Privacy Policy

We handle your account email, authentication records, workspace name, optional logo, plan and payment references, and race results. Password authentication is handled by our hosting provider. Stripe processes payment-card information; we do not store complete card numbers.

We use this information to provide your account and purchased service (contract), maintain security and prevent misuse (legitimate interests), and comply with applicable accounting and legal duties (legal obligation).

Game mode players choose a nickname and racer colours and use temporary player/session identifiers. Race scores and chosen racer appearance may be displayed on the shared screen and saved to the organiser’s leaderboard. Players do not need to provide an email or password.

Connection and technical information may be processed to deliver and protect the game. Our legitimate interests are operating a secure multiplayer service; these interests must be balanced against players’ rights.

Business mode collects name, email, nickname, a join timestamp and marketing opt-in choice. The event organiser controls this information. The Race Game stores it on the organiser’s behalf and provides private viewing, CSV export and deletion tools.

The organiser must explain their own identity, purposes, lawful basis, retention and participant rights. Required name/email collection is separate from optional marketing consent and must have an appropriate lawful basis determined by the organiser. Declining marketing does not prevent participation.

Emails are not shown on game screens or broadcast to other participants. Contact the event organiser about their marketing or your lead record; exported copies are controlled by the organiser.

The service uses necessary browser storage for sign-in sessions, host device identification, room participation and game/audio preferences. Payment providers may use storage required to process and protect payments.

Any future optional analytics or advertising tracking will need appropriate disclosure and consent where required. This notice does not authorise optional tracking.

Lovable Cloud supplies hosting, authentication, data storage and live room services. Stripe processes payments and may act as an independent controller for some payment activities. Data may also be disclosed where required by law.

Before this notice is finalised, the relevant provider legal entities, processing locations, applicable sub-processors and any international-transfer safeguards must be verified. We do not claim that all processing stays in the UK. Where UK GDPR restricts a transfer, an applicable adequacy decision or other lawful safeguard is required.

Account and workspace data are kept while needed to operate the account, followed by any justified legal or security retention. Leaderboards remain until reset or otherwise deleted. Participant leads remain in the workspace until the organiser deletes them or requests closure.

Deleting leads removes them from the active collection; provider backups may retain restricted copies until their deletion cycle completes. Downloaded CSV files are not removed by in-app deletion. Exact retention periods and backup schedules must be confirmed before this policy is finalised.

We use authenticated owner access, workspace isolation and HTTPS to protect data. No system is risk-free, and specific provider encryption and security claims must be verified rather than assumed.

Depending on the lawful basis and circumstances, you can request access, correction, erasure, restriction, portability, and object to processing. Where consent is used, you can withdraw it without affecting earlier lawful processing. We do not use participant data for automated decisions with legal or similarly significant effects.

For Business mode lead records, contact the organiser first. We assist the organiser with requests. Requests about our account administration should be sent to the seller once the confirmed contact details are provided.

You may complain to the Information Commissioner’s Office at ico.org.uk. We aim to respond to rights requests within one month, subject to lawful extensions and identity checks.

Organiser accounts are for adults. Where events include children, organisers must provide suitable supervision and age-appropriate privacy information and must assess whether collecting their contact details is appropriate and lawful.

We will update this notice when our processing changes. This draft was updated on 10 November 2026; legal identity, contact details, retention and provider arrangements still need completion.