Privacy Policy

The controller of your data is the owner of this Website (trading as "Leonida Hub"). Its identifying details are set out in the Legal Notice.

For any matter relating to this policy or to the processing of your data, you can contact us at [email protected].

Account data: when you register we process your email address, your username or handle, and your password. The password is never stored in plain text: it is always stored hashed, so that no one, not even us, can read it.

Social login data (OAuth): if you choose to register or sign in with Discord or Google, we receive from that provider your email address and the basic profile data the provider makes available, in order to create or link your account.

Authentication data: we manage your session using JWT tokens. The access token is stored in an httpOnly cookie with the SameSite attribute (it is not accessible from the browser's JavaScript) and we use a refresh token to keep your session active.

Public user-generated content: the forum is public. The threads, messages and reactions you post, together with your username, are visible to any visitor and may be indexed by search engines.

Technical and security data: we keep technical logs that include your IP address for security and abuse-prevention purposes, and we use a rate-limiting system to protect the service. The site's internal search indexes public forum content so you can find it.

Audience measurement data: we measure visits with Umami, an analytics program we install on our own servers. It uses no cookies and no persistent identifiers, and it does not collect your username, your email address or what you type into the search box. For each visit we record the page viewed, the page or search engine you came from, the country, the browser, the operating system, the device type, the screen size, the language, a few page-speed metrics and how far down the page you scroll (in 25% steps, to know whether a piece is read to the end or abandoned halfway). We do not record the session, the mouse, clicks or heatmaps. Your IP address is used transiently to infer the country and to group the pages of a single visit, and it is not stored. We also record a few site-interaction events: that a reading depth was reached, that a registration was completed, that a thread was created (with its category), that a search was run (with the number of results, never the text searched), that a link to the store was clicked, that someone subscribed to the email notices and that a streak check-in was made. They are usage counters: they are not linked to your account and do not include your username, your email address or anything you type.

Email notice subscription data: if you subscribe to the countdown notices we process your email address and the language you want to receive them in. A subscription does not count until you confirm it from the link we send you, and every email carries a one-click unsubscribe link. Those emails may include a measurement image that counts how many opens there were in total: it is the same first-party analytics, with a single identifier for the whole send and none per recipient, so we do not know who opens an email or how many times they open it.

Data that never leaves your browser: the Radio player's preferences (tuned station, continuous playback, device sounds and the minute of the last song) are stored in your browser's local storage and are never sent to our servers. The player's "Sync with audio" option asks you to share the tab's audio to draw the VU meter: that audio is analysed in your own browser in real time; it is not recorded, not stored and not sent to any server.

Managing your account and providing the service (registration, authentication, posting on the forum): the legal basis is the performance of the contract or user relationship you accept when you register and use the site (Art. 6(1)(b) GDPR).

Social login with Discord and Google: we process the data received from the provider to create or link your account on the basis of the performance of the contract and, as regards the connection with the external provider, of your consent in choosing that method (Art. 6(1)(b) and 6(1)(a) GDPR).

Security, fraud and abuse prevention, and service stability (IP logs, rate limiting): the legal basis is our legitimate interest in protecting the site, its users and the infrastructure against misuse (Art. 6(1)(f) GDPR).

Compliance with legal obligations: where applicable, we will process data to comply with the obligations imposed on us by applicable law (Art. 6(1)(c) GDPR).

Audience measurement: knowing which content is read and how the site behaves, using first-party analytics that set no cookies and cannot identify you: the legal basis is our legitimate interest in maintaining and improving the site (Art. 6(1)(f) GDPR).

Countdown email notices: sending them to people who subscribe with their address and confirm it, and to registered people who have not unsubscribed; the legal basis is your consent when subscribing (Art. 6(1)(a) GDPR) and, if you have an account, the user relationship you accept on registering (Art. 6(1)(b) GDPR). You can stop receiving them with one click from any of those emails, without losing your account. Open measurement is aggregate and anonymous, and relies on the same legitimate interest as the rest of our measurement (Art. 6(1)(f) GDPR).

We do not carry out third-party analytics or advertising, we do not sell or share your data with third parties for commercial purposes, and we do not send marketing communications about other companies' products.

We keep your account data for as long as your account remains active. If you request erasure or delete your account, we will delete or anonymise your personal data, except for any data we must retain to comply with legal obligations or to handle potential liabilities.

