Privacy

Privacy Policy

Version 1.0 · Effective 2 October 2026 · Applies to The Lab iOS app and this website

1. Who we are

The Lab is an independent, fan-made companion app for Grand Theft Auto VI, operated by its developer, Rafael Johnsen ("we", "us"). It is not affiliated with, endorsed by or sponsored by Rockstar Games or Take-Two Interactive.

For anything in this policy, contact us at rafaeljohnsenwettner@gmail.com.

2. What we collect

Account

• Email address and password. Your password is stored only as a salted scrypt hash. We never see or store it in plain text.
• Display name and handle. Your handle is public and shown on anything you post.
• Profile photo, if you choose one from your photo library. Only the picture you pick is uploaded; nothing else in your library is read.
• Terms acceptance — which version of the Terms and Community Guidelines you accepted, and when.

Things you create

• Posts, comments, reactions, saves, follows, blocks and reports in the community (the "Network"). Posts and comments are public to other users.
• Messages to the assistant. What you type to the AI assistant, and its replies, are stored with your account so your conversation history works.
• Gameplay video you upload to find clips in, the authorisation basis you choose for it (owned, licensed, creator-authorised or submitted), the transcript generated from it, and the clips produced.
• Connected publishing accounts (for example YouTube or TikTok), if you connect one in order to publish a clip. We store the access token the platform gives us for that purpose and the identifier of the account; we do not store the password for that account.
• Your player profile for the money tools: in-game balance, level, owned assets and goals. This is in-game data, not real money.

Technical

• IP address and device/browser user-agent, stored with your sign-in session and in a security audit log of account events (sign-in, registration, terms acceptance, account deletion, moderation actions).
• Language and region of your device, used to choose which language the Shorts feed is searched in. This is sent with the request and not stored as a profile field.
• App version, so we can tell which build a problem happened on.

Notifications

The only notification is an optional daily countdown reminder. It is off by default, and when you turn it on it is scheduled locally on your phone. We do not collect push notification tokens and do not send remote push notifications.

Purchases

If the app offers subscriptions or credit packs, the purchase is made through Apple's App Store. We receive confirmation of what you are entitled to; we never receive or store your card details.

What we do not collect

• No precise or approximate location.
• No camera or microphone access — both are disabled in the app's configuration.
• No contacts, calendar, or health data.
• No advertising identifier (IDFA), and no cross-app or cross-site tracking. The app declares NSPrivacyTracking = false in its privacy manifest.
• No third-party analytics or crash-reporting SDKs.

3. Why we use it

• To run the service: sign you in, show your profile and posts, keep your assistant history, process the video you upload.
• Safety and moderation: act on reports, enforce the Community Guidelines, hide content from users you have blocked, and keep an audit trail of moderation decisions.
• Security: detect account abuse, enforce rate limits on sign-in, and investigate incidents.
• Support: answer you when you contact us.

Under the GDPR, our legal bases are performance of the contract with you (running the app you signed up for), our legitimate interests in keeping the service safe and secure, your consent where you turn an optional feature on, and compliance with legal obligations.

4. Who processes it for us

We use a small number of service providers. Each receives only what is needed for its job.

If you connect a publishing account (YouTube, TikTok), content you choose to publish is sent to that platform and that platform's privacy policy applies to it there.

Some of these providers are outside the EU/EEA. Where that is the case, transfers rely on the provider's standard contractual clauses or an adequacy decision.

5. How long we keep it

• Account data is kept for as long as your account exists.
• When you delete your account, your account, profile, sessions, assistant conversations, uploaded videos, transcripts, clips and profile photo are deleted from our server. Your posts and comments are kept but detached from you and shown as from a deleted user, so that other people's conversations are not broken; they no longer contain your name, handle or any link to you.
• Security audit records and moderation records may be retained for up to 12 months after the event where we need them to enforce the Guidelines, investigate abuse or meet a legal obligation. They are not used for anything else.
• Backups of the database are kept for up to 30 days and then expire.

6. Your rights

Wherever you live, you can see and change your profile in the app, and delete your account from Profile → Danger zone. Deletion is immediate on our server and cannot be undone.

If you are in the EU, EEA, UK or Switzerland, you also have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to receive a copy of it in a portable format, and to withdraw consent at any time where consent is the basis. To exercise any of these, email us. You also have the right to complain to your local data protection authority.

7. Children

The Lab is not directed at children under 13, and we do not knowingly collect personal data from them. Grand Theft Auto is rated for adults; the app is rated accordingly in the App Store. If you believe a child has created an account, contact us and we will delete it.

8. Security

All traffic between the app and our server is encrypted with HTTPS. Passwords are hashed with scrypt. Sessions use random tokens that are stored only as a hash on the server, so a leaked database copy cannot be replayed as a live session. Sign-in and registration are rate-limited. Moderator actions require a staff account with two-factor authentication.

9. Changes

If we change this policy in a way that matters, we will update the version and effective date at the top and, for significant changes, tell you in the app before they take effect.

10. Contact