The HideoutPrivacy Policy
Last updated: 17 October 2026
This Privacy Policy explains what personal information The Hideout Game Servers LLC ("The Hideout," "we," "us") collects when you use the thehideout.gg website, the The Hideout Companion iOS app (the "app"), our Discord server and bot (Hideout Assistant) and our in-game city, how we use it, who we share it with and what choices you have. If you do not agree with it, please do not use these services.
1. Who we are and how to reach us
The Hideout Companion is published by Miles Humphries. The Hideout community and its game servers are operated by The Hideout Game Servers LLC. The account data described here lives on the servers the LLC operates, and the LLC is the data controller. Email: thehideoutgameserversllc@gmail.com. This address works without an account, so you can reach us even if you cannot sign in. You can also open a ticket in the app, on the website or in game. See our Support page.
2. Age
The Hideout is for people 18 or older, as our Terms and community rules require. The services are not directed to anyone under 18 (and never to anyone under 13), and we do not knowingly collect personal information from children. If you believe a child has given us personal information, email us and we will delete it.
3. What we collect
| Data | When and why |
|---|---|
| Discord account data: Discord user ID, username, display name, avatar, and your roles and membership in our Discord server | When you sign in with Discord (scopes identify, guilds, guilds.members.read). Used to sign you in, show your profile and map your roles to access (for example staff tools). We do not receive your Discord email address. |
| Apple sign-in data: an Apple account identifier, your name (only the first time, and only if you share it) and your email address, which may be a private relay address if you choose "Hide My Email" | When you sign in with Apple in the app. Used to create and recognise your account and to contact you about it. Apple does not give us your password. If you delete your account we revoke our Sign in with Apple link. |
| Steam ID (optional) | Only if you link Steam on the website. |
| Session data: a sign-in token (stored on your phone in the iOS Keychain; we keep only a hash), the date it was issued and last used, the phone model and platform (see Device information below) | To keep you signed in, show "your sessions" and let you sign out other devices. Website: one essential session cookie. |
| Push notification token and settings: an Expo push token for your phone, your platform and your notification choices | Only if you allow notifications. Used to send alerts you asked for (for example ticket replies, deliveries, city events, restarts). Notification text passes through Expo's push service and Apple's push service. |
| Device information: the phone model (for example "iPhone 15"), operating system and app version. We do not store the name you gave your phone. We do not collect your advertising identifier, contacts, location or microphone audio. | Sign-in session list, support, compatibility, security. |
| Crash reports: error message, stack trace, screen name, app version, platform and whether it was fatal. They contain no account ID, token or IP address, and are not linked to you. | To find and fix bugs. You can switch crash reports off in Me → Privacy and data. |
| Support tickets, live chat, reports, applications: what you write and attach, your name, and the character involved | To answer you, review applications, handle ban appeals and enforce the rules. Chats and tickets are mirrored into private staff threads on Discord. When you delete your account we cannot edit those Discord copies automatically; staff remove them on request. |
| Photos you attach (camera or photo library, only when you tap Attach) | For tickets, posts and listings. Pictures are stored on our media server at a web address; anyone who has the link, or who sees the post, can view the picture. We remove location metadata (EXIF) from pictures before saving. The app never records audio or video. |
| Posts, comments, in-city phone messages and reports you send | To show them to the people you send them to, to apply blocks and filters, and for moderation. |
| In-city character and game data: your character names, phone numbers, jobs, bank and cash balances, vehicles, properties, licences, records and activity | Read from our game database to show you your own characters in the app and on the website. It is fictional roleplay data about characters in the game, not real-world financial, health or criminal records. Police, EMS and court screens show in-game records to players holding those roles. |
| Game account and server logs: game licence identifiers, connection and gameplay logs, anti-cheat results | To run the city, prevent cheating and fraud, and investigate reports. |
| Purchases (website store only): order and coin history | The app does not sell anything. Purchases made on the website are processed by Tebex; we never see your card number. |
| Consent and terms records: the version and date you accepted our terms and, in the app, the AI disclosure | To prove you agreed and to ask again when something changes. |
| Website logs: IP address, request time, pages requested | Security and reliability. |
4. How we use it, and our legal basis
- To provide the services you asked for (contract): sign-in, your profile, your characters in the app, tickets, applications, notifications you turn on.
