Privacy Policy

Effective date: September 28, 2026 (updated: analytics, affiliate links, launch alert) · Responsible party: see Impressum.

We run this site on a simple principle: collect as little as possible.

What we collect

• Server logs. Our hosting provider (Vercel Inc., USA) processes technical data (IP address, user agent, requested URL) to deliver the site and protect it from abuse. DNS and email forwarding are handled by Cloudflare, Inc. (USA). Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Newsletter. If you subscribe, we store your email address with your consent (Art. 6(1)(a) GDPR), used solely to send the newsletter. Every issue contains an unsubscribe link; unsubscribing deletes your address from the active list. Provider: Resend (Resend, Inc., USA). We use double opt-in. When you sign up, your address is processed once to send you a confirmation email through Resend. We don't keep a list of pending sign-ups: the confirmation link itself carries your address in signed form and expires after 24 hours. Your address is stored in our Resend newsletter audience only after you click that link; if you never click it, it is never added. Data is processed in the US under EU standard contractual clauses.
• Newsletter consent record. When you confirm, we store with your address the time of your confirmation, the language you signed up in and which sign-up form you used, so we can prove your consent (Art. 7(1) GDPR). That record is also emailed to our own inbox (support@gtasix.org, forwarded by Cloudflare) and from there added to our Resend newsletter list. If you tick "email me when GTA 6 unlocks in my region", we also store the region you picked (Asia-Pacific, Europe, UK or Americas) to send that one alert at the right time. We don't store your IP address with your subscription.
• Analytics: Vercel Web Analytics, cookieless. We count page views and a few clicks (buy buttons, newsletter sign-ups, Discord links) with Vercel Web Analytics, provided by our host Vercel Inc. It sets no cookies and stores nothing on your device. Visitors are told apart by a hash of the incoming request that is discarded after 24 hours, so you can't be followed across days or across websites. Vercel records the page URL, referrer, country/region/city, browser, operating system and device type. We only see aggregate numbers. Legal basis: legitimate interest in knowing which pages and features are used (Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device, no consent banner is needed.
• Your country, for the buy buttons. Pages with buy buttons ask our own server for the country your connection comes from (Vercel's geolocation of your IP). We use it only in your browser, to pick the store whose codes work in your region (PS5 codes are region-locked), and remember it in your browser's session storage until you close the tab. We don't store it on our side. Legal basis: Art. 6(1)(f) GDPR.
• No tracking ads. This site sets no advertising or cross-site tracking cookies.

Links to storefronts

Buttons to the PlayStation Store and Microsoft Store are plain links: no affiliate tag, and we receive no data about what you do there.

Amazon buttons are affiliate links (Amazon Associates / Amazon PartnerNet, marked Ad). When you click one, Amazon (Amazon.com Services LLC for amazon.com; Amazon Europe Core S.à r.l. for amazon.de) may set cookies on its own site to attribute a purchase to us. We receive reports of clicks and ordered items in aggregate, never your name, address or anything that identifies you. Once you leave this site, the storefront's own privacy policy applies. As an Amazon Associate we earn from qualifying purchases.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict processing of, and port your personal data, and to object to processing based on legitimate interest. Contact: support@gtasix.org. You also have the right to lodge a complaint with a supervisory authority.

Data transfers & retention

Newsletter data (address, consent record, alert region) is retained until you unsubscribe; the consent record may be kept afterwards only as long as needed to prove your consent. Server logs are retained per our host's standard schedule. Where processing involves providers outside the EU/EEA, it occurs under appropriate safeguards (e.g. EU standard contractual clauses) — details: Vercel Inc. (hosting and web analytics, USA), Resend, Inc. (newsletter, USA) and Cloudflare, Inc. (DNS and email forwarding, USA).