Privacy policy

This privacy policy covers the websites vicelocals.de and vicelocals.com and the “Vice Locals” Android app. This English version is a translation for your convenience; only the German version (Datenschutzerklärung) is legally binding.

Last updated: 24 October 2026

1. Controller and contact

The controller responsible for data processing on this website and in the app within the meaning of the General Data Protection Regulation (GDPR) is:

Niklas Schreckling
c/o MDC#1916
Welserstraße 3
87463 Dietmannsried
Deutschland
Email: nschreckling@gmail.com

For any privacy question or to exercise your rights, contact us at [email protected] (or via “Support & feedback” in the app). See also the legal notice (Impressum). We have not appointed a data protection officer because we are not legally required to.

2. Key points at a glance

• No ads, no tracking, no analytics or statistics tools, no selling of data.
• You can use the site without an account. You only need one (sign-in with Discord) for comments, favorites across devices, your own markers, guides, points and the Local Pass.
• We only use strictly necessary cookies and storage – which is why there is no cookie banner (section 6).
• Connections to third parties only happen where expressly described below (e.g. Discord, YouTube and Spotify only after a click, your browser’s push service).

3. Hosting

The website, database and Discord bot run on a virtual server at Oracle Cloud Infrastructure (Oracle) in the Frankfurt am Main data centre (region eu-frankfurt-1). Oracle processes the data solely on our behalf under a data processing agreement (Art. 28 GDPR, Oracle Data Processing Agreement). The data is stored in Germany. Because Oracle belongs to a US group, access from third countries (e.g. for support or on official order) cannot be ruled out entirely; this is covered by the EU-US Data Privacy Framework (EU Commission adequacy decision) or the EU Standard Contractual Clauses. Legal basis: our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).

4. Cloudflare and domains

For vicelocals.de and vicelocals.com we use Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) as DNS service and reverse proxy: every request to vicelocals.de or vicelocals.com passes through Cloudflare’s network, which delivers the site faster and protects it against attacks (e.g. DDoS) and bots. Cloudflare processes your IP address and the data of your request (requested address, browser information, time) and forwards it to our server. If automated access is suspected, Cloudflare may set a strictly necessary security cookie (e.g. __cf_bm, about 30 minutes). Cloudflare acts as our processor (Art. 28 GDPR, Cloudflare Data Processing Addendum); the transfer to the USA is based on the EU-US Data Privacy Framework, supplemented by the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(f) GDPR (secure, fast delivery); for the cookie § 25(2) no. 2 TDDDG.

Both domains are registered with STRATO AG (Berlin), which acts solely as domain registrar; DNS and delivery for both domains run via Cloudflare. All content and data is stored only on our server in Frankfurt.

5. Server logs and backups

For every request our web server logs: IP address, date and time, request method, requested address (incl. domain), HTTP status, amount of data transferred, response time, referrer (previously visited page) as well as user agent and browser hints (browser, operating system, device type). Cookie contents are not logged. Purpose: delivering the site, troubleshooting and fending off abuse and attacks (Art. 6(1)(f) GDPR). Logs are deleted automatically after 14 days, unless a specific security incident needs further investigation.

To protect against spam and overload, we briefly count requests per IP address or per account (rate limiting). These counters are kept in memory only and expire after a few minutes.

We back up our database daily on the same server; each backup is deleted after 14 days. Deleted data therefore also disappears from the backups no later than 14 days after deletion (Art. 6(1)(f) GDPR, protection against data loss).

6. Cookies and local storage

We only use cookies and local storage that are strictly necessary for the features you use to work at all (§ 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). No consent is required for these, so we don’t show a cookie banner. There are no advertising, tracking or analytics cookies. Subsequent processing is based on Art. 6(1)(b) or (f) GDPR. Features that need consent (YouTube player, push notifications) only start after you expressly click.

Local storage (localStorage/sessionStorage): In your browser – without anything being sent to us – we store: map favorites saved without logging in (once you log in, we add them to your account), the chosen map view, the country for the status page, dismissed notices and language hints, whether you have already seen the intro, volume/mute of the music player on the maintenance page and – only for the current session – whether the site is running in the app. These entries remain until you delete them in your browser settings.

Offline storage: A service worker stores program files (scripts, styles, fonts, images) and up to 40 recently visited pages in your device’s cache so the site loads quickly and also works offline. The cache stays on your device and can be cleared in your browser or app settings (“clear storage”).

