Privacy Policy
Last Updated: 2026-10-25
Who is responsible
The RPForge operator identified below is responsible for processing personal data through this service. Contact the support email below for privacy questions or requests.
Account and security information
RPForge stores your email address, password hash if you use a password, account and verification status, credit balance, account creation date, and Google account identifier if you choose Google sign-in. Signup IP addresses are stored for abuse review. Request IP addresses are also used for rate limiting and security. We do not add IP tracking to purchase-consent records.
Prompts, generated content and usage
We store generation inputs, outputs, user and generation identifiers, timestamps, selected models, token usage and credits charged. These records support generation history, billing, error investigation and evidence of service delivery. Avoid submitting passwords, secrets or unnecessary personal data in prompts or scripts. If you pair a FiveM server, we also store server identifiers, names, hashed pairing/authentication credentials and deployment status/history. If you rate a generated script or answer our feedback survey, we store your rating, answers and any comment you write, linked to your account (and, for a rating, to that generation). We may email you once to ask for feedback about RPForge; answering is optional.
Screenshots
Screenshots you attach to a ScriptForge message are sent to Anthropic with your plan or build request so its Claude models can read them. When a screenshot is uploaded we keep only its pixels: location and camera details (EXIF), colour profiles (ICC), XMP data and text embedded in the file are removed, and an animation keeps only its first frame. A screenshot is deleted 24 hours after upload if no build used it, or 23.5 hours after the last build that used it finished. From then it can no longer be opened, and a cleanup that runs every 15 minutes removes it from our database. Removing a screenshot before you send it, deleting the chat it was sent in or closing your account deletes it at once. We keep a record that a screenshot was attached (its format, size and dimensions), not the image. What a plan or build writes from a screenshot is generated content and is kept with that plan or build after the screenshot is deleted, like its other output: the layout it describes, the UI it rebuilds and the names it reads in the image (logos, watermarks, author credits, web addresses), which a build lists to check that none of them was copied into your script. Do not upload screenshots that show personal data about other people, such as player names, Discord tags or IP addresses; crop or blur them first.
Fix my script
Fix my script uploads the code files of your resource (Lua, JavaScript, HTML, CSS and JSON) with their paths, the names of its other files, the name of the zip, the console error, your note and the framework you picked. A zip is opened in your browser: images, sounds, stream files and other non-code files stay in your browser; only their names are uploaded. The code, the file names, the console error, your note and the framework are sent to Anthropic so its Claude models can write the fix. Remove Discord webhook URLs, API keys and other secrets from the code before you send it. We check the fixed code by compiling and scanning it but never run it, either on our servers or on a game server. Encrypted (Asset Escrow) resources are refused and never sent to Anthropic. Every fix is stored in your history like other generations, with the console error, your note, the name of the zip, the framework and how many files and how much code you sent. A fix that is delivered also keeps every code file you sent as it is after the fix, changed or not; the changes to each file, which quote the lines around them; the full answer the AI wrote, which quotes the original lines it replaced; what it found wrong and what it changed; the notes file added to the download (RPFORGE_FIX.md, which repeats the console error); and the results of our checks. Deleting the chat does not delete this record: it is kept like your other generations (see Retention and security).
Payment and consent records
Stripe processes your payment information. RPForge stores purchase and package identifiers, credit quantities, quoted and paid amounts/currencies, payment status, Stripe Checkout Session, PaymentIntent and customer identifiers when available, purchase and fulfillment times, granted credits, and your checkout acceptance text, policy versions and acceptance time. For a monthly plan we also store its Stripe subscription, invoice and customer identifiers, the plan's size and price, its status and billing period, whether a payment failed and Stripe's link for paying that invoice, and your acceptance of the plan's terms. These records link purchases to your account and help resolve refunds, fraud and payment disputes. RPForge does not store full card numbers or card security codes.
Email updates
If you leave your email in the form on our site, we store the address, the page the form was on and the time. If you tick "Send me RPForge updates. Unsubscribe anytime.", we also store that sentence, when you ticked it and on which page, and email you a link to confirm; we send no updates until you open it. After you confirm, our automatic emails are at most a reminder if you have not created an account 24 hours after leaving your email, and our current prices if you opened our pricing page and have not bought credits 24 hours later: never more than one email every 48 hours and three in total, the confirmation included. To choose between them we record whether and when you opened the pricing page in the same browser (the form leaves a random key in its local storage for this), and whether an account with your email address was created or bought credits. Every email has an unsubscribe link that stops all of them at once, and mail apps can unsubscribe you with one click. If you do not tick the box, we never email you; we keep the address only to count how many visitors go on to create an account or buy. Addresses that were never confirmed, or never had the box ticked, are deleted 180 days after they were left. Unsubscribed addresses are kept with the date you unsubscribed, so that we do not email them again. Closing your account deletes this record. Emails are sent through our email provider (Resend or SendGrid).
