Last updated: 1 October 2026
Information we collect
- Account information, including your email address, verification status, an optional uploaded profile photo, and a one-way password hash. We do not store your readable password.
- Discord account details supplied through Discord sign-in, including your user ID, username, avatar, and membership status.
- Application details, including age, Steam or FiveM name, timezone, roleplay experience, character information, your answers to application questions, and the short microphone-quality recording you submit.
- Reports and evidence you submit, including written descriptions, player identifiers, links, images, and videos. These are shared only with authorised Cloud9 staff for review and moderation.
- Account security information: when you use your Cloud9 account we record the IP addresses you connect from, an approximate location worked out from each IP address by Cloudflare (city, region and country - never your precise or GPS location), the name of your internet or network provider, your browser and device type, and security events such as sign-ins, failed sign-in attempts, password changes and new devices. Our hosting and security providers may also keep their own request logs.
- Moderation, whitelist, and community records needed to operate the server safely.
Why we use your information
We use account security information only to protect accounts and the community: spotting stolen or shared accounts, detecting alternate accounts and ban evasion, investigating abuse, and blocking malicious connections. It is visible only to authorised Cloud9 administrators.
We use information to authenticate applicants, assess whitelist applications, contact applicants, assign roles, manage website queue positions and short-lived connection passes, prevent abuse, enforce community rules, keep the service secure, and operate the website and server.
Our lawful bases
We rely on our legitimate interests in operating a safe, moderated roleplay community; taking steps you request before joining the service; and compliance with legal obligations where applicable. We balance those interests against your rights and do not ask for more information than we reasonably need.
Who receives your information
Access is limited to authorised Cloud9 RP staff and service providers needed to run the community, including Discord for identity and communication, Resend for verification and password-reset emails, and Cloudflare for website hosting, delivery, and security. Those providers process information under their own terms and privacy notices.
International transfers
Some providers may process information outside the United Kingdom. Where UK data protection law applies, we expect providers to use a recognised transfer mechanism or other lawful safeguard.
How long we keep information
We use the following standard periods for live account and moderation records:
- Account security information (IP addresses, approximate locations, devices and security events): 90 days, then deleted automatically.
- Unverified accounts: 30 days after creation.
- Declined whitelist applications: 90 days after the decision.
- Closed player reports: 12 months after closure, including evidence messages in the Cloud9 moderation channel where we control them.
- Accounts of members who leave: 12 months after the recorded departure, together with their profile photo and associated records when no active case requires them.
Open reports, pending applications, active disputes, and records subject to a documented legal or security hold may be kept longer while needed, then reviewed again. Deletion from the live service may not immediately remove older copies held in hosting-provider backups; those expire under the provider's backup lifecycle. Contact us through Discord if you want us to review information held about you.
Your rights
Depending on the circumstances, you may have rights to access, correct, erase, restrict, or object to our use of your information, and to receive a portable copy. You may also ask us to review a decision. We do not use solely automated decision-making with legal or similarly significant effects.
Your right to object: where we rely on legitimate interests, you may object to the processing. Contact us through Discord and explain your concern.
Complaints
Please contact us first so we can try to resolve your concern. You may also complain to the UK Information Commissioner’s Office through ico.org.uk.
Cookies and local storage
An essential, secure sign-in cookie keeps your verified Cloud9 account signed in during the browser session. If you select “Remember me”, it persists for up to 48 hours. Short-lived Discord authorisation is held in browser session storage and clears when that browser session ends. Third-party services linked from the site may use their own cookies or storage. We do not use this site to sell personal information or run behavioural advertising.
Changes to this notice
We may update this notice when our services or legal obligations change. The latest version and date will remain available on this page.