Privacy

FiveTrace stores the errors your FiveM script produces, so you can fix them. It does not collect anything about the players on your customers’ servers, because the payload has no field for it.

Your email address, so you can sign in. Signing in is a six digit code emailed to that address and typed into the page that asked for it, so we never hold a password — and there is no link in the mail to be followed by anything but you. The names you give your scripts, and the DSN keys we generate for them. If you configure Discord alerts, the webhook URL you paste in.

For each captured error: the message, the file and line, a stack of function names and locations, the resource name, the resource version from your manifest if you set one, a server name if the server operator has named it with sets sv_projectName convar, and a timestamp.

That is the complete list. The error SDK has no field for a player identifier, a Rockstar or Steam licence, an IP address, a chat message or any other end-user data, so none can reach us through it even by accident.

Live logs is a separate product, and this part is different, so we would rather be blunt about it than let the sentence above cover both.

A log line contains whatever the person who set logging up chose to send. That normally includes a player identifier — a licence, a Steam id, a Discord id — because a log saying somebody did something without saying who is of no use to anyone. It is opt-in: nothing is logged until a server owner sets a log key and adds the calls themselves.

For that data the server owner is the controller and we are the processor. They decide what to send, and they are responsible for telling their players. We keep it for the retention window on their plan and no longer.

A Discord alert is the same data leaving again. If they set a rule on a channel, the lines that match it are posted to the webhook they supplied, rendered with their own template, and a template naming the player puts that identifier in a Discord channel. It is off until they turn it on, and it is worth knowing before they do.

A player can ask the server owner to delete their data, and the owner can do it: the dashboard deletes every line whose actor is that identifier, immediately and across every channel and every server on the account. That is why the identifier is stored as its own field rather than buried in the payload — so the request is answerable rather than approximately answerable.

A line written by somebody else can also name that player in its fields — a payment names whoever was paid. That line is the other player’s record of their own action, so it is not deleted: the identifier in it is replaced with [erased] and the rest of the line is left as it was. The payment still reads as a payment; the person who asked to be forgotten is no longer in it. Both counts are reported to the owner, so they can tell their player what happened.

What this matches is the identifier, in the actor field and anywhere in a payload. A display name is not an identifier — two players can share one — so a name sitting in a field is left alone, and a player who wants that gone should ask their server owner, who can search for it.

We do not join log data to error data, and error tracking is unaffected by any of this. A script seller using only error tracking sends us no player data at all.

Raw error events are deleted automatically after the retention window on your error plan. Issue summaries — the message, location, counts and dates — are kept while your script exists, so your history does not vanish.

Log lines are deleted after the retention window on your log plan. There are no summaries: when a line ages out, it is gone.

Deleting a script deletes its issues and every stored event with it, immediately. Deleting a channel deletes every line in it, the same way.

Supabase hosts the database and handles sign-in. Vercel hosts and serves the application. Upstash provides rate limiting. Resend delivers the email we send you.

If you configure Discord alerts, we post to the webhook you supply and Discord processes what arrives under their own terms. From error tracking that is the error message and the resource name. From live logs it is the matching line, rendered with the template you wrote for that channel — so if the template names the player, as the first example in our own logging docs does, the identifier goes to Discord with it. You choose the template and you choose the webhook; we send what they say.

Paddle.com Market Ltd is the merchant of record for paid plans, which makes them the seller rather than a processor working for us. They hold your billing name, address and payment details under their own privacy notice, and we never see your card. What reaches us from them is which plan you are on and whether it is paid up.

We do not use analytics or advertising trackers, and we do not sell anything to anyone.

One session cookie, set when you sign in and refreshed while you browse. It exists to keep you signed in. There are no tracking or advertising cookies.

You can see everything we hold about a script from its dashboard, and delete it from the settings page.

You can close your account from the settings page yourself. It is scheduled rather than immediate: nothing is removed for fourteen days and you can stop it at any point in that window, after which the account and everything in it is deleted and cannot be recovered. We email you when it is scheduled, if you call it off, and again when it is done.

Invoices for payments already made are kept afterwards, because tax law requires it. They carry billing details and nothing about your servers or the players on them. Backups roll over on a fixed cycle and deleted data is never restored into the live database from one.

To export what we hold about you rather than delete it, email legal@fivetrace.com from the address on the account.

If this changes in a way that affects you, we will say so by email before it takes effect rather than quietly editing this page.

legal@fivetrace.com