Privacy Policy

1. About this policy

1.1. This Privacy Policy applies to the game website streetracers2.com and its apps.

1.2. It explains how your personal data is processed when it is collected as you use Geimika's services on the websites the company operates. Personal data is any information relating to a natural person that can be used to identify that person.

1.3. This Privacy Policy complies with the EU General Data Protection Regulation (GDPR) and the EU ePrivacy Directive.

2. Who is responsible

2.1. The controller of your personal data is Geimika MB (address: Janulaicio g. 13, Kaunas, Lithuania, company code 308160038).

2.2. For any question or request about this Privacy Policy, write to support@streetracers2.com. We have not appointed a data protection officer, as the law does not require one for our processing.

3. Nature and purposes of the data we process

3.1. We process only the data needed for the purposes below, and name the legal basis for each under Article 6(1) GDPR:

1. 3.1.1. Account: your nickname, email address, password (stored in encoded, not readable, form), chosen avatar, country, email verification status and sign-up date. We need these to create and run your account and provide the game (contract, Art. 6(1)(b)).
2. 3.1.2. Guest play: a guest account has a nickname, avatar and country but no email or password, and works only on the device that created it. We suggest your country from the approximate location of your IP address, as reported by our network provider; you can change it (contract, Art. 6(1)(b)).
3. 3.1.3. Sign-in with Discord: if you choose it, we receive your Discord user ID, username, avatar, the date your Discord account was created, your email address if Discord reports it as verified, and whether you are a member of our Discord community server. We use this to sign you in, check reward eligibility and stop rewards being claimed by several accounts (contract, Art. 6(1)(b), and our legitimate interest in preventing abuse, Art. 6(1)(f)). We never store your Discord access token.
4. 3.1.4. Chat: messages you send in public or private chat, as well as reports, mutes and ignore lists. We keep these to provide the chat and moderate it for player safety (Art. 6(1)(b) and (f)).
5. 3.1.5. Sign-in sessions and security: for each signed-in device we keep the session dates and your browser's user agent, so sessions can be managed and ended. Our servers process your IP address to deliver the site, limit request rates and detect cheating and attacks; security events concerning your account may be stored with the IP address (legitimate interest in a secure and fair game, Art. 6(1)(f)).
6. 3.1.6. Purchases: real-money purchases of products are managed and processed by our intermediary Tebex. We receive the transaction ID, products, amount and currency, and Tebex's purchase notifications, which can include your name, email address, country and IP address. We pass your IP address to Tebex so it can show prices for your region. We need this to deliver what you bought and to keep accounting records (contract and legal obligation, Art. 6(1)(b) and (c)). We do not see your card or bank details.
7. 3.1.7. Store usage: per player and day, we record whether you opened the in-game bank and viewed or clicked offers, to improve the store (legitimate interest, Art. 6(1)(f)).
8. 3.1.8. How you found us: when you sign up, we store the referral code you used, the campaign tags in the link you followed (UTM parameters), the referring website and the landing page. This tells us which channels bring players and lets us reward referrals (legitimate interest, Art. 6(1)(f)).
9. 3.1.9. Advertising measurement: only if you allow advertising, as described in the next section (consent, Art. 6(1)(a)).
10. 3.1.10. Emails: we send account emails only: account activation, password reset, and a notice when someone tries to register with your address (Art. 6(1)(b) and (f)). We do not send marketing emails.
11. 3.1.11. Push notifications: if you turn them on, we store your browser's push subscription and user agent to deliver game notifications (consent, Art. 6(1)(a)). You can turn them off at any time.

3.2. An email address or Discord sign-in is only needed for a full account; you can play as a guest without one. Without the data needed for the contract, we cannot provide the game.

4. Advertising effectiveness measurement

4.1. Only with your consent, we tell our advertising partners when an ad led to a new player: when an account is created or registered, when a player reaches an early milestone, and when a purchase is made, with its value. For this we send, directly from our server:

1. 4.1.1. to Meta Platforms Ireland Ltd. (Conversions API): the ad click identifier, a SHA-256 hash of your email address, a SHA-256 hash of your account ID, the event and its time;
2. 4.1.2. to Google Ireland Ltd. (Google Ads): the ad click identifier, the event and its time.

4.2. We never send your nickname, your email address in readable form, your IP address or your user agent, and we place no advertising pixels or third-party tracking cookies in your browser. Ad click identifiers from links stay only in your browser's memory until you consent; without consent they are discarded. Sent events are deleted from our systems 90 days after sending.

4.3. You can give or withdraw consent at any time in Settings. Withdrawing stops any further sending and cancels events still waiting to be sent; it does not affect processing done before. We currently use no analytics tools.

5. Cookies and data storage on your device

5.1. We use one cookie: a strictly necessary cookie, valid for 10 minutes, that completes sign-in with Discord.

5.2. We also use your browser's local storage, mostly for what is strictly necessary to provide the service you asked for: your sign-in tokens, selected world, language and saved translations, game preferences such as camera mode and map view, tutorial progress, and which notices you have dismissed. These do not require consent.

