What the scanner reads

Assume any program you're asked to run is malware, then read its scope. Trace is a scanner: it looks at FiveM and the processes attached to it, and nothing else. This is the full list.

What it reads

• Names, paths and hashes of resources loaded by FiveM
• Hashes of FiveM and CitizenFX client files
• Process names and module lists for processes attached to FiveM
• Game build number and scanner version
• Windows execution records for the scanned session (Prefetch and Amcache), to show when a flagged binary ran

What it never touches

• Browser data, cookies and saved passwords
• Your documents, downloads and any file outside FiveM and the execution records above
• Screen, webcam, microphone and clipboard
• Keystrokes and the memory of unrelated programs
• Network traffic other than one upload of the finished report

How reports are stored

Report contents	Flagged artifacts, hashes and timestamps. No screenshots and no file contents.
Retention	30 days to one year depending on plan, then deleted.
Deletion	A server owner can delete any report at any time. Players ask the server owner.
Access	Only staff holding the viewer role on that server. Every view is logged.
Transport and storage	TLS 1.2 or newer in transit, encrypted at rest.
Scanner binary	Code-signed, SHA-256 published in the docs. Runs for seconds, exits, leaves nothing installed.