when you sign in with Discord or link Discord in-game (we request only the Discord identify scope — never your email, messages, friends or servers); your FiveM / Cfx.re licence identifier; and, on the legacy RAGE Multiplayer server, your Rockstar Social Club name. | You · Discord · Cfx.re · Rockstar |
| Technical and security identifiers | Your IP address, a hash of your IP address, a hash of your hardware identifier (legacy RAGE Multiplayer), a hash of your FiveM licence, your browser's user-agent string, and the date and time of connections and requests. Hashes are one-way and are used to recognise a returning connection without storing the underlying value on your account, ban or login records. | Automatic |
| Gameplay data | Statistics (kills, deaths, wins, losses, playtime, leaderboard position), character appearance and outfits, weapon loadouts and skins, inventory, owned vehicles and property, in-game position, daily-reward streaks, credit balance and credit transaction history. On Rift Roleplay this also includes the fictional details of each character you create (character name, date of birth, gender, nationality, backstory, job, in-game money and phone number) and the content of the in-game phone (messages, contacts, call history, notes, photos, videos, voice memos and in-game social-media posts). | You · Automatic |
| Content you post | Forum threads, posts, reactions, signatures, profile titles, avatar and banner images, the edit history of your posts, and in-game text chat, including private messages to other players. | You |
| Purchase data | When you buy credits we record the package purchased, the amount paid, the credits granted, the order status, timestamps and the Stripe checkout session reference. Your card number, expiry and security code are entered on Stripe's secure checkout page and never reach our servers. | You · Stripe |
| Logs and moderation records | Connection and disconnection logs, chat logs, command logs, kill logs, login-attempt records, username-change history, staff action logs, player reports you make or that are made about you, warnings, mutes, bans and ban appeals, and anti-cheat observations (measurements of in-game behaviour, the detector that produced them, and any resulting flag or action). | Automatic · Staff · Other players |
| Communications | Messages you send us through Discord tickets, forum threads, player reports or email, together with our responses. | You |
We use the information described above for the purposes listed below. Where the GDPR or a similar law applies, we also identify the legal basis we rely on for each purpose.
| Purpose | What we do | Legal basis |
|---|---|---|
| Providing the Services | Creating and maintaining your account, signing you in across the forums and game servers, saving your progression, characters, inventory and credits, displaying your profile and posts, and operating the store. | Performance of our contract with you |
| Account security | Verifying passwords and two-factor codes, recognising trusted devices, detecting unusual sign-in activity, rate-limiting abusive traffic and preventing account takeover. | Contract · Legitimate interests (keeping accounts and the platform secure) |
| Fair play and anti-cheat | Monitoring in-game behaviour for cheating, exploits and unfair advantages, investigating reports, and acting on confirmed violations. | Legitimate interests (protecting the integrity of the game for all players) |
| Moderation and rule enforcement | Reviewing content and chat, handling player reports, issuing warnings, mutes and bans, and preventing banned users from returning under new accounts. | Legitimate interests · Contract (our community rules) |
| Processing purchases | Creating orders, confirming payment with Stripe, crediting your account, handling refunds and disputes, and keeping the records we are legally required to keep. | Contract · Legal obligation (accounting and tax) |
| Communicating with you | Sending email verification codes and security notices, responding to your support requests and reports, and posting service announcements. We do not send marketing email. | Contract · Legitimate interests · Consent (where you add an optional email address) |
| Operating and improving the Services | Diagnosing errors, measuring player counts and server load, and planning capacity. We use aggregate figures only and do not build advertising profiles. | Legitimate interests (running a reliable service) |
| Legal compliance and protection | Complying with applicable law and lawful requests, enforcing our rules, and establishing, exercising or defending legal claims. | Legal obligation · Legitimate interests |
Where we rely on legitimate interests we have balanced those interests against your rights and freedoms, and we do not use your information in ways that would override them. You may object to processing based on legitimate interests as described in section 11. Where we rely on your consent you may withdraw it at any time, without affecting processing that took place before withdrawal.
We do not sell your personal information, share it with advertisers, or use it for targeted advertising.
