Privacy policy

Launch draft · 23 September 2026. Publisher identity, postal address, support/privacy contact and hosting/retention details must be completed and verified before commercial release. This preview is not a completed production notice.

We do not ask you to create an account or enter your real name. Your chosen rider name and bike are remembered on your device. Online players can see your rider name. Our server needs connection information to run the game. This family build has no analytics, ad tracking or advertising SDK.

1. Who is responsible

The controller/operator is [PUBLISHER LEGAL NAME], [POSTAL ADDRESS]. Contact [PRIVACY EMAIL] or [PUBLIC CONTACT TELEPHONE] for questions, parental requests and privacy rights. Last updated: 23 September 2026. This is the notice for the current test build; the commercial version remains subject to the marked launch requirements. This notice covers the official SMASHBIKES game and its official online service; unofficial servers have their own operators.

2. Information processed

• On your device: filtered rider nickname (dl_name) and bike choice (smashbikes-bike). They remain until changed or cleared. Older builds’ analytics identifier (dl_uid) is removed on loading this build. Game assets are cached for offline play. These are not advertising cookies.
• During online play: rider name, bike, room code, room settings, game inputs, scores and match state. The server assigns a temporary player identifier and reconnection token. Your rider name and gameplay are visible to players in the room. Public room listings also expose the host’s rider name, room code, map, status and player counts.
• Connections and security: servers and hosting/network providers receive IP addresses and request/connection metadata. Application logs include timestamps, temporary player IDs, room codes and join/disconnect events. Web-server or provider logs may include IP addresses, request paths and device/browser headers. A nickname does not make all of this information anonymous.
• Support: if a parent or player contacts us, we receive the contact information and content they choose to send. Please avoid unnecessary personal information or details about other children.

3. Purposes and legal bases in the EEA

We process the minimum necessary information to deliver requested multiplayer sessions, keep the service secure and respond to support or legal requests. Where applicable, the legal bases are performance of a valid service agreement, legitimate interests in reliable and safe operation, and compliance with legal obligations. Legitimate interests require a documented assessment that gives particular weight to children’s rights. We do not assume a child can enter a binding contract. Any feature needing consent will remain disabled until the required consent and withdrawal mechanisms exist.

4. Children and families

The game is intended to include children. Custom nicknames are checked against a banned-word dictionary on the client and server; there is no text or voice chat, profile upload or account registration. We do not ask for a real name, date of birth, email address or precise location in the game. Children should ask a parent or guardian for help with support.

For US children under 13, any collection of persistent identifiers without parental consent must be limited to an applicable COPPA exception, such as support for internal operations, and satisfy all its restrictions. That exception is not a blanket exemption for online games. We will not activate a feature requiring verifiable parental consent until it has been implemented. EEA parental-consent thresholds vary by country where consent is the legal basis. No age rating overrides these privacy rules.

Parents may ask what information is held about their child, request deletion or object to further collection, subject to applicable law. Contact [PRIVACY EMAIL]. We use proportionate verification and do not ask a child to submit identification through the game.

5. Advertising and sharing

Current build: no ad-network SDK, advertising identifiers, tracking pixels or personalized advertising are active. Static sponsorship and network advertising are planned, not activated by this notice.

Planned network advertising: Google AdSense or another eligible Google publisher product may be used on the website, and Google AdMob may be used in future native mobile apps. Additional providers require individual review and disclosure before they are enabled. Planned family settings prohibit personalized ads/remarketing and apply child-appropriate treatment to children and users of unknown age.

Depending on the final integration and lawful settings, ad providers may receive IP addresses, general location derived from IP, browser/device and app/page information, consent choices, ad requests, impressions, interactions and fraud-prevention signals. Permitted cookies or device identifiers may also be involved. We will not intentionally send rider names, room codes or reconnection credentials in ad requests. Data may be used for delivery, frequency control, measurement, security and fraud prevention; non-personalized ads can still process personal information.