Emails about your account
Once your email address is verified, we may send you a few automatic emails about your own account: from two days after your first script, a one-time question about how it went, with a link to our feedback form; a day after you have used all the credits you bought, our current prices, unless you have a monthly plan that renews; from three days before the credits from your monthly plan expire, how many are left and how many carry over; and after 21 days without using RPForge, how many credits you still have, only if you have some and at most once every 60 days. We never send more than one of these every 72 hours, counting our email updates to the same address, and none to admins or to addresses that are not verified. To decide which one is due we use your credit balance, your purchases and monthly plan, when you made scripts and when you last opened the site while signed in, and we record which of these emails we sent you and when. Every one has an unsubscribe link, mail apps can unsubscribe you with one click, and you can turn them off and on again in your account (turning them on does not restart our email updates). Unsubscribing also stops our email updates to that address and, if your address is a contact with our email provider, asks the provider to mark it unsubscribed, so that our announcements skip it. Unsubscribing from our email updates stops these emails too. Emails about signing in, your password and your payments are not affected. Closing your account deletes the record of these emails. They are sent through our email provider (Resend or SendGrid).
Purposes and legal bases
We process account, prompt, payment and usage data to perform our contract with you and supply the requested service. Security, abuse prevention, troubleshooting and defending claims are based on legitimate interests, subject to your rights. Records needed for legal obligations are processed on that basis. Where processing requires consent, you may withdraw it without affecting prior lawful processing. Accepting purchase terms is not consent to unrelated marketing. Optional feedback you give us, and the one-time email asking for it, are processed on the basis of our legitimate interest in improving the service. Email updates are sent with your consent, which you can withdraw at any time with the unsubscribe link in every email. Keeping an address left without consent, only to measure how many visitors sign up or buy, is based on our legitimate interest; you can object at any time and we will delete it. Emails about your own account (your first script, your credits and your monthly plan) are sent on the basis of our legitimate interest in telling customers about their own credits, plan and scripts; you can object at any time with the unsubscribe link in each of them or in your account.
Providers and sharing
Information is shared with providers as needed to operate RPForge: Stripe for payments; Anthropic for features powered by its AI models; the configured AI inference service for other generation features; Google if you use Google sign-in; and hosting (Vercel), database and configured transactional email providers (Resend or SendGrid). Once your email address is verified, it is also kept as a contact with Resend so we can email you about RPForge; every such email has an unsubscribe link, unsubscribing from our account emails asks Resend to mark the contact unsubscribed, and deleting your account deletes the contact. Prompts, attached screenshots and relevant conversation or script context are sent to the provider delivering the selected feature. Necessary payment and service-delivery evidence may be shared with Stripe, payment networks, advisers or authorities for disputes or legal obligations.
Browser storage and analytics
The application uses local storage for your login token, cached account details and language preference, and, after you leave your email in our form, the random key described under Email updates (removed when you unsubscribe from this browser). Logging out removes the stored login token and account details. These support authentication and the interface and are not advertising cookies. We also use Vercel Web Analytics, which counts page views without cookies and without cross-site identifiers. To measure how long visits last, each browser tab keeps a random visit identifier in session storage (cleared when the tab closes) and periodically tells our server that the tab is open and in use; we store that identifier, the start time of the visit, last activity time and active duration, the pages of this site you open during the visit (the page address without query parameters) and the time spent on each, key actions such as starting a build or opening checkout, error messages shown to you, and your account identifier if you are signed in. We use this to understand where visitors run into problems. It never includes your prompts or generated scripts, and we do not store your IP address or browser details for this. Google sign-in, Stripe Checkout and hosting providers may process technical information under their own policies.
Retention and security
Records are retained for the account and service purposes described above and as necessary for applicable accounting, legal, fraud-prevention and dispute requirements. Retention depends on the record type, account status and unresolved obligations or claims. Screenshots are deleted on the shorter schedule described under Screenshots. RPForge uses password/token hashing, authenticated access and restricted administrative functions. No system can guarantee absolute security.
International processing
Service providers may process information outside your country, including outside the EEA. Where data-protection law requires safeguards for international transfers, appropriate safeguards must apply, such as an adequacy decision or standard contractual clauses. Contact the operator for information about the safeguards applicable to your data.
Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing, including processing based on legitimate interests. Some records may need to be retained for legal obligations or claims. Contact support to exercise your rights; we may need to verify your identity. You may complain to the data-protection authority in your place of residence, work or the alleged infringement.
Updates
We will update this notice when relevant practices change and provide additional notice where required. The Last Updated date identifies this version.