1. Who we are

Leonida Marketplace (the "Service") is an independent, fan-made GTA 6 companion site operated by Kyrylo Kuklis. This policy explains what personal data the Service collects, why, who else receives it, and the choices you have. You can contact us at support@gta6-tracker.org. See also About and Contact.

2. Information we collect

Information you give us

• Account: when you sign in with Google we receive your email address and name; when you sign in with an email code we receive your email address. If you link a Discord account we receive your Discord user ID and username. We do not store passwords.
• Subscription: if you buy a PRO plan, PayPal processes the payment. We receive a confirmation containing your email and subscription status. We never see or store your card or payment details.
• Content you post: classified listings (title, description, platform and contact details you choose to include) are public. Messages sent through the "contact author" feature are relayed by email without revealing the recipient's address.
• Newsletter and waitlists: your email address, if you subscribe to the weekly digest or the Marketplace waitlist. You can unsubscribe from every digest with the link in the email.
• AI assistant: the questions you type. We store only your side of the exchange (not the assistant's reply) for up to 90 days to see what people ask and to prevent abuse.
• Push notifications: if you turn them on, your browser gives us a push subscription (an endpoint address and encryption keys) so we can send you alerts. You can turn this off at any time.
• Settings: your chosen skin, language, nickname and similar preferences, saved on your account when you are signed in.

Information collected automatically

• Your IP address, browser and device type, the pages you open and the actions you take (for example opening an article or using a tool), recorded in our own activity log and kept for up to 90 days.
• A randomly generated visitor ID stored in a first-party cookie for up to one year, which lets us count visitors and recognise repeat visits without needing an account.
• An approximate location (city and country) derived from your IP address by the third-party geolocation service ip-api.com, used for abuse prevention and aggregate statistics.
• Technical error reports from your browser, to fix bugs.
• If a website embeds our countdown widget, each time it is displayed we receive a request that includes the address of the embedding site and the viewer's IP address. We use it to see how widely the widget is used.

3. How we use information

• To provide the Service: sign you in, keep your session, store your settings and enforce plan limits.
• To process and manage PRO subscriptions.
• To send what you asked for: the newsletter, push alerts, replies to your messages and account emails.
• To keep the Service secure, prevent abuse and fix errors.
• To understand how the Service is used and improve it.
• To show advertising and earn affiliate commission, which pay for the Service (see sections 5 and 6).

We do not sell your personal data.

4. Cookies, local storage and similar technologies

• Essential: a secure HTTP-only session cookie that keeps you signed in (NextAuth.js).
• First-party analytics: the visitor ID cookie described above.
• Preferences and your data: your browser's local storage holds your skin and language, map markers and layers, calculator inputs and saved articles. This stays on your device unless you export it or sign in and sync settings.
• Service worker: if you enable push notifications, a small service worker runs in your browser to receive them.
• Third-party: Google Analytics, Google AdSense, Amazon and embedded YouTube players may set their own cookies, as explained below.

You can block or delete cookies and local storage in your browser settings. Blocking essential cookies means you cannot stay signed in.

5. Advertising (Google AdSense)

We use Google AdSense to show advertising on some pages. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.

You can opt out of personalised advertising by visiting Google Ads Settings. Alternatively, you can opt out of a third-party vendor's use of cookies for personalised advertising by visiting aboutads.info. To learn how Google uses information from sites that use its services, see policies.google.com/technologies/partner-sites.

Your consent choices. If you visit from the European Economic Area, the United Kingdom or Switzerland, we use Google's consent management platform (Funding Choices) to ask for your consent before ads and analytics use cookies or personal data, and to let you accept, decline or manage your choices. You can reopen it at any time with the "Privacy & cookie settings" link in the footer. Until you choose, analytics and ad cookies stay off in those regions.

Signed-in PRO subscribers do not see ads.

6. Analytics and affiliate links

Google Analytics 4 collects usage data such as pages viewed, approximate location and device information, using cookies, to give us aggregate statistics. See Google's Privacy Policy; you can opt out with the Google Analytics opt-out browser add-on.

Amazon Associates. Some hardware and gear links lead to Amazon and carry our affiliate tag. As an Amazon Associate we earn from qualifying purchases. If you follow such a link, Amazon may set its own cookies and receives the information your browser sends; we do not give Amazon your account data. Affiliate links are marked as sponsored.

7. Services that process data for us

• Google: sign-in (OAuth), Analytics, AdSense, the Gemini AI model for the assistant, and YouTube (embedded players use the privacy-enhanced youtube-nocookie.com domain; the YouTube Data API is used to list videos).
• PayPal: payment processing for PRO plans.
• Discord: optional account linking and our community bot.
• Groq and OpenAI: AI models that answer assistant questions. Your questions are sent to the provider that serves your request.
• Netlify: hosting; it processes request logs.
• A managed Redis database provider: stores accounts, settings, listings and the activity log.
• An email delivery provider: sends sign-in codes, newsletters and relayed messages.
• ip-api.com: approximate location from IP addresses (see section 2).
• Browser push services operated by Google, Mozilla, Apple and Microsoft deliver notifications you opted into.
• Reddit and news publishers' RSS feeds: we fetch public content; no personal data about you is sent.

These providers may be located outside your country, including in the United States.

8. Data retention

• Account and subscription records: while your account is active or as needed to provide the Service and meet legal obligations.
• Activity log, error reports and AI assistant questions: up to 90 days.
• Newsletter and waitlist emails: until you unsubscribe or ask us to delete them.
• Push subscriptions: until you turn notifications off or your browser invalidates them.
• Classified listings: until they expire (30 days for free listings, 90 days for PRO) or you delete them.

9. Your rights and choices

Depending on where you live (for example in the European Economic Area, the United Kingdom or California) you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent you previously gave. Signed-in users can export their data from the Settings page. For any request, email support@gta6-tracker.org from the address on your account. We will respond within a reasonable time.

You can also: unsubscribe from the newsletter with the link in any email; turn push notifications off in the notification toggle or your browser; opt out of personalised ads (section 5); and block cookies in your browser. If you believe we have mishandled your data you may complain to your local data protection authority.

10. Security

We use HTTPS, restrict access to our systems and keep sensitive credentials out of the browser. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Children's privacy

The Service is not directed at children under 13 (or the higher minimum age that applies in your country). We do not knowingly collect personal information from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The updated version will be posted here with a new "Last updated" date, and significant changes will be announced on the site.

13. Contact

For privacy questions or requests, email support@gta6-tracker.org.