Privacy
Effective
Who runs this
Explore Theft Auto is built and run by one independent developer. For anything about your data, email [email protected]. A person will reply within seven days.
The short version
What you do in Explore Theft Auto stays in your browser: your story progress, what you have found, what you have ticked and your vehicle and collection marks. We never see it unless you choose to sign in, which copies it to your account so another device can pick it up. One exception: the feed page sends the story stages up to your progress to load matching items (see The feed and its videos below). And if you join the email list and tick the box to tailor your emails, a short summary of how you use the app goes with your address (see The email list below).
We hold personal data only if you choose a feature that needs it: your email address if you join the list, your account if you sign in (see If you sign in below), and what you send if you add something to the guide or report a feed item (see Submissions to the guide below). No ads, no tracking across sites, nothing sold.
Nothing loads from YouTube until you press Load the video on the feed. Then YouTube receives your request and acts on its own account, under its own privacy policy, not for us (see The feed and its videos below).
What stays on your device
The app remembers these in this browser's own storage (IndexedDB, local storage for the sign-in session, and Cache Storage for the saved copies of its files). They are never sent to us, and we cannot see them, unless you sign in (see If you sign in below). When you untick or remove something, this browser keeps a removed entry with its time, signed in or not, and Download my data includes it. While you are signed in, it is also copied to your account so your other devices remove it too. One exception: the feed page sends the story stages up to your progress to load matching items, as The feed and its videos below explains. The email list sign-up can also send a short summary, but only if you tick its box to tailor your emails (see The email list below):
| What | Why |
|---|---|
| Your story progress and whether spoilers are on | So the map, checklist and guide only show what you have reached. |
| The map markers you marked as found, with the time | So your map remembers what you have already found. |
| The checklist items you ticked, with the time | So your checklist and totals pick up where you left off. |
| The hints you opened on the map: how far each one goes, with the time | So each hint stays at the step you reached. They stay on this device even if you sign in. Forget this hint removes one; Clear my checklist removes them all. |
| The vehicles you marked as seen, wanted or owned, and the properties, weapons and clothing you marked as wanted or owned, with the time | So your collection and its totals pick up where you left off. If you sign in, they are copied to your account and kept in step with your other devices. Clear my checklist removes them all. |
| Whether you have the Ultimate Edition or the pre-order bonus | So your collection totals include edition items only if you can get them. If you sign in, it is copied to your account and kept in step with your other devices. |
| Whether you turned on Show all pins on the map | So the map shows every pin, or only what you found and the hints you opened, as you chose. It stays on this device even if you sign in. Delete everything below removes it. |
| Only while you are signed in: your sign-in session, in this browser's local storage (not a cookie) | So you stay signed in until you sign out. Our database host, Supabase, receives it with each request to your account. Signing out removes it, and so does Delete everything below, which signs you out on this device. |
| When the app last asked you to join the email list, whether you joined or said not to ask again, and which parts of the app you have used (checklist, map, hints, feed, vehicles) | So it asks at most once a week, and never again once you join or say stop. Delete everything below removes it. |
| Whether you said Not now or Got it to the offer to install the app, with the time | So it asks at most once a month, and never again once you install it or say Got it. Delete everything below removes it. |
| Copies of the app's pages, code, fonts, map and guide files (Cache Storage), saved after your first visit | So the map and checklist open without a connection. They hold nothing about you: everyone gets the same files, and your progress and marks stay in the rows above. Delete everything below removes them, and the app then saves fresh copies straight away so it keeps working offline; clearing this site's data in your browser removes them for good. |
Your data on this device
Clearing this site's data in your browser settings deletes all of it, and so does the button below. A private or incognito window forgets it when you close the window.
Everything you do in this app is saved in this browser. If you sign in, your account keeps a copy (see If you sign in). Take a copy or wipe it.
