This policy explains how RatRace collects, uses, and protects your personal data. It is written in accordance with the EU General Data Protection Regulation (GDPR, EU 2016/679) and the French Data Protection Act (Informatique et Libertés).

1. Data controller

The controller of your personal data is Nam Duong, based in France. For any question about your personal data, write to: heo19981258@gmail.com.

2. Data we collect

We collect strictly what is needed to run the service:

• Google account information — email address, display name and profile picture — provided by Google when you sign in. A unique identifier (UID) assigned by Firebase Authentication.
• Profile — preferred game mode (kid / adult), customised display name, dates of consent acceptance, and analytics preference.
• Gameplay activity — games played, games won, history of finished games, in-game decisions (cards drawn, deals taken, etc.) and final statements.
• Technical data — IP address, browser and operating system, collected automatically by Google Firebase Hosting for security and reliability purposes.
• Anonymised usage statistics — only if you accepted analytics cookies (see section 6).

3. Purposes and legal bases

• Service provision (Article 6.1.b GDPR — performance of a contract): authentication, saving your progression, matchmaking, displaying games appropriate for your mode.
• Security and abuse prevention (Article 6.1.f — legitimate interest): authentication logs, anti-bot enforcement via Firebase App Check.
• Anonymised usage analytics (Article 6.1.a — consent): only if you clicked “Accept all” in the cookie banner. You can withdraw consent any time from your profile.

4. Sub-processors and data sharing

We never sell your data. It is processed by the following technical providers, chosen for their GDPR compliance:

• Google Sign-In (Google LLC) — authentication provider.
• Google Firebase Hosting (Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland) — web hosting, Firestore, Realtime Database.
• Google Analytics for Firebase (Google Ireland Limited) — anonymised audience measurement (only if you accept analytics cookies).

These providers may transfer data outside the EU (notably to the United States). Google relies on the European Commission’s Standard Contractual Clauses and the EU-US Data Privacy Framework to govern such transfers.

5. Retention period

• Profile and gameplay activity: kept while your account is active, then deleted within 30 days of an erasure request.
• Technical logs: 12 months maximum (Firebase).
• Analytics data: 14 months (Google Analytics default setting).

6. Cookies and local storage

We use a minimal number of cookies and local storage entries:

• Strictly necessary cookies (Firebase Auth) — to keep you signed in. No consent required.
• Local storage for your cookie preference — so the banner is not shown on every visit.
• Analytics cookies (Google Analytics) — loaded only if you click “Accept all” in the banner. You can refuse or change your mind any time.

7. Your rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — know what data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate information.
• Right to erasure (Art. 17) — delete your account and all data.
• Right to portability (Art. 20) — download your data as JSON.
• Right to object / withdraw consent (Art. 21) — refuse analytics tracking.
• Right to lodge a complaint with the CNIL.

Access, portability and erasure rights are exercisable directly from the My profile page. For other requests, write to heo19981258@gmail.com.

8. Minors

RatRace is open to users aged at least 13, in line with Google Sign-In’s terms of service. In France, the digital age of consent is set to 15 by the Data Protection Act. For users between 13 and 14 years old, the agreement of a parent or legal guardian is required. Parents wishing to exercise rights of access or erasure on behalf of a child can contact us at heo19981258@gmail.com.

9. Security

Your data is stored in Google Cloud Firestore and Realtime Database, encrypted in transit (HTTPS) and at rest. Access is restricted by Firebase security rules that scope each user to their own data. Administrative accounts are managed manually.

10. Changes to this policy

This policy may be updated to reflect legal or technical changes. The date of the last update is shown at the top of this page. In the event of a substantial change, we will notify you on the platform before any application.

By continuing to use RatRace, you confirm that you have read and accepted this policy and our Terms of Service.