7. Account and sign-in with Discord

You create an account by signing in with Discord (Discord OAuth2, scope identify). We receive and store your Discord ID, username, display name and avatar as well as the time of sign-up and last login; we do not receive your email address. We do not store access tokens. The purpose is to provide your account and its features (Art. 6(1)(b) GDPR). We keep this data as long as your account exists.

To sign in, you are redirected to Discord. For users in the EEA the provider is Discord Netherlands BV (Amsterdam); its parent company is Discord Inc. (San Francisco, USA); transfers to the USA are covered by the EU-US Data Privacy Framework. Processing by Discord itself is governed by Discord’s privacy policy.

Avatars: Profile pictures of Discord accounts (e.g. on comments, guide authors or your own account) are loaded by your browser directly from Discord’s CDN (cdn.discordapp.com). Discord thereby receives your IP address and browser information. Legal basis is our legitimate interest in showing posts with their authors’ profile pictures (Art. 6(1)(f) GDPR); Discord participates in the EU-US Data Privacy Framework.

Deleting your account: You can delete your account yourself at any time at vicelocals.com/delete-account (also linked in your profile and in the footer; works the same in the app). Alternatively, email us at [email protected] with your Discord username or create a ticket in the “Account” category. Deletion takes effect immediately: your account, Local Pass (incl. generated images), comments, favorites, private markers, pending or rejected marker suggestions and corrections (incl. images), points, role requests, drafts, submissions, notifications, your support tickets with messages and screenshots, push subscriptions linked to your account and all sessions are deleted. Guides already published and accepted map contributions remain without your name (anonymized). Server logs and backups disappear after 14 days (section 5); team role and moderation logs after 12 months and Discord server tickets after 30 days (section 8).

8. Discord server and bot

Joining: After signing in we may ask whether you want to join our Discord server. Only if you choose “Yes” do we use the additional scope guilds.join once; the access token is kept in your server-side session for at most one hour. “Don’t ask again” is saved on your account.

Roles and commands: If your account is linked to the server, our bot assigns Discord roles matching your community rank and team role and keeps them in sync, shows your Local Pass for /localpass and /rank, and posts a welcome card with your Discord name, avatar and join date in the #welcome channel when you join. Changes to team roles and manually awarded points are logged (audit log) so the team can trace and revert them (Art. 6(1)(b) and (f) GDPR). Leaving the server ends the role sync.

Moderation: To protect the community against spam, scams and malicious links, the bot automatically checks new messages in our server (e.g. links from very new accounts, message floods, posts in a channel set up as a trap). It may delete such messages and temporarily mute or remove accounts; the team can review and lift any measure at any time. Moderation actions (affected account, reason, channel, a short message excerpt where applicable, acting person) are logged. Legal basis: Art. 6(1)(f) GDPR (community safety).

Tickets in the Discord server: If you open a ticket there, a private channel is created that only you and the team can see. When it is closed, you receive the transcript by direct message; a copy goes to an internal team channel. We delete ticket data after 30 days.

Retention: Moderation and role logs are deleted automatically after 12 months. Content in the Discord server itself is stored by Discord under its own rules.

Bot on other servers: The public Vice Locals bot, which server admins can add to their own servers, is covered by the separate bot privacy policy.

9. Comments, favorites, markers and points

• Comments are shown publicly with your display name and avatar and remain until you delete them, the team removes them or your account is deleted.
• Favorites and private markers on the map are visible only to you.
• Marker suggestions and corrections (title, category, position, description, optionally an image) are reviewed by the team. Images are re-encoded and metadata such as EXIF/GPS is removed. Accepted contributions appear on the map with your display name and rank as “suggested by” or “corrected by”.
• Points and ranks are calculated from your approved contributions (e.g. guides, markers, corrections) and any points awarded by the team. You appear on the public leaderboard unless you have set your Local Pass to private.

The legal basis in each case is Art. 6(1)(b) GDPR (use of the community features). We keep this data as long as your account exists.

