Who runs this
bs19.org is run by me, XanderP, one guy in Portugal building a FiveM framework. Not a company. When this page says "I" or "we" it's the same person, plus the few people on the team who help moderate. For anything privacy related talk to me on Discord (ask for XanderP) and I'll answer.
What gets stored
You can read everything on the site without an account and then I store nothing about you. Things only get saved when you log in or send something:
- Your account. When you log in with Discord, Google or Cfx.re I get your id on that service, your display name and avatar. No passwords, I never see them. If you link more than one, they're tied to the same account.
- Alpha applications. What you write in the form on /apply, plus its status (pending, approved, etc).
- Bug reports. The text and screenshot you send. These also go to the public Trello board, so don't put private stuff in them.
- Gallery uploads. The image, the caption and who sent it. Approved ones are public with your display name on them.
- Basic logs. Cloudflare (who hosts the site) keeps normal request logs like IP and browser for security, I don't use them for anything else.
All of it lives on Cloudflare (D1 database and R2 storage). I don't sell it, I don't share it with anyone except what's said here.
Cookies
Without ads switched on the site sets just two cookies, and only when you log in: one keeps your session, the other (bs_csrf) protects the forms. Those are strictly necessary, so there's no consent needed for them.
If you choose in the cookie banner, a bs_consent cookie (and the same thing in localStorage) remembers what you picked, for about six months.
Ads and consent
Running servers isn't free so at some point there will be ads, through Google AdSense. Ads only show on public pages like the homepage, devlog and docs, never on login, account, apply or admin.
Before any ad script loads you get a banner with Accept, Reject or Customise. If you reject, Google's script either doesn't load or only serves non-personalised ads that don't use cookies to profile you. If you accept, Google and its partners can use cookies to pick ads for you. You can see how Google handles that at policies.google.com/technologies/partner-sites. Change your mind whenever with the Cookie settings link at the bottom of every page.
There's no analytics running right now. If I add some it will be behind the same consent switch.
How long I keep it
Account stuff stays while you have an account. Bug reports and applications stay while they're useful for the project. Rejected gallery uploads get cleaned up. If you want your account and everything attached to it deleted, just ask.
Your rights
You're in the EU or not, doesn't matter, you get the GDPR stuff anyway: see what I have about you, fix it, delete it, get a copy, or object to something. Message me on Discord and I'll sort it, normally within a few days and never more than a month. If you think I'm doing something wrong you can also complain to the Portuguese data protection authority (CNPD) or the one where you live.
Kids
The site isn't for under 16s. If you are, please don't make an account.
Changes
If this changes in a way that matters, I'll update the date on top and say so in the Discord.