Privacy Policy

FiveSearch is run by oxince, an independent developer based in Frankfurt am Main, Germany, the controller for the processing described here (Art. 4(7)). For anything about your data, including the rights listed below, write to [email protected].

FiveSearch is not affiliated with, endorsed by or operated by Cfx.re or Rockstar Games.

To deliver a page, our servers and our network provider Cloudflare, Inc. process the technical data of each request. Cloudflare sits in front of the site to protect it against attacks and to cache it.

Data

IP address, time, requested page, referring page, browser user agent, language

Purpose

Delivering the site, keeping it secure and available, defending against attacks

Legal basis

Art. 6(1)(f): our legitimate interest in a working and secure website

Storage

Short-lived operational logs, not combined with other data

Server errors are recorded with an error-tracking tool (GlitchTip) so we can fix them. A report contains the error, the page address and technical request headers such as the user agent. Cookies, sign-in sessions and API keys are removed before a report is stored. Legal basis: Art. 6(1)(f), our interest in a site that works.

We count visits on our own server. No cookie is set and nothing is read from or stored on your device. For each page view we keep the page, the time, the referring site, campaign parameters (utm_), the country (from Cloudflare, or looked up from your IP address, which is then discarded), and the type of device, browser and operating system read from the user agent.

To tell visitors apart within one day, your IP address and user agent are combined with a random value that exists for that day only and turned into a one-way hash. Your IP address itself is never stored. The day’s value is deleted after two days; from then on the hash cannot be linked to anyone, by us included. While a page is open in a visible tab it reports about every 45 seconds that it is still open, which is how we count people on the site right now.

We also run Umami, an open-source statistics tool, on our own server at um.oxince.com. Umami sets no cookies, stores no IP addresses and builds no profiles; it counts page views, referrers, countries, browsers and devices.

Purpose

Knowing which pages are used and how, to keep the site fast and useful

Legal basis

Art. 6(1)(f): our legitimate interest in understanding the use of our own site

Storage

Single page views 90 days, then only daily totals without any visitor reference

Consent

Not needed: nothing is stored on or read from your device (§ 25 TDDDG does not apply)

If you allow it in the privacy prompt, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It sets cookies (_ga and _ga_<id>) to recognise your browser across visits and measures how the site is used: pages, time on page, device, approximate location and the like. Before you agree, the site sends nothing to Google.

Legal basis

Your consent: Art. 6(1)(a) GDPR and § 25(1) TDDDG

Cookies

_ga and _ga_<id>, up to two years, or until you withdraw consent

Transfer

Google may process the data in the US; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45)

Withdrawal

Any time, with effect for the future (Art. 7(3)); it stops Google Analytics and deletes its cookies

Withdraw or give consent here: Privacy settings. The same link is at the bottom of every page. More in Google’s privacy policy.

Server icons and banners are copied to our own servers and delivered from there; fonts are delivered from our own servers too. Only an icon we have not copied yet loads once straight from Cfx.re’s image server (frontend.cfx-services.net), which then receives your IP address and user agent like any web server it is asked for a file. Legal basis: Art. 6(1)(f), our interest in showing every server with its icon.

The paid API on /developers needs an account, which you create by signing in with Discord (Discord Inc., USA). Discord sends us your Discord user ID, display name, avatar and, if verified, your email address. We never see your Discord password.

For your account we store your API keys only as one-way hashes (the key itself is shown to you once), when each key was created and last used, and how many requests your account made per day, to enforce the daily quota and show you your usage.

Subscriptions are sold through Stripe’s Managed Payments: Stripe, with its service Link, is the seller of record. It takes your payment details, calculates and collects taxes and sends receipts and invoices. Card and bank data go straight to Stripe and never reach us. We receive a customer ID, the status of your subscription and its renewal date, and give Stripe your Discord name and, if known, your email address so you do not have to type them. Stripe processes your data under its own privacy policy.

Legal basis

Art. 6(1)(b): the contract you enter by signing up and subscribing

Required?

Yes for an account: without the sign-in data we cannot provide the API (Art. 13(2)(e))

Storage

As long as the account exists; deleted on request. Billing records stay with Stripe as tax law requires

Partner access

Some accounts get free access, granted by us; the same data is processed

FiveSearch is a directory and statistics service for public FiveM servers. This data is not collected from you as a visitor. It comes from publicly accessible sources (Art. 14(2)(f)): the official FiveM server list and the information each server publishes about itself. FiveSearch collects it, puts it in order and computes statistics from it.

• Servers
  Name, description, tags, country setting, slots, installed resources, network and hosting provider, and player counts over the last 30 days.
• Server owners
  The Cfx.re username and avatar a server is registered to, as the FiveM server list shows them.
• Players
  The names of players currently on a server, as that server publishes them. Shown live on the server page; we keep no history of who played where.
• Who receives it
  Everyone visiting the site, and API customers, who get server data including the owner name. Player names are not part of the API.

Purpose

A searchable overview and statistics of the FiveM network for players, server owners and developers

Legal basis

Art. 6(1)(f): our legitimate interest, and that of our visitors and customers, in this overview

Balancing

Only what the network itself publishes, no private data, no tracking of players across servers

Storage

Player counts 30 days; a server's page is removed 30 days after the server left the list

• Hosting provider
  Runs our servers and database on our behalf, as a processor (Art. 28).
• Cloudflare, Inc.
  Network protection and caching for every request.
• Google Ireland Limited
  Google Analytics, only with your consent.
• Discord Inc.
  Sign-in to the developer dashboard, only if you sign in.
• Stripe
  Payments as seller of record, only if you subscribe.
• API customers
  Server data from public sources, including owner names.

Cloudflare, Google, Discord and Stripe may process data in the United States. Transfers rely on the EU-US Data Privacy Framework (Art. 45) where the provider is certified, otherwise on the EU standard contractual clauses (Art. 46(2)(c)).

• fs.consent (local storage)
  Your answer in the privacy prompt, so we do not ask again. Kept 365 days. Strictly necessary.
• fs_dev (cookie)
  Your sign-in to the developer dashboard, for 30 days. Only if you sign in. Strictly necessary.
• fs_dev_state (cookie)
  Protects the Discord sign-in against forgery, for 10 minutes during sign-in. Strictly necessary.
• _ga, _ga_<id> (cookies)
  Google Analytics, only after you allowed it. Up to two years, or until you withdraw consent.

Strictly necessary storage needs no consent (§ 25(2) no. 2 TDDDG). Nothing else is stored on your device.

You have the right to

• Access (Art. 15)
  Learn whether and which data about you we process.
• Rectification (Art. 16)
  Have wrong data corrected.
• Erasure (Art. 17)
  Have your data deleted.
• Restriction (Art. 18)
  Have processing limited while something is checked.
• Portability (Art. 20)
  Receive data you gave us in a common, machine-readable format.
• Withdraw consent (Art. 7(3))
  With effect for the future, at any time.

Write to [email protected]. You can also complain to a data protection supervisory authority (Art. 77), in particular in the EU country where you live or work. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wiesbaden.

We make no automated decisions about you and build no profiles (Art. 22).

Where we process data about you on the basis of our legitimate interests (Art. 6(1)(f)), you have the right to object at any time, on grounds relating to your particular situation. This includes your name as a FiveM server owner or player on FiveSearch and in the API. We then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves legal claims. To object, write to [email protected].