Privacy Policy

Last updated 21 Oct 2026. Questions: support@svnlstudio.com.au

Contents

This policy explains what personal information SVNL collects, why we collect it, who we share it with and what you can do about it. It covers SVNL Studio's game servers, the SVNL Discord, this website (svnlstudio.com.au) and your website account.

Right now SVNL runs one game server, for FiveM. If we add a server for another game, we'll update this policy to cover it before that server opens.

SVNL is run from Australia by its owner THRSTXN and co-owner Wings, under the trading name SVNL Studio. For privacy questions and requests, email support@svnlstudio.com.au.

How SVNL approaches privacy law

The Privacy Act 1988 (Cth) and its Australian Privacy Principles (APPs) set rules for handling personal information. Many small businesses aren't covered by the Act, and a business can choose to opt in formally. SVNL hasn't opted in.

Instead, we voluntarily follow practices based on the APPs, and this policy describes them. The promises in this policy, including our response times, are commitments we make to you. Unless the Privacy Act applies to SVNL, they aren't legal rights under the Act.

You can read about privacy law in Australia on the Office of the Australian Information Commissioner (OAIC) website: https://www.oaic.gov.au.

We collect personal information only when we reasonably need it to run SVNL. We use it for the reason we collected it, for a related reason you'd reasonably expect, with your consent, or where the law requires or allows it.

What we collect

Your website account

Your email address.
Your password, stored as a hash. We never store the password itself. If you sign up with Discord, you don't have a password until you choose to set one.
Your two-factor authentication (2FA) secret, stored encrypted, and your recovery codes, stored hashed.
Your sign-in sessions, so you stay signed in.
A record of which version of our Terms of Service, Privacy Policy and Code of Conduct you accepted, and when.

Security records

Security logs and rate-limit records, which use information derived from your IP address. We use them to spot and block attacks such as password guessing.
An audit log of actions taken on the site, including actions taken by staff.

Discord verification

To verify in the SVNL Discord, you agree to our Terms of Service, Privacy Policy and Code of Conduct, and your Discord account is then marked as verified. When you connect to the FiveM server, it checks your Discord account to confirm you're a verified member.

The SVNL bot keeps a record of which version of each document you agreed to, and when. We keep that record even if you close your account.

Linked accounts

If you choose to link them:

your Discord user ID and username
your Cfx.re user ID and username, for the FiveM server

Discord and Cfx.re give us these when you link. We never see your Discord or Cfx.re password.

To join the FiveM server you need an SVNL account with both Discord and Cfx.re linked. So the server can check who may join, the website shares with it which Discord and Cfx.re accounts are linked to each SVNL account: the Discord and Cfx.re user IDs, and an ID number for the SVNL account (never your email address). When you unlink an account, close your SVNL account, or staff disable it, the website tells the game server and that account can no longer be used to join.

Signing up or signing in with Discord

If you sign in with Discord, Discord tells us your Discord user ID and username, and we use them to find the SVNL account linked to that Discord account.

If you sign up with Discord, Discord also gives us the email address on your Discord account and whether Discord has verified it. We use that address for your SVNL account only if Discord has verified it and you keep it. Otherwise we ask for an address and email it a link to confirm it, and your account is only made when you open that link. Until then we keep your Discord ID and username, and your chosen username and email address, for up to 24 hours. The Discord sign-in token is thrown away straight after we read these details.

Your FiveM characters on the website

Once your accounts are linked, the website reads your FiveM characters and stats from the game server and shows them to you, and only you: character names, jobs, job levels and promotions, when you were last seen and how long you've played, each character's cash and bank balances, and how many vehicles and houses each character owns and places it rents. To keep the page quick, the website holds the game server's answer for up to a minute, then discards it; it doesn't keep your balances or counts.

If you share a Rockstar licence with someone (for example on a shared PC), your characters page and weekly recap include every character on that licence.

