Privacy policy. What we hold, and what you can do about it.

01In short

This policy explains what personal data we process, why, how long we keep it and how to use your rights. In a few lines:

• We keep only what it takes to run the service, protect it and comply with the law.
• The site carries no advertising and no audience measurement, and your data is never sold. Its only cookies are needed by the service or remember a choice you made (cookie policy).
• For the media our customers' game servers send us, we act on behalf of those customers, who decide about it.
• A player can open a player space to find their media: we keep only what it needs there, with no password and no email address, and the player deletes it whenever they want.
• From your account, you can download your data, correct your name and email address, and delete the account.
• For any other request, write to us (see Using your rights): we answer within one month.

02Data controller

The controller of the processing described here is Aperture, which publishes Aperture. Its details are as follows.

Requests about your data go to the contact given under Using your rights.

03Controller or processor

Depending on the data, our role under the GDPR is not the same:

• Controller for accounts, the site, the security of the service, the data a hosting provider must keep, content reports and the player space. We then decide why and how the data is processed, and each of these processing activities is described below.
• Processor for the media and player data our customers send us from their game servers. The customer organisation is the controller: it decides what is sent, shared and kept, and we process this data only to host it, deliver it and, if it opened the player space, show it to its players, on its instructions. The data processing agreement annexed to the terms of use governs this role.

The same piece of data can fall under both roles. The IP address an upload comes from is processed for the customer, but we then keep it in our own name, because the law requires it of every hosting provider (see What the law makes us keep).

04Visiting the site

The site has no audience measurement, no advertising and no social media buttons, and its pages load no font or script from another site.

So that forms work and the site stays protected, every visit opens a session, with or without an account. The server keeps for it:

• the IP address and the description the browser sends of itself (its name, its version and the operating system);
• the time of the last activity, and the state of the session: the form security token, the language chosen, the signed-in account if there is one.

Legal basis: our legitimate interest in running the site and protecting it (GDPR art. 6(1)(f)).

Retention: a session expires after 120 minutes without activity, then the automatic session cleanup erases it. The status page opens no session, and media files are served from an address other than the site's, with no cookie at all.

The cookies and browser storage the site uses are detailed in the cookie policy. None needs your consent: each is needed by the service or only remembers a choice you made.

05Your account and organisations

To open your account and provide the service, we process:

• your name, your email address and your password, kept only in hashed form;
• the display language you chose and the last organisation you opened;
• the version of the terms of use you accepted and its date, with an entry in the security log that keeps the proof;
• your organisations: their name, identifier, logo, settings, members and each member's rights;
• the invitations their members send, with the invited email address, and the API keys they create;
• requests for a different offer, with the message that comes with them if there is one.

Your name, email address and password are required: without them we cannot open an account. If an operator created your account, the operator gave us your name and address. If a member invited you to an organisation, we got your address from that member, and it is used only to attach you to the organisation when you accept.

Payment for a paid offer is arranged outside the site. The accounting records it produces are kept for the period the French Commercial Code requires.

Legal basis: performance of the contract formed by the terms of use (GDPR art. 6(1)(b)), and for accounting records a legal obligation (art. 6(1)(c)).

Retention: as long as the account is open. An organisation's data (members, invitations, keys, offer requests) stays as long as the organisation exists. What remains once the account is closed is described under After your account is deleted.

06Security log

To protect accounts, spot abuse and be able to establish what happened after an incident, we keep a log. It records:

• each sign-in to an account, with the IP address and whether you chose to stay signed in;
• refused sign-in attempts, with the email address typed and the IP address;
• significant actions on accounts, organisations, their members, keys and media, with their author, the author's email address and the IP address they came from;
• for each API key, the date and IP address of its last use and of its last refusal. That address can belong to the player whose game made the upload.

The platform's log can be read only by authorised operators. An organisation's activity log is shown to its members according to their rights, and IP addresses only to those who manage members. The sessions open on your account, with their IP address and browser, are listed on your account page, where you can end them.

Temporary counters slow down repeated attempts (sign-in, sign-up, reports, player space sign-in): they tie a number of attempts to the IP address, and for sign-in to the email address typed, then expire on their own at the end of their short window.

Legal basis: our legitimate interest in securing the service and protecting accounts (GDPR art. 6(1)(f)).

Retention: log entries are erased after 365 days, and API key IP addresses 365 days after the use they describe. If you tick "Stay signed in", this browser stays recognised for 365 days.

07What the law makes us keep

Like every hosting provider, we must keep certain data so that a judicial authority can, on request, identify the person behind content put online (article 6 of the French law on confidence in the digital economy, and decree no. 2021-1362 of 20 October 2021):

• the account's name and email address, with the dates it was opened and closed and who closed it (its holder or an operator), for 5 years after it closes;
• the IP address each media upload comes from, for 365 days after the upload. It can belong to the player whose game made the upload.

