Legal
Privacy policy
Last updated 11 November 2026
01Who we are
Kora (“we”, “us”) runs koraframe.work, the website for the open-source Kora FiveM framework and its community. We decide how the personal data described here is used, which makes us the “controller” under data protection law. How to reach us is at the bottom of this page.
02What we collect, and why
We only collect what is listed here. Linking GitHub or Cfx.re is your choice and you can reverse it.
Discord account
Discord user ID, username, display name, a link to your avatar and the email address Discord shares when you sign in.
Why Signs you in. Your Discord account is the root of your Kora profile. We don't use your email to contact you.
Kept Until you ask us to delete your profile.
Kora Discord roles
Whether you're in the Kora server and which roles you hold (for example Mod, Early Tester, Developer, or a rank role).
Why Decides which features you can use and which fox stage is shown.
Kept Refreshed each time you sign in. Removed with your profile.
XP and activity totals
Your XP, level, streaks and a breakdown by source (for example messages, voice, testing, bug reports, invites), calculated by the Kora Discord community bot.
Why Shown on your account page. We read it from the bot when you view the page; it isn't copied into the website's database.
Kept Held by the community bot under its own rules, not by the website.
GitHub (optional)
Your GitHub account ID, username and a link to your profile picture, only if you choose to link it.
Why Unlocks contributor features and connects your pull requests and issues to your profile.
Kept Until you unlink it or delete your profile.
Cfx.re (optional)
Your Cfx.re forum ID, username and a link to your forum profile picture, only if you choose to link it. The forum ID is the same number as the fivem: identifier in game.
Why Connects your in-game identity to your Kora profile.
Kept Until you unlink it or delete your profile.
Sessions and security records
A random session token and its expiry, plus a short log of account events such as linking or unlinking a provider, with the time.
Why Keeps you signed in and lets us investigate abuse or mistakes.
Kept Sessions last up to 30 days. Event records last as long as your profile.
Server logs
IP address, browser type, the page requested and the time, recorded when you visit.
Why Security, spotting abuse and fixing faults.
Kept 14 days.
Profile pictures are stored as links and shown on your account pages. They are loaded through our server, so your browser doesn't contact Discord, GitHub or Cfx.re to display them.
03What we don't do
- We don't sell or rent your data, and we don't show ads.
- We don't run analytics or tracking scripts, and the pages load nothing from advertising or tracking companies.
- We don't email you. We hold your Discord email because Discord supplies it at sign-in, not to contact you.
- We don't keep the access tokens Discord or GitHub give us when you sign in. We use them once to learn who you are.
- For Cfx.re we use a one-time key to read your forum ID and username, then revoke it straight away. The temporary data used for that step is encrypted and deleted within minutes.
04Cookies
We use only cookies that are strictly necessary for signing in: a session cookie, a security (CSRF) token, and a couple of short-lived cookies that exist only while you are signing in. Because they are essential, there is no cookie banner. Cloudflare may also set its own security cookie to protect the site. We don't use advertising or analytics cookies.
05Our legal bases
If UK or EU data protection law applies to you, we rely on:
- Providing the service you asked for, to run your profile and sign you in.
- Consent, when you choose to link GitHub or Cfx.re. You can withdraw it by unlinking.
- Legitimate interests, to keep the site secure, prevent abuse and fix faults (server logs and event records).
06Who we share data with
We don't share your data with anyone else, other than the services below that the site depends on. We may disclose information if the law requires it.
- DiscordSign-in, and the Kora community server.Their policy
- GitHubOptional account linking.Their policy
- Cfx.re (FiveM forum)Optional account linking.Their policy
- CloudflareSits in front of the website for speed and security, so it handles your requests in transit.Their policy
Some of these providers are based outside the UK and EEA, so your data can be processed in other countries, including the United States. Those providers use recognised safeguards for international transfers.
07How long we keep data
The table above gives each period. In short: your profile data stays until you ask us to delete it, sessions expire after at most 30 days, and server logs are deleted after 14 days. When your profile is deleted, your linked accounts, roles and sessions go with it, and any event records are detached from you.
08Your rights
You can ask us to:
- tell you what we hold about you and give you a copy,
- correct anything that is wrong,
- delete your profile and its data,
- restrict or stop how we use your data, or object to it.
You can unlink GitHub or Cfx.re yourself from Linked accounts. For anything else, contact us below and we will reply within one month. If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
09Security
The site is served over HTTPS, sign-in sessions are stored on our server rather than in your browser, and secrets are kept server-side. Access to the data is limited to the Kora team. No system is perfectly secure, so if you find a problem, please tell us.
10Children
The site is not for anyone under 13, which is also Discord's minimum age. If you think a child has given us their data, contact us and we will delete it.
11Changes to this policy
If we change what we collect or how we use it, we will update this page and the date at the top, and tell the community on Discord when the change matters.
12Contact
Open a ticket in the contact-mods channel of the Kora Discord server and mention privacy.