Privacy Policy

01Overview

This Privacy Policy explains what data the Trackborne team ("we", "us") collects when you play Trackborne (the "Service"), why we collect it, and the choices you have. We designed the game to need as little personal data as possible — you can play the entire game without ever giving us your name.

02Data we collect

Data you provide:

• Username — chosen by you, shown publicly on leaderboards.
• Email address and password — only if you choose to link an email to your account. Passwords are stored as salted Argon2id hashes; we never store or see your plain-text password.

Data created automatically when you play:

• Installation identifier — a random UUID generated on your device the first time you play, used to operate guest accounts. It is not derived from your hardware and identifies the installation, not you.
• Gameplay data — race times, medals, unlocked tracks, quest progress, Flux balance and transaction history, selected skins, and session timestamps.
• Purchase records — when you buy Flux, we receive a purchase token from the app store to verify the transaction. We do not receive your payment card details; payment is handled entirely by the app store. In-app purchases exist only in the Android and iOS versions, so no purchase data is created in the Steam or Microsoft Store versions.
• Technical data — app version and platform, used for compatibility (e.g. minimum-version checks) and abuse prevention.

03How we use data

• To run the game — saving progress, syncing accounts across devices, operating leaderboards, quests, seasons, and the in-game shop.
• Fair play — validating race times server-side, detecting impossible results, and enforcing bans.
• Support — resolving account or purchase issues when you contact us.
• Service integrity — rate limiting, security monitoring, and aggregate (non-identifying) statistics such as total races per day.

We do not sell your data or profile you for marketing. Advertising inside the game — on Android and iOS only — is handled by Google AdMob as described in section 04. Our gameplay servers do not use your race data, purchases, or account details for ad targeting.

04Advertising (Google AdMob)

On Android and iOS, the game shows in-app advertising served by Google AdMob, a service of Google LLC. When an ad is loaded, the AdMob SDK may collect and process data under Google's own privacy policy, including:

• Advertising identifier of your device (e.g. Android Advertising ID);
• IP address and coarse location derived from it;
• Device and app information — model, OS version, app version;
• Ad interaction data — impressions, clicks, and diagnostics used for frequency capping and fraud prevention.

Consent and personalization. Where required by law (for example in the EEA and UK), a consent prompt is shown before ads load. If you decline personalized advertising, non-personalized ads are shown instead — these use less data and no behavioral profile.

Your controls. You can reset or delete your advertising identifier and opt out of ad personalization at any time in your device settings (Android: Settings → Google → Ads; iOS: Settings → Privacy & Security → Tracking).

Learn more about how Google processes this data: Google Privacy Policy · How Google uses data from partner apps

05What is public

Leaderboards are a core feature: your username, avatar, race times, medals, and rank are visible to other players in-game. Your public profile also shows aggregate statistics (races finished, medals earned). Your email address is never public.

06Sharing

We share data only with:

• Hosting providers that run our servers and databases, bound by data-processing obligations;
• App stores (Google Play, Apple App Store) for purchase verification — initiated by your purchase;
• Advertising partner — on Android and iOS only, Google AdMob serves ads inside the app and processes the data described in section 04 under Google's own privacy policy;
• Authorities where disclosure is required by law.

07Retention and deletion

• Account data is kept while your account is active.
• Unlinked guest accounts that remain inactive for an extended period may be deleted.
• Login sessions expire automatically; expired sessions are purged.
• You may request deletion of your account and associated personal data at any time by contacting us from your linked email, or in-game via Settings → Account. Deletion removes your profile, records, and Flux; anonymized aggregate statistics may be retained. See the Account & Data Deletion page for step-by-step instructions.

08Security

Data is transmitted over encrypted connections and stored on access-controlled servers. Passwords are hashed with Argon2id, sessions use short-lived rotating tokens, and administrative access is logged in an audit trail. No system is perfectly secure, but we limit what we collect so there is little to lose in the worst case.

09Children

The Service is not directed at children under 13 (or the applicable digital-consent age in your country). We do not knowingly collect personal data from children below that age; if you believe a child has provided us personal data, contact us and we will delete it. On Android and iOS, ad requests for users identified as under the applicable age are configured for non-personalized, age-appropriate advertising.

10Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to processing. To exercise any of these rights, contact us at the address below. We respond within 30 days.

11Changes to this policy

We may update this Policy from time to time. Material changes will be announced in-game or on this page with a new effective date.

12Contact

Privacy questions and data requests: trackborne@codexplore.id