Player privacy

Account information

Registration stores the username, first name, last name, phone number, email address and a securely hashed password needed to operate the player account. Public leaderboards display the username, chosen runner and gameplay performance only.

Game integrity information

For anti-cheat and abuse prevention, the game stores run timing, action history, score data and keyed one-way hashes derived from network/device signals. The game database does not need to store raw IP addresses for this purpose.

Challenges & referrals

Tracked challenge links can store a random challenge code, the creating account, score, click count and registration count. Referral codes can associate a new account with the inviting account. These metrics do not alter ranked scores.

First-party activity analytics

When enabled, the site records page views, game starts, completed and verified runs, registrations, share flows and challenge opens, starts, completions and wins. Random browser identifiers and account identifiers support aggregate funnel and exact-day return reports. Clearing cookies or signing in can change the identifier. Analytics are stored on this game server.

Password recovery

If password-reset email is enabled, temporary hashed reset tokens with expiration times are stored. The original reset token is sent to the account email and is not stored in plain text in the database.

Administration

Authorized administrators can view account contact information for support, account moderation, winner verification and abuse investigation. Access should be limited to trusted administrators and protected with strong cPanel, database and admin credentials.

Advertising & third parties

If advertising, analytics, email or payment services are enabled, update this privacy notice to identify those services and their data practices before public launch.

Retention

Set a retention policy appropriate for account support, security, prize disputes and legal obligations. Players should be given a support path for account/privacy requests before launch.