Weekly recap email

If you turn on the weekly recap in account settings, we record that you turned it on and when, and which weeks we sent you a recap. Each recap is put together when it's sent, from your linked characters' weekly totals on the game server: time played, what you earned and the change in your cash and bank, job progress and job stats, vehicles bought, fish caught, kilometres driven, challenges completed and daily rewards collected. The website doesn't keep those totals. A recap also shows a few totals for the whole server, such as hours played and parcels delivered, which don't identify anyone.

The recap is off unless you turn it on.

FiveM server records

The SVNL FiveM server records:

your game licence identifier
the Discord and FiveM (Cfx.re) identifiers your game sends when you join
your IP address, recorded by the server's admin and ban tools (txAdmin)
which Discord and Cfx.re accounts are linked to each SVNL account, sent by the website so the server can check who may join
your characters and their game data, including inventory, money, vehicles and houses
weekly activity totals for each character: time played, sessions, money earned and the change in cash and bank, job progress and job stats (such as deliveries, fish caught and kilometres driven), vehicles bought, challenges completed and daily rewards
server logs of activity on the server

Reports, appeals and Discord

Reports, appeals and help requests go through tickets in the SVNL Discord. We see what you send us there, including any clips or screenshots, and we keep a transcript of each ticket for up to 12 months.

Messages you post in the SVNL Discord, including in tickets, are held by Discord under its own privacy policy. The SVNL bot also keeps a log of those messages, so staff can moderate the server. The log includes messages that were later edited or deleted: it keeps each message as first posted, and records edits and deletions, with their text, in a staff-only log channel. We keep this log for moderation and never delete it, even if you close your account or ask us to delete your data.

Your subscription

Once the SVNL store is available, the SVNL subscription will be sold through Tebex, which handles payment under its own terms and privacy policy. The SVNL website doesn't collect or store your payment details. If Tebex passes us details of your subscription, we use them to apply your perks and to handle disputes.

Using a nickname

You don't have to give us your real name anywhere on SVNL. Usernames and character names can be made up. You do need an email address and password to have a website account.

How we use it

To run your account: signing you in (with your password or with Discord), checking your 2FA and keeping your sessions.
To keep a record that you've accepted our terms and policies.
To send you emails about your account and its security.
If you've turned it on, to email you a weekly recap of your linked characters' activity.
To protect the website and our game servers with rate limits, security logs, bot checks and the audit log.
To show your FiveM characters and stats on the website once you've linked your accounts.
To run our game servers: checking your Discord verification and that your SVNL account has Discord and Cfx.re linked when you connect, identifying you, and saving your characters and progress.
To handle reports, appeals and support, and to enforce the Code of Conduct and bans.
To meet our legal obligations.

We don't sell your personal information or use it for advertising.

Staff

Staff roles are assigned by the owner and co-owner. Staff with access to the website's staff area can look up an account and its linked Discord and Cfx.re accounts. They use this for support, reports and enforcement.

Service providers

We use these providers to run SVNL. Each one handles your information to provide its service to us:

Cloudflare hosts the website and its database (Cloudflare D1), and provides Turnstile bot protection and Web Analytics (see Cookies and similar technology). Website data and traffic to the site pass through Cloudflare, and it carries the encrypted connection between the website, our Discord bot and the FiveM server.
Resend sends our account emails and, if you turn it on, your weekly recap, and receives email sent to support@svnlstudio.com.au. It receives your email address, the emails we send you (including character names and stats in a recap) and any email you send us there.
RocketNode hosts the FiveM server and its data in Australia.
Discord hosts the SVNL Discord, and gives us your Discord ID and username when you link your account or sign in with Discord (and, when you sign up with Discord, your email address and whether Discord has verified it).
Cfx.re gives us your Cfx.re ID and username when you link your account.
Tebex will sell and manage the SVNL subscription, under its own privacy policy, once the store is available.

Discord and Cfx.re have their own privacy policies for the information they hold about you.

