Privacy Policy

Last updated: July 13, 2026

1. Controller

The controller responsible for data processing on this website is:

Tim Plate Solutions
Tim Plate
Krähennocken 3
58511 Lüdenscheid
Germany
Email: privacy@fivestats.io

2. Data We Collect

a) Server & Player Data (Publicly Available)

FiveStats collects publicly available data from the Cfx.re/FiveM server listing API, including server names, player counts, player names (as displayed in-game), resource lists, and server configuration. This data is publicly broadcast by server operators and players. We do not collect private data such as IP addresses of players, private identifiers, or data not exposed through the public API.

b) Account Data

When you sign in via Discord or another OAuth provider, we receive and store your username, email address, and profile picture as provided by the authentication provider. We do not store your passwords.

c) Usage Data

We collect standard web analytics data including pages visited, browser type, device type, and referring URL. This data is processed via Google Analytics (see section 5).

3. Legal Basis (Art. 6 GDPR)

4. Data Retention

• Server & player data: Historical data is retained to provide long-term trend analytics. Current state data is refreshed every 15 minutes. You can object to this processing and request deletion at any time (see section 6). On such a request, the associated records are deleted without undue delay and the affected identifiers are added to a suppression list so they are not collected again.
• Account data: Retained as long as your account exists. Deleted upon account deletion request.
• Erasure & objection requests: A minimal audit record (identifiers requested, timestamp, method) is kept to document that we honoured the request, in line with our accountability obligations (Art. 5(2) GDPR).
• Analytics data: Retained according to Google Analytics default retention settings (14 months).

5. Consent

Advertising and analytics on this site are based on your consent, which we obtain through the cookie banner shown on your first visit. You can accept or refuse analytics and advertising separately. Refusing costs you no functionality, and the entire site remains usable.

Your choice is respected before any data is collected.The Google Analytics and Google AdSense scripts are loaded on every page, but Google Consent Mode v2 is initialised in a "denied" state before they run. Until you actively consent, no analytics or advertising cookie is written, no advertising identifier is read, and no personalised ad is requested. Advertising units are not rendered at all without your consent. Loading a script is not the same as processing your data.

You can withdraw your consent at any time, as easily as you gave it, via the Cookie Settings link in the footer of every page, with effect for the future (Art. 7(3) GDPR).

6. Third-Party Services

a) Google Analytics

We use Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand how the site is used. Google Analytics sets cookies and may transfer data to servers in the United States.

Legal basis: your consent (Art. 6(1)(a) GDPR), obtained through the cookie banner described in section 5. Without that consent, Google Consent Mode holds analytics_storageat "denied" and no analytics data about you is collected.

b) Google AdSense

This site is financed in part by advertising, which we serve through Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). With your consent, Google and its advertising partners may set cookies and read device identifiers in order to select and measure advertisements, including advertisements based on your prior visits to this and other websites (personalised advertising). Google acts as an independent controller for this processing.

Legal basis: your consent (Art. 6(1)(a) GDPR). AdSense is not necessary for the operation of this website, so no other legal basis applies. Your consent is collected through the cookie banner described in section 5 and signalled to Google via Google Consent Mode v2.

If you refuse: no advertising cookie is set, no advertising identifier is read, and no personalised advertising is delivered to you. You can still use the entire site; refusing costs you no functionality.

You can additionally manage Google's ad personalisation across all sites at myadcenter.google.com. Google's obligations as a controller are set out in its advertising controller terms.

c) Transfers to the United States

Google Analytics and Google AdSense may transfer personal data to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework. Such transfers therefore take place on the basis of the European Commission's adequacy decision of 10 July 2023 (C(2023) 4745), Art. 45 GDPR, and are additionally covered by your consent (Art. 49(1)(a) GDPR). Despite the adequacy decision, we point out that US authorities may, under certain conditions, be able to access personal data, and that enforcing your rights in a third country can be more difficult than within the EU.

d) Authentication Providers

We use OAuth (e.g., Discord) for authentication. When you sign in, we receive basic profile information from the provider. We do not access your contacts, messages, or other private data.

e) Hetzner (Hosting)

Our servers are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. All data is stored on servers within the European Union.

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access (Art. 15): request a copy of your personal data
• Rectification (Art. 16): correct inaccurate personal data
• Erasure (Art. 17): request deletion of your personal data
• Restriction (Art. 18): restrict processing of your personal data
• Data Portability (Art. 20): receive your data in a structured, machine-readable format
• Objection (Art. 21): object to processing based on legitimate interest
• Withdraw Consent (Art. 7(3)): withdraw consent at any time without affecting the lawfulness of prior processing

Self-service: You can view, download, and delete your player data, and opt out of future tracking, directly at fivestats.io/privacy/manage. Deletion via email requires no account; the full data export requires signing in with Discord so we can verify the data belongs to you.

You can also exercise any of these rights by contacting us at privacy@fivestats.io.

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority for Tim Plate Solutions is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.

9. Cookies

FiveStats uses the following types of cookies:

• Essential cookies: Session authentication, CSRF protection. These are strictly necessary for the service to function and are set without consent (Art. 6(1)(f) GDPR / § 25(2) TDDDG).
• Analytics cookies: Google Analytics cookies for usage statistics. Set only after you consent.
• Advertising cookies: Google AdSense cookies for ad selection and personalisation. Set only after you consent.

The Google scripts are present on every page, but as described in section 5 they are held in a "denied" consent state and set no analytics or advertising cookie until you agree. You can change or withdraw your choice at any time via Cookie Settings in the footer.

10. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated through the service. The current version is always available at this URL.

11. Contact

For privacy-related inquiries:
Tim Plate Solutions
Tim Plate
Krähennocken 3
58511 Lüdenscheid
Germany
Email: privacy@fivestats.io