Legal

Privacy Policy

Effective October 6, 2026

The short version

You can play without giving us your name, email or phone number. Your account starts as a guest identified by a random install ID.
If you connect Google Play Games, we store your Play Games player ID so your progress and purchases follow you to other devices.
We store what the game needs: your rider name, races and results, rank, cash, XP, owned bikes and items, and your loadout.
Purchases go through Google Play. We never see your card or payment details, only the purchase record needed to unlock your bike.
No ads. No advertising ID. No third-party analytics or advertising SDKs. We never sell your data.
Delete your account any time in Settings → Account → Delete account, or by email.

1. Who we are

Rash Riders (the "game") is developed and operated by Tanvir Mahin ("we", "us", "our"), who is the data controller for the information described here. This policy covers the Android app, our online game services and this website. Questions? Contact tanvirmahin24@gmail.com.

2. What we collect and why

2.1 Guest account

The first time the app connects to our servers it creates a guest account, so your progress is saved without any sign-up. We store:

Install ID: a random identifier generated by the app on your device. It is not derived from your phone's hardware, phone number or advertising ID, and our servers store only a one-way hash of it.
Account dates: when the account was created and last used.

When you sign in, the server gives your device a signed session token that expires after 30 days. The token stays on your device; we don't keep a copy.

2.2 Google Play Games (optional)

If you connect Google Play Games, the app passes a one-time sign-in code from Google to our server, which exchanges it with Google for your Play Games player ID and gamer name. We store only the player ID, linked to your account, so you can restore it on any device; your gamer name is not stored. We do not receive your email address, contacts or any other Google account data, and we do not keep Google access tokens.

If you connect a Play Games account that already has a Rash Riders profile, that profile is loaded. Premium bikes bought on the guest account move to it; the guest account's cash, XP and rank are not merged.

2.3 Gameplay data

Rider name: one is generated for you and you can change it. It is shown to other players and on public leaderboards.
Races and results: mode, highway, finishing position, time, knockouts, wipeouts and rewards. Offline race results are sent when you are next online so you earn rewards.
Rank: your matchmaking rating (MMR) and ranked tier.
Progress: cash, XP and level, owned bikes and cosmetic items.
Loadout: the bike, paint, decals and rider outfit you have equipped, which other players see.

During an online race, real-time packets carry only gameplay state (your inputs, positions, hits and pickups). They are processed live by the race server and are not stored, apart from the race result.

2.4 Purchases

Premium bikes are sold through Google Play Billing. Google processes the payment under its own terms and privacy policy – we never see your name, card, bank or billing details. When you buy a bike, the app sends the purchase to our server, which verifies it with Google Play and stores a purchase record: the product, the Google Play purchase token, the order ID, the purchase time and its status. We use it to unlock the bike exactly once, restore it on your other devices, prevent fraud and handle refunds: our server regularly asks Google Play which purchases were refunded or charged back, marks those records as voided and removes the bike they unlocked.

2.5 Technical data

Like any online service, our servers see your IP address when your device connects. We use it in memory for security and rate limiting (for example, to block abuse and floods). The game server does not write IP addresses to its logs; network and hosting logs that may contain them are kept for a short time (see section 5). The game server's own logs record technical events; some name your account's random ID (for example a refunded purchase, or an account deletion so it can be re-applied if we ever restore a backup). We do not use your IP address to locate you or build a profile.

2.6 Local Wi-Fi play

Local Wi-Fi games are discovered and played directly between devices on your network (UDP broadcast and direct connections). This traffic stays on your local network and never reaches our servers. Android's network, Wi-Fi state and multicast permissions are used only for this.

2.7 On your device

The app saves your settings, your install ID, session token and a cached copy of your progress on your device so the game works offline. Uninstalling the app or clearing its storage removes them.

2.8 What we don't collect

We do not collect your email address (unless you email us), phone number, location, contacts, photos or files, microphone or camera data, advertising ID or hardware identifiers. The app contains no advertising SDKs and no third-party analytics or tracking SDKs. This website sets no cookies and uses no trackers.

3. How we use it, and our legal bases

To provide the game (contract): save progress, run matchmaking, rooms and races, show your rider name and loadout to other players, calculate rewards and rank, and restore your account and purchases on your devices.
To deliver and restore purchases (contract).
To keep the game fair and secure (legitimate interests): detect cheating, rate-limit abuse, replace offensive names and protect our servers. You can object to this processing by contacting us.

We do not use your data for advertising, sell it, or make automated decisions about you that have legal or similarly significant effects.

Other players see your rider name, loadout, rank tier and race results in online modes.
Anyone can see public leaderboards and rider profiles: your rider name, level, rank, race, win and knockout counts, loadout and the date you joined. Pick a rider name that doesn't identify you if you prefer to stay anonymous.
Google acts as our processor and service provider for Google Play Games Services (sign-in verification) and Google Play Billing (purchase verification and refunds). Google's privacy policy also applies to your use of those services.
Hosting providers that run our servers and database process data on our behalf, under contract, only to operate the service.
Authorities, only when the law requires it or to protect the safety of players and the service.

We do not sell, rent or trade personal information.

5. How long we keep it

Account, progress, loadout and rank: while your account exists. Deleting your account removes them from our database at once.
Race history: while your account exists. After deletion, finished online races keep only anonymous rows (position, time, rank change) so other riders' results stay correct.
Purchase records, including refunded ones: while your account exists, so your bikes can be restored and refunds handled. Google Play keeps its own records of your orders under Google's privacy policy.
Database backups: kept for 14 days, then deleted. Data you delete disappears from them within 14 days.
Game server logs (no IP addresses, at most your account's random ID): up to 14 days.
Network and hosting logs with IP addresses: up to 14 days.
Real-time race traffic: not stored.

6. Your rights and choices

Delete your account and data in the app (Settings → Account → Delete account) or by email. See Delete your account for details.
Change your rider name and loadout in the app at any time.
Access, correct, export, restrict or object: email us with your rider name (shown on your Profile) so we can find your account.
Complain to your local data protection authority if you are unhappy with how we handle your data.

We respond to requests within 30 days.

7. Children

Rash Riders is not directed to children under 13 (or the higher minimum age that applies in your country), and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

8. Security

Account, progress and purchase traffic is encrypted in transit with TLS. Install IDs are stored only as hashes, access to our servers and database is restricted, we keep the minimum data the game needs, and purchases are verified server-side with Google. No system is perfectly secure; if you find a vulnerability, please tell us at tanvirmahin24@gmail.com.

9. International processing

Our servers and service providers may be located outside your country, including in countries with different data protection laws. Where the law requires it, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

10. Changes to this policy

We will update the effective date above when this policy changes. For significant changes we will also notify players in the app or on this website before they take effect.

11. Contact

Tanvir Mahin · tanvirmahin24@gmail.com