When the law requires it

We may disclose information if the law requires it, for example in response to a valid request from police or a court. We may also disclose it where that's needed to prevent a serious threat to someone's life, health or safety.

Where your information is stored

The FiveM server and its data are hosted in Australia by RocketNode. Other information is stored or processed overseas:

Cloudflare, a US company, hosts the website and its database on a global network. Website data and traffic may be processed in any country where Cloudflare operates, including the United States.
Resend, a US company, sends and receives our email from its Tokyo, Japan region, so your email address and those emails are processed in Japan and may also be accessed from the United States.
Discord, a US company, handles what you post in the SVNL Discord, your verification, and your linked Discord details, under its own privacy policy.
Cfx.re may handle your linked Cfx.re details overseas under its own privacy policy.
Tebex, a UK company, will handle subscription payments under its own privacy policy once the store is available.

We use established, reputable providers and rely on the security and privacy safeguards each of them publishes.

How we protect it

Passwords are stored as hashes, never as plain text.
Accounts use 2FA with an authenticator app, and recovery codes as a backup.
2FA secrets are encrypted, and recovery codes are hashed.
Traffic to and from the website is encrypted in transit (HTTPS).
Traffic between the website and the game server is encrypted (HTTPS).
Rate limits and Turnstile slow down password guessing and bot sign-ups.
Only staff with a role assigned by the owner or co-owner can use the staff area.

No system is completely secure. If a data breach is likely to cause you serious harm, we'll tell you as soon as we can. If the law requires us to notify anyone else, we will.

How long we keep it

When we no longer need personal information, we delete or de-identify it.

Website account data: while your account exists. After you close your account, we delete its website data within 30 days.
Inactive website accounts: if a website account hasn't been used for 24 months, we may delete it. We'll email you a warning first.
Sessions: until you sign out or the session expires.
A Discord sign-up that's waiting on its last step: up to 30 minutes, or up to 24 hours while we wait for you to confirm your email address.
Security logs and rate-limit records: up to 90 days.
Audit log: up to 90 days.
Linked Discord and Cfx.re details: until you unlink them or close your account. The game server's list of linked accounts follows the same changes, usually within seconds and always within 10 minutes.
Your weekly recap setting: until you turn it off or close your account.
The record of which weekly recaps we sent: 8 weeks.
Weekly activity totals on the FiveM server: 10 weeks.
FiveM server data: until you close your account and ask us to delete all your data, or until a wipe or reset removes it.
Support ticket transcripts: up to 12 months, then deleted.
Ban and enforcement records: for as long as the ban applies. We keep permanent ban records while the ban stands, and review them if the ban is lifted or appealed.
Fraud and chargeback records: for as long as we need them to handle the dispute and enforce any ban.
Discord message log: kept for moderation and never deleted (see "Reports, appeals and Discord").
Website backups: deleted website data can remain in database backups for up to 30 days, the window Cloudflare D1 keeps for restoring the database.
FiveM server backups: our host, RocketNode, keeps these with no set expiry date, so deleted game data can stay in a FiveM server backup indefinitely.

Closing your account

You can close your website account on the website. It stops working straight away, and we delete its website data within 30 days. Closing your account on its own doesn't delete your in-game data: your characters, inventory and other game server records stay on the server.

Closing your account and deleting all your data

When you close your account, you can also ask us to delete all your data, in and out of game. Your account keeps working for 72 hours so you can change your mind, then it closes and your request goes to the government office in the city, where staff with the right access check and carry it out. We finish within 30 days.

We check each request is really from you: it has to come from your signed-in account, with your password and two-factor code (or, for an account made with Discord, a fresh Discord sign-in), and we can only find your characters through the Discord and Cfx.re accounts you've linked. If you haven't linked either, we can only delete your website data. If you can't use the website, staff can file the request for you once they've checked who you are.

