Scope
This Privacy Policy applies to the WorldRacer iOS application, website, and related services (the “Services”). “WorldRacer,” “we,” “us,” and “our” mean [Operator legal name not configured], located at [Operator postal address not configured], the controller responsible for the processing described here.
WorldRacer is intended only for people aged 18 or older. By using the Services, you confirm that you meet this age requirement.
Data we collect
Account information
When you sign in with Apple or Google, we may receive an account identifier, your name, email address, and authentication status, depending on your choices and the provider’s settings. We also store your chosen public WorldRacer username. For Sign in with Apple, we securely encrypt a provider refresh token so we can revoke the authorization when you delete your account.
Location and driving data
When you choose to record a track or challenge one, WorldRacer collects precise location samples, timestamps, GPS accuracy, speed, and direction of travel. WorldRacer may also collect relevant device motion signals when motion-based validation is enabled. We use this trace to draw the route, detect start and finish crossings, calculate elapsed time, and assess whether an attempt is valid.
Content and competition data
We store tracks you publish, track names and approximate locations, timed attempts, validation results, leaderboard positions, and your best valid time for each track.
Purchase and technical data
If you purchase a subscription, we receive product, entitlement, renewal, and transaction status from Apple. Apple processes your payment details; WorldRacer does not receive your full card information. We may also process basic device, app-version, error, security, and diagnostic information needed to operate and protect the Services.
How we use data
We use your information to:
- create and display tracks you record;
- time, validate, rank, and retain attempts;
- operate public track leaderboards;
- authenticate accounts and prevent impersonation;
- apply free allowances and premium entitlements;
- detect fraud, GPS manipulation, abuse, and unsafe misuse;
- maintain, troubleshoot, secure, and improve the Services;
- comply with legal obligations and enforce our rules.
Where applicable, our legal bases include performing our contract with you, our legitimate interests in operating and securing WorldRacer, your consent for device permissions, and compliance with law. You can withdraw device permission through iOS Settings, although route recording and timed challenges will then stop working.
Storage, transfers, and retention
Information may be processed in countries other than the one where you live. Where required, we use appropriate safeguards for international transfers.
We retain account information while your account is active. Precise GPS samples submitted with a timed attempt are retained for up to 30 days for validation, fraud review, and dispute handling, then deleted; the attempt time, validation result, leaderboard eligibility, and a non-reversible trace hash remain. A route you deliberately publish remains visible with its track until you unpublish or delete it, or until we remove it. Expired authentication sessions and email action tokens are removed by scheduled maintenance; challenge grants are removed after the limited offline-upload grace period has elapsed. We may retain security, transaction, moderation, dispute, and legal records for longer where reasonably necessary, with direct account identifiers removed where appropriate.
We use reasonable technical and organizational safeguards, but no online system can guarantee absolute security. Keep your device and sign-in account protected and contact us if you suspect unauthorized access.
Your choices and rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our use of your personal information; receive a portable copy; withdraw consent; or appeal a privacy decision. You may also have the right to complain to your local data-protection authority.
You can manage location permission in iOS Settings and subscription renewal through your Apple ID subscription settings. While signed in, you can request a machine-readable copy of your WorldRacer data through the authenticated data-export function. You can permanently delete your WorldRacer account and its associated tracks and attempts from the profile screen, or contact us for another privacy request. A confirmed deletion request immediately blocks further account access and is durably retried by our maintenance system until the local data purge completes, including after a temporary service or database interruption. A random deletion receipt lets the requesting device confirm completion after its session and account are gone; after completion we retain only a keyed one-way receipt hash, status, provider-revocation outcome, and timestamps for up to the configured receipt-retention period, then purge them. Limited moderation records may be retained without your direct account identifiers where needed to preserve the integrity of safety decisions. We may need to verify your identity before completing a request.
We do not knowingly collect information from anyone under 18. If you believe a minor has provided information to WorldRacer, contact us so we can investigate and remove it.
Changes and contact
We may update this policy as WorldRacer develops. If a change materially affects your rights, we will provide reasonable notice in the app, on the website, or by another appropriate method. The effective date above shows when this version took effect.
Please include “WorldRacer Privacy” in the subject line.