Local Pass: Your Local Pass is public by default. We generate the pass image (card and story format) on our server from your display name, avatar, community rank, pass number and sign-up month; your avatar is fetched from Discord’s CDN by our server and cached there, the rendered images are cached until your data changes. Your public pass page lives at a random address (/pass/…, not your user number). It shows only your display name, avatar, rank (including Ocean Drive VIP or team role), pass number, “resident since” and your approved guides – never your Discord ID, username or email; the avatar is delivered through our server, so the Discord ID is not exposed. Your favourite spot only appears in the image you download yourself. While your pass is public, your name and avatar in guides, comments, on the map and on the leaderboard link to it; while it is private, your name is shown without a link and the pass address is never published. Public pass pages are excluded from search engines (noindex) and are not listed in our sitemap. You can make your pass private at any time with the switch on your Local Pass in your profile (and public again later); the page and its images are then no longer available and you no longer appear on the leaderboard. We store whether you made that choice yourself (Art. 6(1)(b) and (f) GDPR – presenting the community; you can object at any time by setting the pass to private).

10. Community guides

If you write a guide, we store its title, category, language, text, optional cover image and map link, its status (draft, submitted, approved, rejected, changes requested), timestamps, and any review note from the team, linked to your account (Art. 6(1)(b) GDPR). Drafts and submissions are visible only to you and the Vice Locals team (admins and moderators). Approved guides are published with your Discord display name, avatar and community rank; the team may translate them into the other site language (using a self-hosted translation service on our server, without external providers) and mark them as official. Uploaded cover images are checked, re-encoded and resized on our server; metadata such as EXIF/GPS is removed. We store on-site notifications about review decisions until your account is deleted. To prevent spam we limit the number of open submissions; the team can block an account from submitting. You can delete drafts at any time; if your account is deleted, your drafts, submissions and notifications are deleted too, while already published guides may remain without your name. To have a published guide removed, contact us (see section 1).

11. Support & feedback, contact by email

Support tickets: Via “Support & feedback” (mainly in the app) you can report problems or send suggestions. We store the subject, category, your messages and our replies, language, timestamps and status, whether the ticket came from the app, app version, device model and the Android or browser version (from the user agent) and – if you attach one – a screenshot. Screenshots are re-encoded (metadata removed) and can only be accessed by you and the team. With an account, the ticket is linked to your account; without one, you provide a way to contact you (email address or Discord name), and the vl_support cookie gives you access to your tickets. We show team replies to you on the site and, if you wish, by push (section 12). Purpose: handling your request and improving the app (Art. 6(1)(b) and (f) GDPR).

So the team can respond quickly, a new ticket triggers a message in an internal, non-public team channel on our Discord server: ticket number, category, subject, the first up to 300 characters of your message, whether it comes from an account or a guest, app/web with version and language – without your contact details. For further replies, a short notice follows at most every 30 minutes. These messages are transmitted via Discord (see section 7).

Retention: Support tickets are deleted automatically together with their messages, screenshot and links 12 months after the last activity (last message or status change), so that we can see what has already been discussed if a problem comes back.

Email: Emails to [email protected] are received by Cloudflare Email Routing (Cloudflare, Inc., USA; see section 4) and forwarded to our mailbox at Google (Gmail; Google Ireland Limited, Dublin, Ireland, parent company Google LLC, USA), where they are stored. Transfers to the USA are covered by the EU-US Data Privacy Framework. We process your email address, name and the content to handle your request (Art. 6(1)(b) or (f) GDPR) and delete the emails once the matter is settled, at the latest after 12 months, unless statutory retention obligations apply.

12. Push notifications

If you wish, we send you push notifications (e.g. Rockstar/PSN/Xbox outages for chosen platforms and regions, news, patch notes or replies to your support tickets). Your browser or Android asks for your permission first. We then store your device’s push address (endpoint) with the associated keys, your chosen categories, platforms and regions, the language, whether you subscribed in the app, timestamps and technical delivery information (last successful delivery, failed attempts) and – where applicable – the link to your account or tickets. We log delivered messages for 60 days to avoid duplicate deliveries.

Messages are delivered encrypted via the push service of your browser or device vendor (e.g. Google Firebase Cloud Messaging for Chrome and the Android app, Mozilla for Firefox, Apple for Safari, Microsoft for Edge); it receives the push address and technical connection data, but not the content. These providers may process data in the USA; Google, Apple and Microsoft participate in the EU-US Data Privacy Framework.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time – via “Unsubscribe on this device” on the notifications page or in your browser or Android settings. When you unsubscribe, we delete the subscription immediately; likewise if the push service reports the address as invalid or deliveries keep failing. Subscriptions without any category switched on, without an account and without a linked ticket are deleted automatically after 30 days.

