Summary
We use Google Tag Manager to load analytics that show which pages and map features are used. Visitors in the EEA, the UK and Switzerland are asked first, and no analytics cookies are set unless they accept. We do not use advertising networks or data brokers, and we never sell visitor information. When you use the GTA 6 interactive map or the GTA 5 interactive map without signing in, your map style preferences and marked locations stay strictly in your own browser.
Creating an account is completely optional and exists only to sync your found markers and favorites across devices. If you choose to sign in, we store your email address (along with your name and profile picture if you use Google sign-in) and your saved marker list. You can permanently delete your account and all associated data anytime from the account page.
Visiting the site
GTAMap is hosted on Cloudflare. Like any standard web server, Cloudflare processes your IP address, browser user agent, and requested page URLs to deliver the site and guard against abuse. We use request logs solely to keep the service running and secure, and they are automatically deleted within seven days.
When you view the GTA 5 map in a development environment without self-hosted tiles, your browser may load map images from GitHub's raw file network, which receives your IP address to serve those files.
Accounts
Signing in is optional. When you use an email sign-in link, we process your email address to identify your account and send the link you requested. If you choose "Continue with Google", we receive your Google account identifier, name, email address, and profile picture URL as shared by Google when you approve the sign-in. We never receive your Google password or access any other Google data.
To keep you signed in and help spot suspicious activity, we store a session record containing the IP address and browser user agent used at sign-in, alongside the IDs of markers you have marked as found or favorite on each map. We also keep short-lived rate-limit counters keyed by IP and email address so sign-in links cannot be spammed. Our legal basis for processing this information is to provide the account sync service you requested and our legitimate interest in keeping accounts secure. We never use your email for marketing.
Analytics
Every page loads Google Tag Manager (Google LLC), which runs the analytics tags we configure in it. They record the pages you view, how you reached the site, rough location derived from your IP address, device and browser type, and which map features you use. We use this only in aggregate to decide what to build and fix, and our legal basis is your consent where the law requires it and our legitimate interest in improving the site elsewhere.
We use Google Consent Mode. In the EEA, the UK and Switzerland, analytics storage stays off until you click Accept on the consent bar; if you decline or ignore it, Google tags may still send cookieless pings without identifiers. Everywhere else analytics is on by default. Wherever you are, you can change your choice at any time with the Cookie settings link at the bottom of every page.
Cookies and local storage
If you accept analytics (or are outside the EEA, the UK and Switzerland and have not declined), Google Analytics sets first-party cookies whose names start with _ga. They last up to two years and let Google count you as the same visitor across visits. All our other storage is strictly necessary for features you choose to use. Session cookies starting with gtamap. (and prefixed with __Secure- over HTTPS) keep you signed in. They are HttpOnly, meaning page scripts cannot read them, and they are set only when you sign in. Short-lived security cookies are also set during the Google sign-in flow.
Your browser's local storage remembers your chosen map style, visible layers, found and favorite markers, your analytics choice, and a simple flag indicating whether you have an active session on this device. For the current browsing session we also remember whether your region needs the consent bar. You can clear local storage anytime through your browser settings, and signing out clears your synced progress from the device.
Service providers
We rely on a small set of infrastructure providers to run the site. Cloudflare, Inc. handles web hosting, our D1 database, and transactional sign-in emails through Cloudflare Email Service. Cloudflare also tells us your country so we know whether to show the consent bar. Google LLC provides Google Tag Manager and analytics as described above, and processes sign-ins when you click "Continue with Google". Resend acts as a backup email provider for sign-in links if our primary email service is unreachable.
These providers may process data outside your home country, including in the United States, under their respective data protection terms and standard contractual clauses.
How long we keep data
One-time sign-in links expire after 15 minutes and are stored only as cryptographic hashes. Active sessions expire after 30 days of inactivity or immediately when you sign out, and rate-limit counters reset within a few minutes. Your account and saved marker progress remain stored until you delete your account, which removes everything immediately and permanently.
Your rights
Depending on where you live, including under the GDPR, UK GDPR, Brazil's LGPD, or California's CCPA, you have the right to access, correct, export, or delete your personal data, as well as to object to or restrict its processing. You can view and delete your account directly on the account page. For any other requests, email us at hello@gtamap.io. You also have the right to lodge a complaint with your local data protection authority.
Children
GTAMap is an informational reference site covering games rated for adults and is not directed at children. Please do not create an account if you are under 16 or below the minimum digital consent age in your country.
Changes and contact
Whenever we update this policy, we revise the date at the top of the page. If we ever introduce advertising, we will update this policy beforehand and ask for consent where required by law. If you have any questions, email hello@gtamap.io or visit our contact page.