The email list
If you join the email list, we keep these, in a database run for us by Supabase:
| What | Why |
|---|---|
| Your email address | To send you what you asked for. |
| Whether you ticked the reminders box | So we only send the 12 November and 19 November reminders to people who wanted them. |
| When you signed up and when you clicked the confirmation link | To prove you asked, which the law requires of us. |
| Which page you signed up from | To know which parts of the site are worth keeping. |
| The exact consent text you saw, and its version | So that if the wording changes later, we still know what you agreed to. |
| Only if you tick the box to tailor your emails: the console you pick (if any), your story stage, and which parts of the app you use (cars, completing the checklist, the feed, hints), with the wording you agreed to and when | So the emails fit how you play. Without the tick none of it is stored. Once your address is confirmed, signing up again cannot change it. |
| Only if you tick the weekly email box: that you did, the wording you agreed to and when, and when we last sent you the weekly email | To send the weekly what’s new email: a few links each with a line we wrote, filtered to the story stage you shared with the tailoring box, or with nothing from the story if you did not share one. If you are already on the list, ticking it sends a link to confirm first. Stop it from the link in any weekly email; unsubscribing stops it too. |
| Two random tokens | One confirms your address, one lets you unsubscribe with a single click. Neither says anything about you. |
What we do not collect
Apart from the sign-in security log described under If you sign in, we store no IP addresses (Cloudflare sees them in transit and keeps short-lived logs; the guide submission form keeps a scrambled code for two days instead, see Submissions to the guide), no names, no device fingerprints and no advertising networks. The sign-up form does not record which site sent you or what browser you use.
We set no cookies. The storage on your device holds only what you asked the app to remember, which the law treats as strictly necessary, so there is nothing to consent to and no consent pop-up.
Analytics
We count visits with Umami, a privacy-first analytics tool. It sets no cookies, stores no personal data and cannot follow you to other sites. IP addresses are hashed with a regularly rotating salt and are never stored. Umami honours the Do Not Track setting in your browser: turn it on and you are not counted at all. We see aggregate numbers only: pages viewed, countries, browsers, and how often a hint link is sent, opened and followed into the app. Like every visit, these counts arrive with the address and title of the page, and the title of a hint page names its item. They carry nothing about you, and a hint link itself carries nothing about the person who sent it.
Error reports
If something on Explore Theft Auto crashes in your browser, the browser sends a short technical report to Sentry so we can fix it: the error message, the page path (never the part after a question mark), the browser stack and the browser type that every web request carries. No account, email address, progress or IP address is stored with it, and Sentry deletes reports after 30 days.
Who processes it
These companies handle data on our behalf, and no one else. Cloudflare serves the site and runs the sign-up and submission code, keeping its standard short-lived request logs; it also runs the Turnstile spam check on the submission page, and on the feed when you open the report form on a feed item, and stores submitted screenshots (Cloudflare R2). Supabase hosts the database that holds the email list, the feed list, the guide submission queue and the accounts of people who sign in, and runs the sign-in itself (Supabase Auth); where that project is hosted outside the UK or EU, the transfer is covered by Supabase's data processing agreement and its standard contractual clauses. Resend delivers the emails, so it sees your address and whether a message was delivered. Umami counts visits as described above. Sentry receives the error reports described above. If you email us, the email provider that hosts our inbox stores your message.
Nothing is sold, rented or shared with anyone else.
How long we keep it
Device data stays until you delete it. If you sign in, your account and everything stored with it stay until you delete the account; the sign-in security log is kept for the limited time Supabase sets. If you sign up but never click the confirmation link, your address is deleted once it is more than 30 days old; we clear these out when the next person signs up and check by hand every month. If you confirm, we keep your address until you unsubscribe. Unsubscribing deletes the tailoring details (console, story stage, parts of the app you use) and the weekly email record at once; stopping only the weekly email deletes its record at once; erasing your address deletes them with it.
After you unsubscribe, the address stays marked as unsubscribed so you are never added back by mistake. The unsubscribe page lets you erase it completely in one click, or email us and we will. Resend keeps its delivery logs for a limited time set by Resend. Emails you send us are deleted after 12 months.
Guide submissions: the scrambled rate-limit code is cleared after two days and screenshots are deleted after 60 days; see Submissions to the guide.
Submissions to the guide
The form for adding to the guide needs no account, email or name. When you send something, we keep what you chose and wrote (the kind of thing, the story stage, your text and the optional link), the optional screenshot with its location and camera details removed, the time, and a scrambled code made from your connection’s address with a secret key. The code changes at midnight UTC; codes older than two days are cleared when the next submission arrives. It only exists to stop floods, and the address itself is never stored.
