Nitro Legend Privacy Policy

1. Your account

The first time you open the game, it creates a guest account for you on my server without asking for anything. The server runs on Cloudflare and stores a random account ID, when the account was created and when you last played, and your sign-in session: a random token with its expiry date, and the IP address and device type it was created from, which help stop abuse. The game keeps the session token on your device so you stay signed in. The server also keeps your progress: cash, cars and their parts, tunes, paint and decals, career progress and level. It keeps them itself so that a purchase or a race prize only counts once the server has checked it. For every career race it stores a ticket with the event, the car raced and a random number that drives the opponent. When you watch a rewarded ad, AdMob tells my server so it can pay the reward, and the server keeps the ad's transaction ID and ad unit with your account so no reward is paid twice. If you link Sign in with Apple or Google sign-in, so your progress can follow you to another device, I also store the account ID that Apple or Google gives me and the name and email address it shares. Apple lets you hide your email address behind a relay address.

The server also keeps game statistics for each account, so I can see how far players get, where they stop and how much rewarded ads speed up the career. It records when you open the game (with the game version and whether it is the app or the website), the story scenes you reach, the result of each career race (the event, whether you won, the stars and the prize), which rewarded ads the game offered you and which you watched, what you buy with cash or gold and what it cost, the gold packs you buy, and when you run out of fuel. These statistics stay on my server and go to no one else. Share data in the game's settings stops them, together with the crash reports in section 7.

2. How long I keep it

A guest account that is not used for 12 months is deleted automatically, with everything stored for it. A linked account is kept until you delete it. Delete account in the game's settings deletes your account and all its data on the server at once. In both cases the game statistics from section 1 stay, under a new random ID that no longer leads back to you or your account.

3. Data stored on your device

Your settings (volume, units, vibration) are saved in the app's local storage on your device and are not sent to me. The app also keeps a copy of your progress there, so your garage shows without waiting for the server. Both are deleted when you delete the app, and Delete account erases the copy too.

In the apps, Alerts in the settings is off until you turn it on. The reminders that your tank is full or your daily bonus is back are scheduled on your device and send nothing anywhere. To tell you when a new district opens, the app also registers with Google's Firebase Cloud Messaging: your device gets a random push token, and the app subscribes it to the last district you finished. The token carries no account, player ID or name, and I never see it. Turning Alerts off deletes it. (Firebase privacy and security)

4. Races and leaderboards

When you join an online race, the game connects to a race server run on Cloudflare. It sends the room code, your sign-in session, your tune and your race inputs (gas, shifts, nitrous), and the server races the car your account has selected. After a career race the game sends your inputs too. Either way the server replays the race from those inputs to judge it. Other players in an online room see your car, its paint and your lane, not your account or nickname. The server keeps room data only while the room exists and deletes it when the last player leaves.

Your best time for each distance and car class goes on the leaderboards, with your nickname, your car model and the date. The leaderboards are public: anyone can see them in the game and on this website. Your nickname is shown nowhere else. Delete account removes your times and your nickname. As with any web server, Cloudflare sees your IP address in order to deliver the connection. (Cloudflare privacy policy)

5. Advertising

The free apps show ads served by Google AdMob. To show those ads and measure how they perform, Google may collect your device's advertising identifier (IDFA on iOS, Advertising ID on Android), your IP address, device and app information, and how you interact with the ads.

• In the European Economic Area, the UK and Switzerland, the app asks for your consent before it personalises ads. If you decline, you see non-personalised ads, which use only limited data such as an approximate location derived from your IP address. In these regions you can change your choice at any time with the Privacy options button in the game's settings.
• On iOS, the app asks your permission before your advertising identifier can be used for tracking (App Tracking Transparency). You can change this later in iOS Settings, Privacy and Security, Tracking.
• On Android, you can reset or delete your Advertising ID in your device settings.

For more detail, see how Google uses data from apps that use its services and the Google privacy policy.

6. In-app purchases

The Apple App Store or Google Play handles every purchase, and I never receive your payment details. The app uses RevenueCat to confirm and restore purchases. RevenueCat receives the purchase receipt, the product bought, a random app user ID and basic device information. (RevenueCat privacy policy)

7. Crash and performance reports

When the game hits an error or crashes, the apps and the game on this website send a report to Sentry. It holds the error and the place in the game's code where it happened, the game version, your device's maker and model, its operating system and version, how much memory it has, and the screen you were on.

While you play, the game also sends a few numbers to Sentry: how long it took to start and to open each screen, how much memory it used there, and the frame rate of each race.

Reports carry no account, player ID, nickname or advertising identifier. Sentry sees your IP address in order to deliver the connection, and is set not to store it. Reports are kept for 30 days. You can stop them at any time with Share data in the game's settings. (Sentry privacy policy)

8. The website

This website runs on Cloudflare, which processes your IP address and browser information to deliver the pages. It sets no advertising or analytics cookies. (Cloudflare privacy policy)

9. Legal bases (GDPR)

10. Children

The game is not directed at children under 13, and I do not knowingly collect personal data from them. If you believe a child has shared personal data, contact me and I will delete it.

11. Your rights

Under the GDPR you have the right to access, correct, delete and port your personal data, to object to or restrict its processing, and to withdraw consent. Two of these work directly in the game's settings: My data downloads everything stored about your account as a file, and Delete account deletes your account and its data. For anything else, or if you can no longer open the game, email me (section 14). For data held by Google, Apple, RevenueCat or Sentry, you can also use their own tools. You may complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or to the authority in your own country.

12. International transfers

Google, Cloudflare, RevenueCat and Sentry may process data outside the EU, including in the United States. They do so under the EU-US Data Privacy Framework or standard contractual clauses.

13. Changes

If the game starts storing more on the server or sending data to another service, I will update this policy before that change is released and change the date at the top.

14. Contact

Ruben Heymans, Belgium. Email: info@nitrolegend.com