The forums use a small number of cookies and similar technologies. We do not use advertising or third-party analytics cookies.
| Name | Purpose | Type | Duration |
|---|---|---|---|
| connect.sid | Keeps you signed in to the forums and store and protects your session. Set only when you sign in; marked HTTP-only so scripts cannot read it. | Strictly necessary (first party) | 7 days |
| rift_device | Set only if you tick "Remember this browser" when entering a two-factor code. Holds a random token whose hash is stored against your account so this browser can skip the authenticator step. HTTP-only; you can revoke it from Account Security at any time. | Functional (first party, optional) | 30 days |
| Stripe cookies | Set by Stripe on its own checkout pages to process your payment securely and detect fraud. Governed by Stripe's privacy policy. | Strictly necessary (third party, during checkout only) | Set by Stripe |
| Local browser storage | Some in-game interfaces remember display preferences on your device. Nothing stored this way is sent to us. | Functional (on your device) | Until cleared |
The forums load fonts from Google Fonts. When your browser requests a font file, Google receives your IP address and standard browser information in order to serve it; Google's privacy policy applies to that request. No Google cookies are set by this process.
Because the session cookie is strictly necessary, the forums cannot function without it. You can delete it at any time through your browser settings, which will sign you out. We do not respond to browser "Do Not Track" signals because we do not track users across third-party websites.
We share personal information only where necessary to operate the Services, with the safeguards described below.
These companies process information on our behalf and under our instructions. Each is bound by its own terms and data-processing commitments.
| Provider | Service | Information involved |
|---|---|---|
| OVHcloud | Hosting of the forums, game servers and databases (United States, Virginia) | All data we hold |
| Stripe, Inc. | Payment processing for credit purchases | Payment details (held by Stripe only), order reference, account ID, amount |
| Discord Inc. | Sign in with Discord, account linking, our community server, and staff notifications | Discord user ID and username; announcements and moderation notices we post |
| Resend | Delivery of verification and security emails | Email address, username, message content |
| Google LLC | Web fonts for the forums | IP address and browser information when fonts are requested |
| Fivemanage | Storage of photos, videos and voice memos captured with the in-game phone on Rift Roleplay | Media you choose to capture or upload in-game |
Members of the Rift Networks staff team can access account information, logs and moderation records to the extent needed for their role. Access is limited by rank, and staff actions on player accounts are themselves logged. Staff are required to keep player information confidential and to use it only for the purposes in section 4.
Some information is visible to other players and forum visitors by design, as described in section 7.
We may disclose information where we believe in good faith that it is necessary to comply with applicable law or a valid legal request; to enforce our rules; to investigate fraud, cheating or security incidents; or to protect the rights, property or safety of Rift Networks, our players or the public.
If the operation of Rift Networks is transferred to new owners, your information may be transferred as part of that change. We will continue to protect it as described in this policy and will notify you of any material change in how it is used.
We do not sell personal information and have not done so in the preceding twelve months. We do not share personal information with third parties for their own marketing.
Please be aware that the following information is visible to other users and, on the forums, to anyone on the internet:
Think carefully before including personal information in your username, signature, posts or chat. Our community rules prohibit sharing other people's private information, and you should not share your own.
We keep personal information only for as long as necessary for the purposes described in this policy, after which it is deleted or anonymised. The periods below are our standard retention periods; we may keep specific records for longer where an investigation, dispute or legal obligation requires it.
| Information | Retention period |
|---|---|
| Account, profile and gameplay data | For as long as your account exists. Deleted or anonymised within 30 days of a verified deletion request, subject to the exceptions below. |
| Forum session cookie | 7 days from sign-in, or until you sign out. |
| Trusted-device and "remember me" tokens | Until they expire or you revoke them. |
| Web-server access logs (IP address, user agent, URL) | 14 days. |
| Login-attempt records | 90 days. |
| Connection, chat, command and kill logs | Up to 12 months. |
| Anti-cheat observations, player reports and staff action logs | Up to 12 months, or for the duration of any resulting sanction plus 12 months, whichever is longer. |
| Ban records and the hashed identifiers attached to them | For as long as the ban is in force. Hashed identifiers linked to a permanent ban are retained so that the ban can be enforced. |
| Purchase and credit transaction records | For as long as required for accounting, tax and dispute-resolution purposes — normally up to 7 years. |
| Support communications | Up to 24 months after the matter is closed. |
Backups of our databases are kept for a limited period for disaster recovery and are overwritten in the normal backup cycle. Information deleted from live systems may persist in backups until that cycle completes.