No screen of the service shows the archive of closed accounts. This data is disclosed only to authorities that request it within the framework the law provides, and is deleted automatically at the end of its period.

Legal basis: a legal obligation (GDPR art. 6(1)(c)).

08Content reports

Anyone can report hosted content they believe to be illegal, with the report form. To handle a report, we keep:

• the address of the content, the reason chosen and the explanation given;
• the name and email address of the person reporting, except for child sexual abuse, which can be reported without them;
• the statement of good faith, then the decision taken, its grounds, its date and the operator who took it;
• the IP address it was sent from, noted in the security log.

Every report is reviewed by a person. The name and address of the person reporting are seen only by the operators handling the report, so they can answer if needed: the tracking page shows only the date, the status and the decision, and we do not disclose that identity to the organisation concerned.

Legal basis: a legal obligation, under the EU Digital Services Act (arts. 16 to 18) and article 6 of the French law on confidence in the digital economy (GDPR art. 6(1)(c)).

Retention: until the decision, then 365 days; the report is then deleted along with its author's details. The security log entry follows the log's own period.

09Media and player data

Our customers are organisations, most often game servers, that send us their players' screenshots, videos and voice messages to host them and show them in game. For this data, the organisation is the controller and we are its processor. It includes:

• the files themselves, and whatever they show or let you hear;
• the game identifiers the game attaches to the upload for the player, among their Rockstar licences and their Discord, Steam and Cfx.re accounts (the other identifiers FiveM provides, the player's IP address among them, are dropped on receipt), their name, and any other information the game adds;
• the file's original name, format, size, dimensions or duration, how many times it was viewed and when it last was;
• the IP address the upload came from, which we also keep in our own name (see What the law makes us keep).

The organisation decides what is sent, what is shared and how long it is kept: its settings can delete media automatically. A deleted media spends 7 days in the recycle bin, where the organisation can restore it, then its files are erased. Every file gets a public address: anyone who knows it can open the file, without an account. Share pages, on by default and which the organisation can turn off, add a page for each media and a preview on the services where its link is posted, such as Discord.

If the organisation opens the player space, we also show each player who signs in there the media sent under one of their identifiers, of the kinds the organisation chose, and only those sent by a key it marked as feeding the space. That is its instruction: it opens and closes the space in its settings, and closing it removes its media from its players' spaces at once.

We do not use this data for our own purposes, except to handle a report, protect the service or meet a legal obligation.

Are you a player? Contact the game server concerned first: it decides about your data and can delete its media. Its name appears on a media's share page. If you write to us, we pass your request on to the organisation concerned when we can identify it, and we let you know. For a screenshot, clip or recording that shows you without your consent, you can also use the report form, with the reason "My image or my personal data".

10Player space

The player space lets a player find the media a game server sent us under their identifiers, once that server has opened it. For this space, we are the controller ourselves. Its terms, which the player accepts on their first visit, give the essentials. We process:

• the identifier of each Discord, Steam or Cfx.re account the player links to their space;
• the display name of the first linked account that passes one on (Steam does not);
• the date of their last sign-in;
• when they accepted the terms of the space and confirmed being 15 or older.

No password and no email address is asked for. The access Discord or Cfx.re gives us during the sign-in is revoked as soon as the identifier is read, and nothing else is kept from the account. Like every visit, the space opens a session (see Visiting the site).

Source: the identifier and the name come from the provider the player chooses, Discord, Steam or Cfx.re, through the sign-in they start themselves. That provider handles the sign-in under its own responsibility, by its own rules, and may be established outside the European Union. The rest comes from the way the player uses the space.

Purpose: to show the player the media sent under one of their identifiers by the servers that opened the space, of the kinds each one chose to show. An identifier can be linked to one space only, so that nobody sees the media of someone else. The space is visible to its player alone: servers see neither who opened one nor the accounts linked to it.

Legal basis: performance of the terms of the space, which the player accepts before it opens (GDPR art. 6(1)(b)).

Retention: until the player deletes their space. Deletion is immediate and erases the whole space, linked accounts included. The space's sign-in cookie, set on every sign-in, lasts 365 days (cookie policy) and is of no use once the space is deleted.

Your rights: the space's My account page shows the linked accounts, lets you link others and deletes the space. For any other request about the space, write to us (see Using your rights). Deleting the space does not delete the media: they remain those of the server that sent them, which is who to ask about them (see Media and player data).

11Retention periods

The table below lists each retention period, taken from the service's own settings. At the end of its period, a piece of data is deleted automatically.

Account and organisation data is kept as long as they exist, and media according to their organisation's retention settings.

12Recipients

Your data is neither sold nor rented, and is never used for advertising. Only the following have access to it, each for what concerns them:

• the platform's operators, the people Aperture authorises to administer the service, troubleshoot it and handle reports;
• the members of your organisations, who see your name, email address and actions in the organisation, according to their rights;
• our technical processors, starting with the hosting provider, listed below with where they process the data;
• administrative and judicial authorities, only on a request the law allows, or when the law requires us to report an offence to them.