5.3. Local storage also keeps your consent choice and, for up to 30 days, how you first arrived at the site (campaign tags, referring website and landing page); this is sent to us only when you register. Ad click identifiers are stored only after you allow advertising.

5.4. To make purchases possible, our pages load the checkout script of our payment provider Tebex, which may set cookies needed for checkout under its own privacy policy.

5.5. You can clear cookies and local storage in your browser at any time; you will then be signed out.

6. Sharing data with other players

6.1. Other players can see your nickname, avatar and country flag. Choose a nickname that does not reveal your real identity.

6.2. Players can also send messages in public and private chat channels. Private messages are visible only to their recipient.

6.3. You may choose to share personal data with other players, but you are responsible for doing so.

7. Sharing data with third parties

7.1. We share personal data with third parties only as far as needed to achieve the purposes above:

1. 7.1.1. Hetzner Online GmbH, Germany: hosts our servers and databases (processor).
2. 7.1.2. Cloudflare, Inc.: delivers the site, protects it against attacks and tells us the country of your connection (processor).
3. 7.1.3. Brevo (France): sends our account emails (processor).
4. 7.1.4. Tebex Limited (United Kingdom): sells and processes real-money purchases as our reseller and merchant of record; Tebex is an independent controller under its own privacy policy.
5. 7.1.5. Discord Inc.: only if you sign in with Discord; an independent controller.
6. 7.1.6. Meta and Google: only with your advertising consent, as described above.
7. 7.1.7. The push service of your browser vendor (Google, Mozilla, Apple or Microsoft): only if you enable push notifications, to deliver them.
8. 7.1.8. Authorities: where the law requires it.

7.2. We do not sell your personal data.

8. Transfers outside the EU

8.1. Our servers are located in the EU/EEA. Some recipients (Cloudflare, Discord, Google, Meta, browser push services, and Tebex in the United Kingdom) may process data outside the EU/EEA. Such transfers rely on an adequacy decision of the European Commission (for example for the United Kingdom, or for US companies certified under the EU-US Data Privacy Framework) or on the Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards used.

9. Data retention periods

9.1. Account data: until your account is deleted.

9.2. Guest account data: a guest account that has not been used for 12 months may be deleted, together with its game data.

9.3. Sign-in sessions: until they expire (at most 30 days after sign-in) or you sign out, then removed shortly after.

9.4. Activation and password reset links: valid for 24 hours and 1 hour respectively.

9.5. Chat: only the latest 50 messages per channel are kept; messages removed by moderators are kept as moderation records.

9.6. In-game transaction history: 6 months.

9.7. Advertising events: 90 days after sending.

9.8. Purchase records: as long as tax and accounting law requires.

9.9. Security, moderation and anti-abuse records, including IP addresses in security events and the history of Discord account links: as long as needed to protect the game, also after account deletion, so that bans and reward limits cannot be bypassed.

9.10. Server access logs: for a short period, for security and troubleshooting.

10. Deleting your account

10.1. To have your player account deleted, contact us at support@streetracers2.com from your account's email address; for a guest or Discord account, include your nickname and world.

10.2. We delete your account within one month. Your nickname is not given to anyone else afterwards. We keep only what is listed above as kept after deletion: purchase records, and security and moderation records.

11. Your rights

11.1. Under the GDPR you have the right to:

1. 11.1.1. access your personal data and receive a copy of it (Art. 15);
2. 11.1.2. have inaccurate data corrected (Art. 16);
3. 11.1.3. have your data erased (Art. 17);
4. 11.1.4. restrict processing (Art. 18);
5. 11.1.5. receive the data you gave us in a machine-readable format (Art. 20);
6. 11.1.6. object at any time to processing based on our legitimate interests (Art. 21);
7. 11.1.7. withdraw your consent at any time, without affecting earlier processing (Art. 7(3)).

11.2. To use these rights, write to support@streetracers2.com. We reply within one month, free of charge, and may ask you to confirm that the account is yours.

11.3. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where you believe the infringement took place.

12. Protection of children

12.1. Street Racers 2 is intended for players aged 16 and over. We do not knowingly process the data of children under 16. If you are a parent or guardian concerned about how your child's personal data is processed, contact us at support@streetracers2.com.

13. Automated checks

13.1. We use automated checks against cheating and abuse, such as limits on request rates or on new accounts using global chat.

13.2. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. If you think an automated check affected you wrongly, contact us and a person will review it.

14. Data protection methods

14.1. We protect your data with encrypted connections (HTTPS), password hashing with Argon2id, signed sign-in tokens, staff access limited to those who need it with an audit log of staff actions, and rate limits against abuse.

14.2. No system is perfectly secure; if a breach is likely to put your rights at high risk, we will inform you as the law requires.

15. Changes to this policy

15.1. We may update this policy when the game or the law changes. The date at the top shows when it was last updated. If a change affects something you consented to, we will ask for your consent again.