We apply technical and organisational measures appropriate to the risk of the processing, including:
No system can be guaranteed to be completely secure. You are responsible for keeping your password confidential, using a password you do not use elsewhere, and enabling two-factor authentication where it is available. If you believe your account has been compromised, contact us immediately using the details in section 16.
If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected users, in accordance with applicable law.
Our servers are hosted by OVHcloud in the United States. If you use the Services from the European Economic Area, the United Kingdom, Switzerland or another region with data-transfer restrictions, your information will be transferred to and processed in the United States, and by the service providers listed in section 6 in the countries where they operate.
Where such a transfer requires a legal safeguard, we rely on the relevant provider's participation in the EU-U.S. Data Privacy Framework (including its UK and Swiss extensions), the European Commission's Standard Contractual Clauses, or another mechanism recognised under applicable law. You can request further information about these safeguards using the contact details in section 16.
Under the GDPR and UK GDPR you have the right to:
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we collect and how we use and disclose it, to request deletion or correction of your personal information, to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information for purposes that would trigger a right to limit. We will not discriminate against you for exercising your rights. You may designate an authorised agent to make a request on your behalf; we will ask the agent for proof of authorisation and may ask you to verify your identity directly.
Residents of other jurisdictions with privacy laws (including other U.S. states, Canada, Brazil and Australia) may have similar rights. We will honour any request to the extent required by the law that applies to you, and we extend the rights of access, correction and deletion to all users regardless of location.
Send your request using the contact details in section 16. To protect your account we will verify that you control it — normally by asking you to send the request from a signed-in account, from the email address on the account, or from the linked Discord account. We respond within one month; where a request is complex we may extend this by up to two further months and will tell you if so. We do not charge a fee unless a request is manifestly unfounded or excessive.
Grand Theft Auto V is rated for adults (ESRB Mature 17+, PEGI 18). The Services are intended for players who are old enough to play the game under the age rating and platform terms that apply where they live, and Rift Roleplay may apply its own minimum age through its whitelist.
We do not knowingly collect personal information from children under 13, or under 16 where the applicable law sets a higher age of digital consent without parental permission. If you believe a child has created an account or provided us with personal information, please contact us and we will delete it promptly.
To keep play fair, our game servers automatically monitor in-game behaviour — for example movement, weapon handling and damage values — and compare it against expected limits. Where behaviour is clearly outside those limits the system may automatically log an observation, issue a warning, remove you from the server or, for severe and unambiguous cases, apply a ban.
Automated actions of this kind are reviewed by staff. If you believe an automated action was wrong you may appeal through the Player Reports board on the forums or a Discord ticket; a member of staff will review the underlying logs and can reverse the action. Permanent bans are applied or confirmed by a human member of staff.
We do not use automated decision-making or profiling for any other purpose, and we do not build behavioural profiles for advertising.
To use the Services you interact with platforms we do not operate. Each processes your information under its own privacy policy:
The forums and Discord may contain links to websites, videos or streams posted by other users. We are not responsible for the privacy practices of those sites.
We may update this policy from time to time to reflect changes to the Services, our practices or the law. When we do, we will change the "Last updated" date at the top of this page and, for material changes, post an announcement on the forums and Discord before the change takes effect. Your continued use of the Services after a change takes effect means you accept the updated policy. Previous versions are available on request.
If you have questions about this policy, want to exercise your rights, or need to report a privacy or security concern, contact the Rift Networks staff team:
Please include your username and enough detail for us to identify the request. For account-related requests we will ask you to verify that you control the account before acting.
↑ Back to top