Privacy Policy

01Overview

This policy explains what personal data TruffAC Network ("TruffAC", "we") handles, why, and what choices you have. It covers three groups of people:

• Customers — server owners and their staff who sign in to the TruffAC website and panel.
• Players — people who play on FiveM servers that run the TruffAC resource.
• Scanned players — people who run the TruffScan client with a PIN from a server's staff.

02Data about customers

When you sign in with Discord we receive, with your permission:

• your Discord user ID, username, display name, avatar and email address;
• the list of Discord servers you are in, and your roles in a small number of servers that our features check (for example, community blacklist servers);
• Discord access and refresh tokens, stored so that role checks and lookups keep working without asking you to sign in again.

We also keep your license details (key, plan, dates, the server name and IP address the license is bound to), your panel settings, the staff permissions you configure, and messages you send us through support tickets.

We do not receive or store your card details. Card payments are handled by Stripe; PayPal and crypto payments are handled through those providers. We keep the payment confirmation, amount and date for accounting.

03Data about players on protected servers

When you play on a server running TruffAC, the resource processes data needed to detect cheating:

• identifiers sent by FiveM: Rockstar license, FiveM, Steam and Discord IDs (if linked), hardware tokens and IP address;
• your in-game name, connection times and the server you played on;
• gameplay and technical signals our detections look at (for example weapon, movement, damage and resource events);
• detection records, ban records and staff notes;
• screen captures and short screen recordings of the game, taken around a detection or when staff use live monitoring, kept as evidence for bans and appeals.

This data is shown to the staff of the server you played on. Identifiers linked to confirmed bans may also be used to recognise ban evasion on the same server.

04Data collected by TruffScan

TruffScan only runs when you start it yourself with a PIN from a server's staff. One scan sends the following to the staff who issued that PIN:

The search happens on your computer and only matching findings are sent: TruffScan does not upload your files, documents or photos, your full browsing history or your messages, and it does not collect passwords. It does not install itself and does not keep running after the scan. The design of the scanner window (colours, logo) is loaded from the server that issued the PIN.

05Website visitors, cookies and logs

• Cookies. We use one session cookie to keep you signed in, and your browser's local storage for preferences such as the sidebar state and panel theme.
• Advertising measurement. Our public pages (home, scanner, blog and legal pages, not the panel) load the Google tag from Google Ads. It tells us how many visits come from our ads; Google may set its own cookies for this and receives your IP address and the page you visit. You can limit ad personalisation in your Google account's ad settings.
• Logs and security. Our servers log IP address, browser type and the pages requested, and we keep short-lived rate-limit records to stop abuse and brute-force attempts. Our website is served through Cloudflare, which processes traffic to protect it from attacks.
• Third-party assets. Pages load fonts and scripts from Google Fonts, jsDelivr and the Tailwind CDN, which receive your IP address when your browser requests them.

06Why we use data

• To provide the Service: run detections, show evidence and scan results to the right staff, manage licenses and accounts. (Legal basis: performance of a contract with the customer; for player data, the server owner's legitimate interest in fair play.)
• To keep the Service secure and prevent fraud, license sharing and abuse. (Legitimate interest.)
• To improve detections and fix false positives, using detection and scan findings. (Legitimate interest.)
• To meet legal and accounting obligations. (Legal obligation.)

We do not sell personal data and do not use it to build advertising profiles.

07Who we share data with

• The server's staff — players' and scanned players' data is shown to the staff of the server concerned, and only that server.
• Service providers — hosting and Cloudflare (website delivery and protection), Discord (sign-in, and webhook messages that server owners configure to post to their own Discord channels), Stripe and PayPal (payments), ipify (IP lookup during a scan).
• Authorities — when the law requires it, or to protect our users or the Service from serious harm.

When a server owner connects a Discord webhook, ban and detection notices are posted to that owner's Discord channel, where Discord's own policies apply.

08How long we keep data

• Customer account data: while the account or license is active, and then as long as needed for accounting and to handle disputes.
• Player data, ban records and evidence: while the server's license is active, unless the server owner deletes it earlier. Records of confirmed cheating may be kept longer to prevent ban evasion on that server.
• Scan PINs expire 24 hours after they are created; scan results and screenshots stay in the issuing server's panel while its license is active, unless deleted earlier.
• Rate-limit and security records: minutes to days.

09Your rights

Depending on where you live (for example under the GDPR or Türkiye's KVKK), you can ask for access to your data, correction, deletion, restriction or a copy in a portable format, and you can object to processing based on legitimate interests. You can also complain to your data protection authority.

• Customers: contact us directly.
• Players and scanned players: contact the server you played on first, as it decides about your data. If you cannot reach them, contact us and we will pass your request on and help where the data is stored with us.

We may need to confirm your identity (for example through your Discord account) before acting on a request.

10Security

We protect data with access controls, per-server separation of player data, rate limiting against brute force, and transport encryption where available. No system is perfectly secure; if we learn of a breach that affects you, we will notify affected customers and authorities as the law requires.

11International transfers

Our providers (such as Cloudflare, Discord, Stripe and PayPal) may process data outside your country. Where required, these transfers rely on the safeguards those providers offer, such as standard contractual clauses.

12Children

The TruffAC website and panel are not intended for children under 13 (or the higher age set by your local law). FiveM servers set their own age rules; a server should not scan a player who is too young to agree to it.

13Changes to this policy

We will update this policy when our practices change. The "Last updated" date shows the current version, and significant changes are announced on our Discord.

14Contact

For privacy questions or requests, open a ticket on our Discord server and mention "privacy" in the subject.