Privacy Policy
Effective 26 October 2026
GTAVI.RIP is a fan project. We collect as little as we can, we don't sell data, and we don't run ads or tracking. This page explains exactly what we process and the rights you have.
1. Who is responsible
The controller of personal data processed through gtavi.rip is Marko Tičinović, a private individual based in Croatia (“we”, “us”). Contact for anything privacy-related: legal@gtavi.rip. We haven't appointed a data protection officer because the law doesn't require one for a service of this size and kind.
2. The short version
- You can browse and make predictions without an account.
- If you sign in, we get your name, email address and profile picture from Google or Discord. We never see your password.
- Anything you choose to share by link (a prediction card) or publish (a clip report) is public.
- We use only cookies that are needed for the site to work: no analytics, advertising or tracking cookies.
- You can ask us at any time for a copy of your data, or to correct or delete it.
3. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account: name, email address, profile picture URL and account ID from Google or Discord; the sign-in tokens they issue (stored encrypted) | Creating and running your account; linking your content to you | Contract (1)(b) |
| Sessions: a session identifier, the IP address and browser user agent at sign-in, expiry time | Keeping you signed in; detecting misuse of your account | Contract (1)(b); legitimate interests in security (1)(f) |
| Public profile: username and optional bio | Crediting your published reports | Contract (1)(b) |
| Predictions: nickname, chosen cause, setting and last words, creation date | Creating, sharing, exporting and saving your prediction card | Contract (1)(b) |
| Clips and reports (once clip submissions open): the video you upload, report text, trim, cover frame and template choices, your confirmation that you may publish the footage | Hosting, reviewing and publishing your report | Contract (1)(b) |
| Launch email: your email address, the exact consent wording you agreed to, when and where you opted in | Sending you one email when clip submissions open | Consent (1)(a), which you can withdraw at any time |
| Abuse protection: request counts keyed to a one-way, keyed hash of your IP address; for sign-in endpoints, request counts keyed to the IP address itself | Rate limits that stop spam, scraping and attacks | Legitimate interests in security (1)(f) |
| Moderation and security records: decisions on reports (with the moderator's account and reasons), security events, request identifiers | Reviewing content, explaining decisions, handling appeals, investigating abuse, meeting legal duties | Legitimate interests (1)(f); legal obligation (1)(c), e.g. the Digital Services Act |
| Staff passkeys: the public key and device type of a moderator's passkey | Strong authentication for moderation tools | Legitimate interests in security (1)(f) |
| Server logs kept by our hosting provider: IP address, time, requested address, browser user agent | Operating the service, fixing errors, preventing attacks | Legitimate interests (1)(f) |
We don't collect special categories of data, precise location, payment data or contact lists. Please don't put personal information about yourself or anyone else into nicknames, report text or videos.
4. What is public
- Shared predictions are visible to anyone who has the link. They aren't listed or indexed by search engines, but a link can be passed on, so treat it as public.
- Published clip reports are public, including the video, the report text, your username and the publication date, and may appear in search engines.
- Profiles show your username, bio and published reports. Your real name and email address are never shown.
5. How long we keep it
- Account and profile: until you ask us to delete your account.
- Sessions: 7 days from your last activity; expired sessions are deleted within a further 24 hours.
- Sign-in rate-limit records (contain IP addresses): deleted 24 hours after the last request.
- Abuse counters (hashed IP): deleted when their time window ends, at most 24 hours.
- Predictions shared without an account: 30 days, unless you save them to an account. Predictions saved to an account: until you delete them or your account.
- Clips: while published or until you delete them. Videos rejected or removed by moderation are kept 7 days so you can edit, resubmit or appeal, then deleted.
- Launch email: until the launch email is sent or you withdraw consent, whichever comes first; we then keep a minimal record that you consented or opted out, as proof, for up to 3 years.
- Moderation and security records: as long as needed to handle disputes and legal duties, normally no longer than 3 years.
- Hosting server logs: kept by our hosting provider for its standard short retention period.
- Backups: our database provider keeps point-in-time history for a limited period; deleted data disappears from it when that period ends.
6. Who processes data for us
We use these service providers, each under a data processing agreement and only to run the service:
- Vercel Inc. (USA): website hosting. Our application runs in Vercel's Frankfurt (EU) region; Vercel's global network may handle requests outside the EU.
- Neon: database hosting in the EU (Frankfurt, Germany).
- Mux, Inc. (USA): video upload, processing and streaming, used only once clip submissions open.
When you choose to sign in with Google or Discord, they process your sign-in under their own privacy policies; we only receive the profile information described above.
Where data is transferred outside the European Economic Area, we rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses. Ask us for details or copies at legal@gtavi.rip.
We may disclose data where the law requires it, for example to answer a valid order from a court or authority, and only to the extent required.
7. Cookies and local storage
We only use cookies that are strictly necessary for the service you asked for, so no consent banner is needed. We don't use analytics, advertising or social-media tracking, and our fonts are hosted on our own domain.
| Cookie | Purpose | Lifetime |
|---|---|---|
__Secure-better-auth.session_token | Keeps you signed in | Up to 7 days |
__Secure-better-auth.state and similar short-lived sign-in cookies | Protects the sign-in with Google or Discord against forgery | About 5 minutes |
__Host-gtavi_pred_claim | Lets the browser that made a shared prediction save it to an account later | 30 days, or until saved |
better-auth-passkey | Staff only: the challenge for a passkey check | Minutes |
The predictor may also keep your unfinished card in your browser's session storage while you sign in, so you land back where you were. It is never sent to us and disappears when you close the tab.
8. Your rights
Under the GDPR you can:
- get a copy of your personal data (access, Art. 15) and receive it in a portable format (Art. 20);
- have inaccurate data corrected (Art. 16);
- have your data deleted (Art. 17), including your whole account;
- restrict or object to processing based on legitimate interests (Art. 18, 21);
- withdraw consent at any time, for example for the launch email, without affecting earlier processing (Art. 7(3)).
Email legal@gtavi.rip from the address linked to your account, or tell us which shared prediction or report the request is about. We may ask you to confirm it's you. We reply within one month (extendable by two more months for complex requests, in which case we'll tell you). Requests are free unless clearly unfounded or excessive. Self-service account deletion in your settings is coming; until then, email us and we'll delete your account, content and sessions.
You can also complain to a data protection authority. In Croatia that is the Agencija za zaštitu osobnih podataka (AZOP); you may instead contact the authority in the EU country where you live or work.
9. Children
Accounts are for people aged 16 or older. We don't knowingly collect data from younger users; if you believe a child has created an account, contact legal@gtavi.rip and we'll delete it.
10. Automated decisions
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Rate limits apply automatically to everyone. Every clip is reviewed by a person before it is published.
11. Security
We use encrypted connections (HTTPS) everywhere, encrypt stored sign-in tokens, keep secrets out of the browser, limit staff access by role and require a passkey check for moderation, keep append-only audit records, and give our application the minimum database permissions it needs. No system is perfectly secure; if a breach affects your data, we'll notify you and the authority where the law requires it.
12. Changes
We'll update this policy when our processing changes and change the effective date above. If a change matters to you, for example a new purpose or a new provider, we'll tell signed-in users in advance. Related pages: Terms of Service, Community Guidelines.