Privacy Policy
How CFXR handles personal data. Last updated: 3 September 2026.
Who is responsible
CFXR (cfxr.cc) is operated by Titan Software z.s., zapsaný spolek (registered association), Czech Republic, with its registered seat at Ametystová 702/46, 153 00 Praha, Česká republika (IČO 29738725). Titan Software z.s. is the data controller for the processing described here.
For anything in this policy, including requests about your data, contact [email protected]. Security vulnerabilities go to our disclosure page instead.
No data protection officer has been appointed; CFXR's processing does not meet the Article 37 criteria. Requests are handled by the operator directly at the address above.
What CFXR does
CFXR resolves information about FiveM/CFX game servers. Given a join code it queries the public Cfx.re server API, resolves the server's advertised connect endpoints over DNS, and enriches the resulting IP addresses with hosting, ASN and country data. It also offers accounts with a synced watchlist, API keys and uptime notifications.
What we collect, why, and for how long
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Keyed hash of your IP address | Rate limiting, blocking abusive clients, counting unique visitors | Legitimate interest (Art 6(1)(f)) — keeping a free public API usable | 90 days in request logs; blocklist entries until removed (automatic blocks expire after 7 days) |
| Request metadata: join code looked up, success/failure, response time, whether it was cached, and the resolved server's country | Operating and debugging the service, usage statistics | Legitimate interest (Art 6(1)(f)) | 90 days |
| Account: Titan Auth account id, email address, display name, avatar URL | Signing you in and running your account | Contract (Art 6(1)(b)) | Until you delete your account |
| Your watchlist, API keys (stored only as a hash), notification settings and webhook URLs (encrypted) | Delivering the features you switched on | Contract (Art 6(1)(b)) | Until you delete them or delete your account |
| Funnel events: which cross-product link you clicked, from which page, plus the keyed hash of your IP | Measuring which parts of the site lead people to Titan's other products | Legitimate interest (Art 6(1)(f)) — first-party measurement only, no third-party trackers | 180 days |
| Server data: name, project, endpoints, IP address, hosting/ASN, resources, tags, player counts, and the operator name and Cfx.re operator id as published by that server | The resolver, the directory, uptime history and change history — this is the product | Legitimate interest (Art 6(1)(f)) | Kept while the service runs; change history is retained as a product feature |
| Administrator action log: what was done, when, by which administrator, and a keyed hash of their IP | Accountability and security incident investigation | Legitimate interest (Art 6(1)(f)) and legal obligation (Art 6(1)(c)) | 365 days |
About the IP hash: CFXR never stores raw visitor IP addresses. It stores a keyed HMAC-SHA-256 of the address. This is pseudonymisation, not anonymisation — because we hold the key, we treat these records as personal data, apply the retention periods above to them, and include them in the scope of your rights below.
Server operators
When a FiveM server publishes an operator name and Cfx.re operator id in its own public server listing, CFXR shows them on that server's page. Where the operator is an individual, that is personal data, processed on the basis of our legitimate interest (Art 6(1)(f)) in providing a transparency tool for a public game-server ecosystem, weighed against data already published by the operator in a professional capacity.
If you operate a server and want that information removed from CFXR, email [email protected] with the join code. You can object at any time under Article 21 and we will stop unless we can show compelling legitimate grounds.
Automated blocking
To protect the service, CFXR can automatically block a client that repeatedly exceeds the published rate limits. The decision is made on request volume alone, applies to a hashed IP address rather than to an account, expires automatically after 7 days, and only affects access to CFXR itself. If you believe you were blocked in error, email [email protected] and we will review it. No other automated decision-making or profiling takes place.
Who else receives data
| Recipient | What they receive | Role |
|---|---|---|
| Titan Auth (auth.titansoftware.eu) | Your sign-in; CFXR receives back your account id, email, name and avatar | Operated by Titan Software z.s. |
| Cfx.re (frontend.cfx-services.net) | The join code being resolved. Not your IP address | Independent controller — the source of the server data |
| ip.sb, ipwho.is, ipapi.co | The resolved game server's IP address, for hosting and country lookup. Not your IP address | Independent controllers |
| Our email provider | Your email address and the alert content, when you enable email notifications | Processor, under an Article 28 agreement |
| Our hosting and CDN providers | Request metadata needed to serve the site | Processors, under Article 28 agreements |
| Discord, or any webhook address you configure | The alert payload you asked us to send there | Recipients you choose; you direct this transfer |
Some of these providers operate outside the EEA. Where that is the case we rely on an adequacy decision or on Standard Contractual Clauses. Ask us at [email protected] for the current position on any specific provider.
CFXR uses no third-party analytics, no advertising, no tracking pixels and no fingerprinting. Fonts are served from our own domain.
Cookies and local storage
CFXR sets only cookies that are necessary for the service you asked for, so no consent banner is shown. The full list is on the cookie page.
Your rights
You can ask us to give you a copy of your data (Art 15), correct it (Art 16), delete it (Art 17), restrict how we use it (Art 18), hand it over in a portable format (Art 20), or object to processing based on our legitimate interest (Art 21).
Two of these are self-service in your account: Download my data gives you a complete machine-readable export, and Delete account permanently removes your account, watchlist, API keys and notification settings. For anything else, email [email protected]. We respond within one month.
Your sign-in credentials — password, passkeys, linked accounts and two-factor settings — are held by Titan Auth, not by CFXR. Manage or delete them at auth.titansoftware.eu; deleting your CFXR account does not delete your Titan Auth account.
If you are unhappy with how we handled your request you can complain to the Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic (uoou.gov.cz), or to the supervisory authority where you live.
Children
CFXR is not directed at children. You need to be at least 15 years old to create an account, matching the age threshold in Czech law. The resolver itself works without an account and collects nothing beyond the request metadata described above.
Security
Data is transmitted over HTTPS. Session cookies are httpOnly and same-site. API keys are stored only as a hash and shown to you once. Webhook URLs are encrypted at rest. Access to production data is limited to those who need it to operate the service. Report a vulnerability at https://security.titansoftware.eu/responsible-disclosure.
Changes
When this policy changes materially we update the date at the top. For changes that affect you significantly, and where we hold your email address, we will tell you directly.