- To keep the community safe (legitimate interests and our legal obligations): moderation, handling reports, blocking, fraud and cheat prevention, enforcing the rules and our Terms of Use.
- To maintain and improve the services (legitimate interests): fixing crashes, security, capacity planning.
- With your consent: AI features in the app, push notifications, crash reports where required, and photo access. You can withdraw consent at any time without affecting what you did before.
- To comply with the law, respond to lawful requests and protect our rights.
5. AI processing
Some features use a third-party AI service. In the app these features need your consent: before you first use "Ask the city" the app shows what is sent and asks you to agree, and it will not send anything until you do. You can say no and still contact staff, open tickets and use the rest of the app. You can withdraw consent later, and we ask again if the providers change.
- Ask the city assistant (Anthropic). The text you type and the recent messages of that conversation, plus our public knowledge base and FAQ, are sent to Anthropic to write an answer. Anthropic processes this for us under its commercial terms and does not use it to train its models. Do not include passwords or payment details in your messages. AI answers can be wrong; ask for a human at any time.
- Staff tools (Anthropic and Groq). Staff may use AI to help grade resolved tickets, summarise anonymous crash reports and review report clips. For clips, still frames are extracted and the audio is transcribed with Groq's speech-to-text service. This is staff-side processing of content you submitted to us; it does not make decisions about you without a person.
- AI dispatcher voice (ElevenLabs). In the city, our AI dispatcher turns its written text into speech with ElevenLabs. It receives the dispatcher's script, not your voice or account data.
On the website, using the on-site assistant is covered by your agreement to this policy and our Terms of Use.
6. Who we share data with
We use the service providers below to run the services. Each receives only what it needs, and we choose providers that give the same or equal protection to your data as this policy describes. We may also disclose information where the law requires it or to protect the safety, rights or property of our community.
| Provider | What it receives and why |
|---|---|
| Discord | Sign-in with Discord; your roles; mirrored support chat and ticket text in private staff threads; community features and moderation on our Discord server. |
| Apple | Sign in with Apple (identity token verification and revocation); push notification delivery (APNs); the App Store. |
| Expo (Expo Application Services) | Over-the-air app updates (app version, platform, request metadata including IP address) and the push notification service (push token and notification text). |
| Anthropic | Text for the Ask the city assistant (with your consent in the app) and staff-side AI tools. |
| Groq | Audio from report clips for transcription by staff tools. |
| ElevenLabs | Written dispatcher scripts for text-to-speech in the city. |
| Giphy | Search words typed into the GIF picker (sent through our server, which keeps our key private). |
| Tebex | Website store purchases and payments. Tebex and its payment processors handle your card details. |
| Steam | Only if you link your Steam account on the website. |
| YouTube and Medal | If you attach a clip link, your device loads the thumbnail or opens the link, which tells that site your IP address. |
| Hosting and network | Our servers and the Caddy web server and TLS proxy run on virtual servers from our hosting providers, who process data on our behalf. |
7. How long we keep it
We keep data only as long as we need it for the purposes above. What we actually do today:
| Data | Retention |
|---|---|
| Account profile, sign-ins, devices, push tokens, notification settings, blocks, RSVPs, consent and terms records | While your account exists. Deleted when you delete your account in the app (see section 9). |
| App sign-in tokens | Expire 60 days after they are issued and are replaced as you use the app; a phone unused for 90 days is signed out. Signing out or "sign out everywhere" revokes them at once. Expired tokens are deleted automatically. |
| Crash reports | Anonymous; deleted automatically after 90 days. |
| Devices and push tokens | While your account exists; a device row not used for 90 days is deleted automatically. |
| Support tickets and live chat | Kept for 2 years after they are closed, then anonymised automatically: your words are replaced with "[deleted]" and the link to your account is removed. If you delete your account, your own messages, name and character details in them are replaced right away; staff replies stay. |
| Applications | The decision is kept for staff records. Your answers are removed when you delete your account. |
| Reports about content, and takedown records | The copy of the reported content is kept while the report is open and removed automatically 12 months after it is closed. Takedown records are removed 12 months after the report is closed. When you delete your account, reports you filed lose your identity. |