13. Android app

The “Vice Locals” Android app (distributed via Google Play) shows this website as a so-called Trusted Web Activity in Chrome or another compatible browser on your device. The same processing as on the website therefore applies; cookies and storage are kept in your device’s browser. The app itself contains no advertising, analytics or tracking libraries and collects no additional data. It only asks for permission to show notifications (push, section 12) and uses internet access. So that display and support work properly, the app tells the website that it is running as an app and which version it is (cookies in section 6). Google is responsible for downloads, installation and updates via Google Play; Google’s privacy policy applies.

14. YouTube videos, Spotify and external content

Trailers are embedded in privacy-enhanced mode (youtube-nocookie.com) and only loaded once you click “Play”. Only then is data (including your IP address and device information) transferred to Google Ireland Ltd. / Google LLC, and YouTube may store data on your device (legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG – consent by clicking; transfer to the USA based on the EU-US Data Privacy Framework).

Spotify player on the radio page: On /radio we offer an embedded Spotify playlist player from Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. It is click-to-load: until you click “Load Spotify player”, no connection to Spotify is made at all, only a local placeholder is shown. Only after the click is the player loaded from open.spotify.com; data (including your IP address, device and browser information, the page visited and, if you are logged in to Spotify, your account) is then transferred to Spotify, and Spotify may set cookies or similar technologies on your device. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG – consent by clicking; you can withdraw it at any time with effect for the future by reloading the page or leaving it. Spotify may also process data in third countries, in particular the USA; such transfers are based on the EU Commission’s standard contractual clauses (SCC) and, where the recipient is certified, the EU-US Data Privacy Framework (DPF). We do not host, stream or proxy any audio ourselves; the “Listen on Rockstar” buttons are plain links to rockstargames.com. More information: Spotify privacy policy.

Music on the maintenance page: During maintenance, the maintenance page may show a music player. It uses the official YouTube IFrame Player API; we don’t store or host any audio files ourselves. Until you click “Play”, no connection to YouTube/Google is made at all. Only after the click are the player script from www.youtube.com and the privacy-enhanced player from www.youtube-nocookie.com loaded; this transfers, among other things, your IP address and device information to Google Ireland Ltd. / Google LLC (legal basis as above). Your chosen volume and mute setting are only stored locally in your browser (localStorage) and never sent to us. Music never starts automatically.

Video background on the maintenance page: The moving city scenes are fictional, self-generated clips hosted on our own server – no YouTube, no third-party connection. They are not loaded at all if your browser signals data saving (Save-Data) or reduced motion; then only a still image is shown.

Fonts and maps: Fonts, the map library (Leaflet), map tiles and place photos are served from our own server – no connection to Google Fonts, map services or CDNs. Links to external sites (e.g. sources or other community maps) only open them after you click; the respective provider’s privacy rules apply there.

15. Recipients at a glance

On our side, your data is seen only by the operator and the Vice Locals team (admins, moderators/editors) where needed for their tasks. External recipients are exclusively the service providers named above: Oracle (hosting), Cloudflare (proxy, DNS, email forwarding), Google (mailbox, push for Chrome/Android, YouTube after a click), Spotify AB (Spotify player after a click), Discord (sign-in, server, avatars, team notices) and the browser vendors’ push services. We do not sell data. We only disclose data to authorities if we are legally obliged to (Art. 6(1)(c) GDPR).

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). An informal message to [email protected] is enough. You can delete your account yourself at any time at vicelocals.com/delete-account.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint: You may lodge a complaint with any data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.

17. Further information

• No obligation to provide data: You are under no statutory or contractual obligation to provide us with data. Without the technically necessary connection data we cannot deliver the site, though, and without signing in the account features are not available.
• No automated decision-making: We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR), and we do no profiling. The automatic spam protection in the Discord server (section 8) can be reviewed and lifted by the team.
• Age: Vice Locals is a fan site about a game aimed at adults. To sign in you must meet Discord’s minimum age in your country. If you are under 16, you may only give consent (e.g. for push notifications) with your parents’ approval.
• Security: All connections are encrypted via HTTPS/TLS; access to the server and admin area is restricted to the team.
• Changes: We update this privacy policy when our services or the law change. The version published here applies; the date at the top shows when it was last updated.