Google explains its handling of partner data in How Google uses information from sites and apps and its privacy policy. These links do not mean Google advertising is currently integrated. Before enabling any service, this notice must identify the contracted provider, its processing role, actual enabled data uses, recipients, retention and transfer safeguards. We do not assume all ad services act only as our processors.

Where legally required, optional processing needs valid prior consent and an accessible way to withdraw. Child-related processing requires an applicable lawful route, not a child's unsupported “accept” click. We will not treat acceptance of game terms as advertising consent. Network ads remain off if applicable legal, child-safety or consent requirements cannot be met. The current no-ad build does not sell personal information or share it for cross-context behavioral advertising; that assessment must be revisited before new providers activate.

Hosting and network providers process information needed to operate the service. The official game is hosted on an operator-managed Oracle Cloud server in Frankfurt, Germany (eu-frankfurt-1), verified from the instance metadata on 23 September 2026. This identifies the game-server location, not every location used by Oracle support or subprocessors. The contracted Oracle entity, applicable processing agreement, subprocessors and any international-transfer safeguards still require verification from the publisher’s hosting agreement: [CONTRACTED PROVIDER / TRANSFER DETAILS]. We may disclose necessary information when legally required or to protect service safety. We do not sell personal information or share it for cross-context behavioral advertising.

6. Retention and international transfers

Device preferences remain until you clear them. Live room state is temporary; reconnection credentials normally have a 60-second reconnection window after disconnection, and room state is discarded when its lifecycle ends or the server restarts. It is not a permanent player profile.

Current test-server logs: Nginx is configured for daily rotation, retaining 14 rotated files in addition to the current file. Rotation skips empty logs, so this is not a guarantee of deletion after exactly 14 days. Application output is held in the system journal, which currently has no explicit age-based retention limit; storage limits and journal management determine its actual lifetime. A defined, enforced retention schedule is a commercial-launch requirement.

Provider-managed logs and backups may have separate retention periods. These must be confirmed in the hosting account before commercial release: [PROVIDER LOG AND BACKUP RETENTION]. There is no operating support mailbox yet; its provider and retention schedule must be established before launch: [SUPPORT PROVIDER AND RETENTION]. Any exceptional preservation for a legal obligation or security incident must be limited to what is necessary and reviewed.

The game server is in the EEA. If providers or support operations transfer personal information outside the EEA, the publisher must document an applicable lawful transfer mechanism and make details available on request: [INTERNATIONAL TRANSFER SAFEGUARDS]. EEA hosting alone does not establish that no international transfers take place.

7. Your choices and rights

Clear saved preferences to remove your name and bike choice from this device. Clearing device storage does not delete server logs. There is no account to delete. You can stop online play at any time and use offline mode where available.

Depending on applicable law, you may request access, correction, deletion, restriction, portability, object to processing (including processing based on legitimate interests), or withdraw consent where consent is used. Contact [PRIVACY EMAIL]. We respond within applicable legal deadlines and may need proportionate verification. We cannot always link temporary session records to a requester, and will not collect additional identifying data just to create a permanent profile.

EEA residents may complain to their local data protection supervisory authority. US state privacy rights, where applicable, may include access, correction, deletion, portability, opt-out and appeal; requests and appeals go to [PRIVACY EMAIL]. Exercising rights will not result in unlawful discrimination. We do not currently conduct the sale, targeted advertising or consequential automated decision-making activities to which some opt-out rights relate.

8. Cookies, device storage and tracking choices

The cookies and device-storage policy lists saved preferences, session settings and offline caches. This build does not use advertising or analytics cookies, tracking pixels or fingerprinting. Browser tracking-preference signals do not change gameplay; there is currently no sale or targeted-advertising activity to opt out of. We will not interpret continued play or acceptance of game terms as consent to future optional tracking.

9. Security and changes

The official online test service uses HTTPS/WSS to encrypt data in transit. Access controls and retention limits must be maintained; no service can promise absolute security. Material changes will be announced in the game and this notice updated before new processing begins. Any new consent requirement will be implemented before the relevant collection starts.