| Flagged or removed pictures | The file is deleted when staff remove it or you delete your account, and the record of it is deleted after 365 days. |
| Consent and terms records | Deleted with your account. |
| Posts, in-city messages and pictures | Until you or staff remove them, or the character is wiped. Pictures you upload from the app are recorded against your account and the files are deleted when you delete it. Other copies, such as pictures posted in game, are not covered; email us a link to have one removed. |
| Character and game data, game logs | While the game account or character exists and for the period needed for moderation and anti-fraud. Deleting your app account does not delete your in-game character; email us to ask for character removal and we will handle it within 30 days. |
| Staff-online and server status data | Not stored beyond the current moment; aggregate player counts are kept for 14 days. |
| Website access logs | Kept for security and rotated by our hosting software. |
| Staff records (moderation actions, audit logs, financial and anti-cheat records) | Kept as long as needed for support, safety and legal reasons. Deleted or anonymised on request or when an account is deleted, except where we must keep a record (for example a ban, an open dispute or a legal matter). After account deletion these records keep only an anonymous reference. |
8. Discord data
Our use of information obtained through Discord complies with the Discord Developer Terms of Service and Developer Policy. Members and roles build the staff roster, map permissions and route tickets. Presence (online status) is used only to show a live "staff online" indicator, is held in memory and is not logged. Message content in our server is processed for moderation and not used for anything else.
9. Your choices and rights
- Access and export. In the app, Me → Privacy and data → Export my data gives you a file with your account and game data. On the website or by email you can ask for a copy.
- Delete your account. In the app, Me → Settings → Delete account. It signs you out everywhere and removes your sign-in methods, devices, push tokens, notifications, blocks, consent records, uploaded pictures, mutes and personal profile details. Your name, character details and the words you wrote in tickets, support chats and applications are replaced with "Deleted user" and "[deleted]". Staff replies and decisions stay, without your details, and your account record becomes an empty "Deleted user" entry with an internal reference. Copies in private Discord staff threads and your in-game character are not removed automatically; email us and staff will remove them. Signing in again creates a new account. Staff accounts cannot be removed instantly because they anchor audit records, so staff use Request account deletion (same screen) and we complete it within 30 days.
- Correct your information by changing it at the source (Discord, Apple) or asking us.
- Withdraw consent for AI features, notifications and crash reports in the app or in iOS Settings.
- Revoke access. Remove the website from Discord Authorized Apps, remove The Hideout from your Apple ID's "Sign in with Apple" list, unlink Steam on the website, or sign out everywhere in the app.
- Block and report other players in the app; see our Terms of Use.
- Depending on where you live (for example the EEA, UK or California) you may also have the right to object to or restrict processing, to data portability, and to complain to your data protection authority. We do not sell or share personal information as those terms are defined in California law. We will not discriminate against you for using these rights.
To use any right, email thehideoutgameserversllc@gmail.com. We may need to verify it is you, and we aim to answer within 30 days.
10. Security
Traffic between the app, the website and our servers uses HTTPS. App sign-in tokens are stored in the iOS Keychain and only a hash is kept on our servers; payment cards never reach us. Access to staff tools is limited by role. No system is perfectly secure, so please use a strong Discord and Apple ID password and two-factor authentication. If a breach affects you we will tell you as the law requires.
11. International transfers
We are based in the United States and our servers and most providers are in the United States. If you use the services from elsewhere, your information is transferred to and processed in the United States and possibly other countries where our providers operate, which may have different data protection laws. Where required we rely on appropriate safeguards such as contractual terms with our providers.
12. Cookies
The website uses a single essential session cookie to keep you signed in. We do not use advertising or third-party tracking cookies.
13. Changes to this policy
We may update this policy. The "Last updated" date shows the latest version, and for material changes we will tell you in the app or on the website, and ask for consent again where the law requires it.
14. Contact
The Hideout Game Servers LLC, United States. Email thehideoutgameserversllc@gmail.com, or visit thehideout.gg/support.