What happens:

your characters are deleted
houses you own pass to the next person who holds a key, or go back on the market, and what was stored in them is taken into government care
your vehicles become government property and are no longer linked to you
money in your accounts goes to the city government
shops and businesses you own go back on the market
your phone, bank, licence and other character data is deleted
the links between your Discord and Cfx.re accounts and your game licence are deleted

Some records are kept after a full deletion because we need them to enforce bans, prevent fraud and protect SVNL, or because they're part of the game world:

ban and enforcement records, for as long as the ban applies
if the account was disabled for breaking the rules, a one-way code (an HMAC) of its email address and of its linked Discord and Cfx.re IDs, so they can't be used for a new SVNL account, for as long as the ban applies
fraud and chargeback records, for as long as we need them to handle the dispute and enforce any ban
security logs and audit log entries, for up to 90 days
police records about your characters, kept as part of the game world and marked to show the character has left the city permanently (only the character's name and date of birth are kept with them, and they're no longer linked to you)
the in-game record of your request, which shows only your characters' names and IDs, for up to 90 days
the game server's log of requests from the website, for 30 days
the SVNL bot's Discord message log and the record of the documents you agreed to

We delete or de-identify these once we no longer need them. Support ticket transcripts follow their own limit and are deleted within 12 months of the ticket. Deleted data can also stay in backups, as set out in the list above: website backups for up to 30 days, and FiveM server backups with no set expiry.

Your choices and requests

These are commitments we make voluntarily, as explained in "How SVNL approaches privacy law" above.

See your information: you can ask for a copy of the personal information we hold about you.
Correct it: you can ask us to correct information that's wrong, out of date or incomplete. You can also update some details yourself in account settings.
Delete it: you can close your account, and choose to have all your data deleted too, as explained above.
Unlink accounts: you can unlink your Discord or Cfx.re account at any time in account settings on the website. This removes that account's ID and username from your SVNL account.
Weekly recap: turn it off any time in account settings, or with the unsubscribe link in any recap. The link works without signing in.

To ask for a copy of your information or a correction, email support@svnlstudio.com.au. We'll check the request comes from you, for example by asking you to send it from your account email or confirm it while signed in. We'll respond within 30 days. If we can't do what you've asked, we'll tell you why.

Cookies and similar technology

The website sets only essential cookies of its own: a session cookie that keeps you signed in, and a few short-lived cookies used while you finish a two-factor sign-in, sign in or sign up with Discord, or link your Cfx.re account. Each lasts 10 minutes, except the one for finishing a Discord sign-up, which lasts 30. The site can't work without them, so you can't turn them off.

Cloudflare, which hosts the site, also protects it from bots and attacks. Its Turnstile check on some forms, and its other security services, process technical information about your device and browser, such as your IP address and browser details, to tell people from bots. Cloudflare may store short-lived security data in your browser to do this. It's used for security only, and Cloudflare's privacy policy covers it.

We use Cloudflare Web Analytics to count visits and measure how fast pages load. It uses no cookies, no fingerprinting and no tracking across other sites. It records the page you visited, the site you came from, your country, and your browser and device type, and we only see totals.

We don't use advertising cookies or any other analytics, and we don't use any of this information for advertising.

Children

The SVNL Discord, the website and the FiveM server are for people 18 and older. We don't knowingly collect information from anyone under 18. If you think someone under 18 has an account or has given us their information, email support@svnlstudio.com.au. We'll close the account and delete their information, apart from records we have to keep, such as ban records.

Complaints

If you're unhappy with how we've handled your information, email support@svnlstudio.com.au with the details. We'll reply within 30 days and try to put things right.

If the Privacy Act applies to SVNL in future, you may also be able to complain to the OAIC. You can learn more about privacy in Australia at https://www.oaic.gov.au.

Changes to this policy

We may update this policy. The date at the top shows the current version. We'll announce significant changes on this site or in the Discord.

Contact

Email support@svnlstudio.com.au for privacy questions, requests and complaints.