Public content you have posted may remain visible on the forum after you leave; at your request we will remove it or dissociate it from your identity, without prejudice to third-party quotes or replies that reproduce it.

Technical logs containing IP addresses are kept only for as long as strictly necessary for security and abuse-prevention purposes, after which they are deleted or anonymised.

Audience measurement data is kept for a maximum of 14 months, just enough to compare one season with the same season a year earlier; after that period it is deleted automatically.

The email address you subscribe to the notices with is kept while the subscription remains active: when you unsubscribe it is deleted from the mailing list.

We do not sell your data or transfer it to third parties for commercial purposes. Only the providers necessary to deliver the service are involved; they act as processors on our behalf and under contract.

Social login providers: Discord and Google, when you choose to authenticate with them. Their processing of your data is additionally governed by their own privacy policies.

Hosting and infrastructure providers: companies that provide us with hosting and the technical infrastructure (servers, database, search engine and rate-limiting system) needed to operate the site.

Third-party players: if you press play in the Radio section or on a video, your browser connects directly with Spotify AB (Sweden) or Google (YouTube), which receive your IP address and the usual technical data of a web request and process them as independent controllers under their own privacy policies. The players do not load until you press play, and we say so next to them.

We may also disclose data to authorities or courts where we are under a legal obligation to do so.

Some of the providers we use, such as Google (including YouTube), Spotify or Discord, may process data outside the European Economic Area (EEA).

Where an international transfer takes place, we ensure that appropriate safeguards under the GDPR are in place, such as an adequacy decision of the European Commission or approved Standard Contractual Clauses, so that your data continues to enjoy a level of protection equivalent to that of the EU. In Google's case, the company is listed under the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023.

You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and data portability. You also have the right to withdraw any consent you have given, without this affecting the lawfulness of processing carried out before its withdrawal.

To exercise them, write to us at [email protected] indicating the right you wish to exercise; we may ask you to prove your identity. We will respond to your request within the legally prescribed time limits.

If you believe that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es), without prejudice to any other administrative or judicial remedy.

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure. These include storing passwords as hashes, managing sessions with httpOnly cookies and the SameSite attribute, rate limiting to mitigate abuse, and restricting data access to the staff and providers who need it.

No system is invulnerable; we work to maintain and continuously improve these measures and to respond diligently to any security incident.

Use of Leonida Hub is intended for people over 14 years of age, the minimum age set in Spain for consenting to the processing of their personal data. Please also bear in mind that GTA VI is a product rated for an adult audience.

If you are under that age, you must not register or provide us with personal data. If we detect that we have processed a minor's data without the required authorisation, we will delete it. If you believe this has happened, contact us at [email protected].

We use only technical cookies necessary for the site to function: a session and authentication cookie (httpOnly) that keeps you logged in, and a language-preference cookie that remembers whether you prefer the site in Spanish or English.

We do not use analytics, advertising or third-party tracking cookies: our audience measurement works without cookies and without identifying you. The Spotify and YouTube players, which load only when you press play, may set their own cookies. For more detail, please see our Cookie Policy.

We may update this Privacy Policy to reflect legal, technical or operational changes to the site. The version in force is always the one published on this page, with its last-updated date.

If we make substantial changes, we will endeavour to inform you by an appropriate means. We recommend that you review this page periodically.

If you have any questions about this Privacy Policy or about how we process your data, you can write to us at [email protected]; the owner is contacted by electronic means.

Any dispute relating to this policy shall be subject to Spanish law and to the courts and tribunals of Spain, without prejudice to the rights afforded to you by data protection regulations.

Leonida Hub uses YouTube API Services in two ways.

Website: the site queries the YouTube API with an API key to obtain public video data that we use when writing news. It does not use your Google account and does not access any user's private data. For each relevant video we store its title, a summary of its description, the link to the video and the thumbnail, as a news draft; that draft is kept until our team publishes or discards it, with no automatic deletion. We also store the video identifier for 30 days so as not to process it again.

Publishing to our channel: our team publishes our own videos to the official Leonida HUB channel (@leonidahub.gta6) through an internal tool authorized by OAuth with that account only. We store only the authorization token and basic data about that channel. They are not shared with third parties.

By using features that rely on YouTube you agree to the YouTube Terms of Service. Google's processing is governed by the Google Privacy Policy.

The owner of a Google account can revoke an application's access from the Google security settings page.

To request deletion of YouTube-related data, write to us at [email protected].