Only the reviewer sees a submission. Nothing is shown publicly unless it is approved, and approval publishes text and a map position, never the screenshot. Cloudflare runs the Turnstile spam check in your browser on that page, and on the feed only when you open the report form on a feed item (our server passes it your connection’s address to confirm the check) and stores screenshots; Supabase holds the queue. Screenshots are deleted after 60 days. Rejected submissions are kept as a record of the decision, without the code; approved text becomes part of the guide.
The feed and its videos
The feed page asks our database host, Supabase, for the list of videos and articles it may show you. The request names the story stages you can see, worked out from the progress on your device, so that later titles never reach your browser. We store nothing from it; Supabase keeps short-lived request logs, which include your IP address, like any web server.
Nothing loads from YouTube until you press Load the video. Then your browser fetches YouTube’s own player from youtube-nocookie.com, YouTube’s privacy-enhanced mode, and YouTube (Google) receives what any web request carries: your IP address, your browser details and the address of our site. YouTube says that in this mode the ads it shows are not personalised and what you watch does not shape your recommendations on YouTube. Once the player loads, YouTube’s own privacy policy applies and YouTube may store cookies or similar data (such as local storage) in your browser. We receive nothing back from the player. YouTube is not our processor; it acts on its own account.
Links that say Watch on YouTube or Read on a publisher take you to that site. If you report a feed item, the report goes the same way as a guide submission (see above): the item, the reason you chose and your optional note, with the same spam check and the same two-day connection code.
Your rights
You can ask what we hold about you, have it corrected, have it erased, or take a copy. Your device data is yours already: use Download my data above. You can object to how we use your data and withdraw consent at any time: every email carries a one-click unsubscribe link, or email [email protected]. A person will reply within seven days.
If you are in the UK or the EU and think we have got something wrong, you can complain to the ICO or to your local data protection authority.
Children
The email list and accounts are not directed at anyone under 16, and the game this app is about is rated for adults. We do not knowingly collect data from children; if you believe we have, email us and we will delete it.
If you sign in
Signing in is optional; everything works without it. If you sign in, Supabase Auth keeps your email address and the times you signed in. If you choose Discord, it also keeps what Discord shares: your account id, email address, Discord username, display name and a link to your avatar. For security, Supabase Auth logs the IP address and browser of each sign-in in a security log, which Supabase keeps for a limited time it sets; email us and we will send you your entries or erase them. Alongside it we keep your stage (and whether you last went back a stage), your spoilers switch, the things you marked as found or ticked, your collection marks and your edition choice, with the time of each change, so your other devices stay in step while you are signed in. Something you removed stays in the account as a removed entry, so your other devices remove it too. The hints you opened stay on this device.
While you are signed in, the sign-in session is kept in this browser's storage until you sign out. It is strictly necessary for the sign-in you asked for, so there is no consent prompt, and it is not a cookie.
On your account page, Download my account data gives you a copy of your account details, progress and marks, and Delete my account deletes your account, your progress and your marks, then signs you out. The sign-in security log is not in that file and that button does not remove it: email [email protected] for your entries or to have them erased. You can also email us and we will delete your account for you.
Links to other services
Links to Discord and to stores or news sites take you to services with their own privacy policies. We do not control what they collect.
Takedown and problems
To report something on the site or ask us to take it down, email [email protected] with "Takedown" in the subject. A person replies within 24 hours.
Changes
The date at the top tells you when this policy last changed. If a change matters to you, for example a new processor or a new kind of data, we will say so on the site, and by email to the list, before it takes effect.
About Explore Theft Auto
Unofficial fan-made app. Not affiliated with, endorsed by or sponsored by Rockstar Games or Take-Two Interactive. Grand Theft Auto, GTA, Rockstar Games and related names and marks are trademarks of Take-Two Interactive Software, Inc. and are used only to describe what this app is about. Nothing is shown before your point in the story. Places come from official material, from openly licensed fan-made maps credited on the about page, and from players after release; we host no leaked images or videos.