Depending on the storage in use, a file can be served directly by the storage provider, which then sees the IP address of the person viewing it. The storage an organisation connects itself is run by its own providers, which it chooses and answers for.

13Transfers outside the European Union

Your data leaves the European Economic Area (the European Union, Iceland, Liechtenstein and Norway) only for a recipient the list above marks as located outside it. Each such transfer rests on the safeguard shown next to the recipient: an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or its standard contractual clauses (GDPR arts. 45 and 46).

You can obtain a copy of these safeguards by writing to us (see Using your rights).

14Protective measures

The following measures protect your data:

• passwords are never kept in clear: only their hash, computed with an algorithm designed for it, is stored;
• API keys, invitation links and password change links are kept as hashes: a key's secret is shown once, when it is created;
• the access credentials of connected storage are encrypted in the database;
• the site and its files are served over HTTPS, and the session cookie travels only over an encrypted connection;
• the files our customers send are served from an address separate from the site, which never receives a session cookie: a booby-trapped file cannot reach your session;
• repeated sign-in attempts are slowed down, and the security log can be read only by authorised operators;
• operators' rights are granted one by one, and their own actions are recorded in the log.

If a data breach puts your rights at risk, we notify the CNIL and, if the risk is high, we inform you (GDPR arts. 33 and 34).

15Your rights

For the data we are responsible for, you have the following rights (GDPR arts. 15 to 22):

• Access: know whether we process data about you, and get a copy of it.
• Rectification: have inaccurate data corrected or incomplete data completed.
• Erasure: have your data deleted when it is no longer needed, when you object to its processing or when it was processed unlawfully, except the data the law requires us to keep.
• Restriction: have a piece of data frozen, neither erased nor used, for instance while its accuracy is checked or your objection is examined.
• Objection: object, on grounds relating to your situation, to processing based on our legitimate interest, such as the security log. We then stop it, unless there are compelling legitimate grounds (protecting the service from an attack, for instance) or a need to defend legal claims.
• Portability: receive the data you gave us in a structured, machine-readable format, to pass it on to another service.
• Directives after death: decide what becomes of your data after your death (art. 85 of the French Data Protection Act) and give us the directives that concern this service. Without directives, your heirs can have your account closed and obtain what is needed to settle the estate.
• Withdrawal of consent: no processing described here relies on your consent. Should one ever depend on it, you could withdraw it at any time, without affecting what was done before.

No decision that produces legal effects concerning you, or similarly significantly affects you, is based solely on automated processing, and we do no profiling: reports and the measures that follow them are decided by a person.

For media and player data, contact the organisation concerned first (see Media and player data).

16Using your rights

Most of these rights can be used directly from your account page:

• Access and portability: download your data as a JSON file, after confirming your password.
• Rectification: change your name and email address. An organisation's name and settings are changed in its settings, according to your rights.
• Erasure: delete your account, after confirming your password. If you are the only owner of an organisation that has other members, hand it over to one of them first.

A player deletes their player space, at once, from the space's My account page, which also shows the accounts linked to it.

For everything else, or if you have no account, write to us:

Describe your request and, if you have an account, write from the email address linked to it. If we have reasonable doubts about your identity, we may ask you to confirm it. Using your rights is free of charge.

We answer within one month of receiving your request. That period can be extended by two months if the request is complex or if we receive many; we then tell you so within the first month, with the reasons.

17After your account is deleted

When you delete your account, or an operator deletes it:

• the account is deleted and all its sessions are ended;
• you leave the organisations that have other members; they keep their media and their activity log;
• an organisation you were the only member of is closed with the account: its keys are revoked, its domains removed, its media stop being delivered at once, and their files are erased by the cleanup that runs every night;
• the security log entries about you remain until the end of their period, 365 days;
• a legal archive keeps your name, your email address and the dates the account was opened and closed for 5 years, then it is deleted.

This archive serves only to answer the requests from authorities the law provides for (see What the law makes us keep).

18Complaint to the CNIL

If you believe the processing of your data breaks the rules, you can lodge a complaint with the CNIL, the French data protection authority, online on its site, or with the authority of the European Union country where you live or work. Writing to us first is not required, but often settles the matter faster.

19Minors

The service is not intended for children under 15: the terms of use ask that you be at least 15 to create an account. If you learn that a younger child has created one, write to us and we will close it.

The player space opens only to players aged 15 or older, as its terms provide: each one confirms it on their first visit. If you learn that a younger child has opened one, write to us and we will delete it.

A minor player whose media are hosted here deals with the game server concerned, which is responsible for them, or uses the report form for an image that shows them. A request to erase data collected while the person was a minor is handled as a priority.

20Changes to this policy

This policy changes with the service and with the law. The version in force is the one published on this page, updated on October 28, 2026.