Privacy policy

Last updated 2026-10-17. Applies to FiveM MCP at fivem-mcp.fivem.no and its sister server (RedM MCP / FiveM MCP), which share the same infrastructure.

FiveM MCP is an independent, non-commercial service for game-modding developers. It is not affiliated with Rockstar Games, Take-Two, Cfx.re, Discord or Anthropic. Contact: cmoen11@gmail.com.

What we collect

• Discord identity when you sign in: Discord user ID, username and public display name (scope identify). We do not receive your email, messages, server list or password.
• Tool usage: every tool call is logged with the tool name, the arguments you sent (for example search queries, native names or paths), result metadata (success, latency, hit counts), your Discord ID/username, the OAuth client ID and the MCP client name/version.
• Request metadata: IP address, user agent, path, HTTP status and timing of requests to the server.
• Authentication records: OAuth client registrations and hashed access/refresh tokens.
• Findings you submit with share_finding: the title and body, together with your Discord ID, username, OAuth client ID and IP address.
• Code you submit to check_code (RedM): the script source, the optional purpose line, the checker's result, your Discord ID/username, OAuth client ID and session. Credential-shaped values (webhook URLs, passwords, tokens, API keys) are masked before storage. Used only by administrators to improve the checker.

We do not see your conversations with your AI assistant — only the tool calls it sends to this server. Do not put secrets or personal data into tool arguments or findings; submissions that look like credentials are rejected and credentials detected in logs are masked.

How we use it

• To authenticate you and provide the service.
• To enforce rate limits, detect and block abuse, and investigate misuse.
• To measure and improve search quality, find missing documentation and debug errors (aggregated usage statistics).
• To attribute and review community findings.

We do not sell your data, use it for advertising, or use it to train AI models.

Who processes it

• Discord — sign-in (governed by Discord's own privacy policy).
• OpenAI — search queries and submitted findings are sent to the embeddings API to compute search vectors. No identity data is sent.
• Voyage AI — search queries and candidate documents are sent for result reranking. No identity data is sent.
• Data is stored in a PostgreSQL database on a privately operated server. Search results may be cached for up to 10 minutes.

Retention

• Tool-call and request logs are currently retained without a fixed expiry to support abuse investigation and long-term quality analysis.
• Access tokens expire after 1 hour, refresh tokens after 30 days; expired tokens are deleted.
• Code submitted to check_code is deleted after 90 days.
• Published findings are kept until removed by an administrator or at your request.

Your rights

You can stop using the service at any time and revoke the app's access in your MCP client. To request a copy of your data, its correction or deletion, email cmoen11@gmail.com from or with your Discord username/ID. Where the GDPR applies, you may also complain to your data-protection authority. The legal basis for processing is our legitimate interest in operating and securing the service.

Security

All traffic uses HTTPS. Tokens are stored only as hashes. Access to logs is limited to administrators.

Changes

We will update this page when our practices change and adjust the date above.