Last updated: 19 August 2026
The short version: we hold your email, your chosen handle, a hash of your password, and the map points you have ticked off. Nothing else. There are no advertising trackers, no analytics scripts, and no third party receives your data.
No cookie banner, and that is deliberate. We set exactly one cookie — the one that keeps you signed in. Cookies that are strictly necessary to provide a service you asked for do not require consent, so there is nothing to ask you about.
1. Who we are
Larceny Map is an independent map and progress-tracking tool for open-world games. It is not affiliated with, endorsed by, or connected to Rockstar Games or Take-Two Interactive — see our disclaimer.
For data protection purposes, the operator of this site is the data controller. Contact details are in section 12.
2. What we collect
This is the complete list. If it is not here, we do not have it.
| Data | When | Why |
|---|---|---|
| Email address | You create an account | To identify your account and let you reset your password |
| Handle | You create an account | Your display name; shown publicly only if you turn on profile sharing |
| Password hash | You create an account | To sign you in. We store a one-way hash — we cannot read your password |
| Your progress | You tick items off | So your progress follows you between devices |
| Your favorites | You star a location | To show them on your map |
| Session records | You sign in | To keep you signed in and let you sign out everywhere |
| Hashed IP address | Every request | Rate limiting, to stop automated abuse. We store a hash, not the address |
| Browser user-agent | You sign in | Shown on your sessions list so you can spot one you do not recognize |
| Location reports | You submit one | Crowdsourced map data. Published as map data, not attributed to you publicly |
You can use the map without an account. If you never sign in, we hold nothing about you beyond a hashed IP for rate limiting.
3. What we never collect
- Payment details. We do not take payments.
- Your real name, address, or phone number.
- Your physical location. The map shows a fictional city.
- Any credential for a game, console, or platform account.
- Analytics, advertising, or cross-site tracking data. There are no third-party scripts on this site at all.
Most of the harm in a data breach comes from data that was collected because it was easy, not because it was needed. We have tried to keep the list above as short as the product allows.
4. Why we hold it (legal basis)
Where the UK/EU GDPR applies, our lawful bases are:
- Contract — your email, handle, password hash, progress and favorites. We cannot provide an account without them.
- Legitimate interests — hashed IP addresses and session records, to keep the service available and secure against abuse. We have limited this to hashed and truncated values so it is no more intrusive than it needs to be.
We do not rely on consent, because we do not do anything that would require it.
6. Third parties
Your data is not shared with anyone. We do not sell it, rent it, or pass it to advertisers or analytics providers.
The site displays weekly in-game economy data sourced from GrindMap under a CC BY 4.0 license. We fetch that data on a schedule from our own server and store a copy — your browser never contacts them, so they receive nothing about you.
Our hosting provider processes data on our behalf as part of running the servers.
If we ever add optional console account linking, it will be opt-in, it will use the platform's own authorisation flow, and this policy will be updated before it ships.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and progress | Until you delete your account |
| Sessions | 30 days, then automatically deleted |
| Password reset tokens | 30 minutes, or until used |
| Rate-limit records | 24 hours |
| Server logs | Routinely rotated; contain no raw IPs |
| Location reports | Retained as map data after your account is deleted, with no link to you |
A scheduled job deletes expired sessions, used tokens and old rate-limit records every night. Deletion is automatic, not something we remember to do.
8. Your rights
Depending on where you live, you may have the right to:
- Get a copy of the data we hold about you
- Correct it if it is wrong
- Delete your account and the data attached to it
- Object to, or restrict, how we use it
- Complain to your data protection authority
To exercise any of these, email us using the address in section 12. We will respond within one month.
Location reports you have submitted stay in the map data after account deletion, because other people's maps depend on them. They carry no link back to you once your account is gone.
9. How it is protected
- Passwords are hashed with Argon2id. We could not tell you your password if we wanted to.
- Session identifiers are stored hashed, so a stolen database backup does not hand over live sessions.
- All traffic is encrypted in transit (HTTPS, enforced).
- IP addresses are hashed before storage.
- Sign-in attempts are rate limited per address and per account.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant authority as required by law.
10. Age
You must be at least 13 to create an account. We do not knowingly collect data from children under 13; if we learn we have, we will delete it.
Separately, the games this tool covers carry mature age ratings. Please respect the rating that applies where you live.
11. Changes
If we change this policy we will update the date at the top. For changes that materially affect what we collect or why, we will tell account holders by email before they take effect.
12. Contact
Privacy questions, data requests, or complaints: privacy@larcenymap.com.