Privacy notice
This notice is for people who visit this site or hold a FiveSpoof account. If you are a player on a server that uses FiveSpoof, your page is here.
On this page
In force from 21 October 2026.
Who is responsible
The makers of FiveSpoof are the controller of the data described here. Ask about anything in this notice on our Discord.
This website
The site counts visits with Google Analytics. Without your consent it sets no cookies, and Google receives only the page you open, the page you came from, your browser and device type and a rough location. Google Analytics does not store your IP address. If you accept cookies, it also sets cookies for up to 13 months to tell repeat visits apart. Your choice is saved in your browser, and you can change it at any time from Cookie settings at the bottom of every page. Our hosting provider processes your IP address for a short time to deliver the page and to stop attacks.
Your account
| What | Why | How long |
|---|---|---|
| Your Discord user ID, stored only as a keyed hash | To sign you in to the same account each time | Until you delete the account |
| During the closed beta, if we approve you: your Discord user ID and a note by our team, encrypted | To let you sign in during the beta | Until the beta ends or you ask us to remove it |
| Your Discord display name and a copy of your profile picture, encrypted | To show who is signed in | Until you delete the account |
| A sign in cookie | To keep you signed in. It is needed for the account to work. | 30 days |
| If you are staff on a server: which server and when you joined | To show you that server's cases, so you can let players in | Until you leave or are removed, or the server or your account is deleted |
| A record of sign ins and of changes made in your account | To show you what was changed, so you notice if someone else used your account | 180 days. Deleting a server deletes its entries, except the entry that records the deletion with the server's name. Deleting the account deletes all of them. |
| Your servers: name, plan, mode, size, the version of the resource and when it was last heard from | To provide the service and to charge the right tier | Until you delete the server. Daily player peaks are kept for 400 days. |
| The IP address your server connected from, as a keyed hash | To keep one license on one server | Until the server IP is changed or the server is deleted |
| The network a server connected from, as a keyed hash, linked to your account and to the first server from that network | To give the free trial once, not again after the server is deleted and added back, and to notice free trials repeated from one network | 2 years, also if the server is deleted |
| The contact and language you set for the message before joining | To show them to your players | Until you change them or delete the server |
| A Discord webhook address, if you connect a channel, encrypted | To post blocked players, a weekly summary and notices about your plan to your channel | Until you disconnect it |
| Stripe customer and subscription references, encrypted | To match payments, refunds and disputes to your server | Until you delete the server |
| When an account withdraws from a purchase: markers for the account, the payment method and the Stripe customer, as keyed hashes | To stop the 14 day refund from being used repeatedly, also from another account | 2 years, also if the account is deleted |
| When someone tries to tamper with the service: the time, the account, the server and the kind of attempt | To protect the service and its customers, to tell our team, and to end access when it is clear that someone did it on purpose | 12 months, also if the server or the account is deleted |
We do not receive your Discord email, your password or your card details. Sign in asks Discord only for your identity. Card data stays with Stripe.
Legal grounds
- The contract with you: the account, your servers, plans and payments.
- Our legitimate interest: keeping one license on one server, preventing misuse of refunds, the free tier and free trials, and keeping the service secure.
- Legal duties: bookkeeping and tax records for payments.
- Website analytics: our legitimate interest in counting visits without cookies, and your consent for analytics cookies, which you can withdraw at any time.
Who else handles the data
- Cloudflare runs the service and stores the database in the European Union. Requests may pass through its data centres elsewhere on the way.
- Stripe takes payments and is responsible for card data under its own privacy notice.
- Discord confirms your identity when you sign in, receives the messages you choose to have posted to your channel, provides the profile pictures we keep a copy of, and hosts our support server and its tickets.
- An AI service drafts answers to the support tickets you open. It sees what is written in the ticket and the status of your own servers. We do not send it data about your players.
- Google runs Google Analytics on this website and may process that data in the United States under the EU and US Data Privacy Framework.
Where one of them processes data outside the European Economic Area, the transfer rests on the European Commission's standard contractual clauses or an adequacy decision. We do not sell data and we do not use it for advertising.
Your rights
You can see and change most of this in your account, and delete a server or the whole account there. You can also ask us for a copy of your data, for a correction, for deletion or for a restriction, and you can object to processing that rests on our legitimate interest. We answer within a month.
If you think we handle your data wrongly, you can complain to the Data Protection Ombudsman of Finland or to the authority of your own country.
Players on your server
For the data of your players you are the controller and we process it for you under the data processing agreement. What players are told is on their own page.
Changes
When this notice changes in a way that matters to you, we tell you in your account before the change takes effect.