Privacy policy

Who is responsible

Alexandros Lekkas is the controller of personal data processed by Athens Racing at athensracing.com and staging.athensracing.com. Contact aflekkas@gmail.com about this policy or your data.

Sign-in and your account

Google is our only sign-in provider. We request the openid profile scopes to authenticate you. We store Google’s unique account identifier (sub) and the provider name, linked to an internal account ID. We do not request the email scope or store your Google email, name or profile photo. Google profile information is received during authentication; only the identifier is saved. Google access and ID tokens are used during sign-in and are not persisted.

We store the display name and vehicle plate you choose, your account creation date, saved game settings and progress, friend requests, accepted friendships, blocks, and lobby invitations (sender, recipient, lobby code and expiry). Other players can find your chosen display name; your name, plate, car and race state can be visible in multiplayer. Accepted friends can see whether you are in the menu or in a race, the selected map and a verified hosted lobby. Presence becomes offline after disconnecting or about 65 seconds without a heartbeat.

Progress and race times

Your browser saves settings, controls, graphics preferences, car and paint choices, personal bests, event progress, replays and a generated driver identifier in localStorage and other browser storage. Game assets are cached for loading and offline use. These remain on your device until you clear site data, subject to your browser’s storage limits.

On first account sign-in, an allowlist of local settings and progress is copied to your account, including personal bests, event records, car choices and controls. The current implementation imports this once; it does not continuously back up every later change or upload local replay files.

Completed races can submit leaderboard records: a driver identifier, chosen driver name, car, map, event, time, traffic setting, route, game version, solo/online source and submission time. Leaderboards publicly show race results and the chosen name, but omit the internal driver identifier. Leaderboard records are stored separately from accounts.

Cookies, connections and security

We use necessary HttpOnly, Secure, SameSite=Lax cookies: ar_session keeps you signed in for up to 30 days, and ar_oauth binds a sign-in attempt to your browser for up to 10 minutes. JavaScript cannot read these cookies. Server session tokens are stored as hashes. Signing out invalidates your current session.

The game itself sets no advertising or analytics cookies and includes no analytics tracker. If you choose to load a YouTube player in music settings, your browser connects to Google/YouTube, which may process device and connection data and use its own cookies under Google’s privacy policy. Google sign-in also takes place under Google’s own policies.

IP addresses are used for abuse prevention, rate limiting and connection limits. OAuth rate limits use a hash of your IP with a 10-minute expiry. Leaderboard rate limiting temporarily stores the IP in Durable Object storage with a one-minute window; old entries are removed on later submissions. Multiplayer connections and reconnect state can also retain an IP while the session is active or reconnectable. These are operational records, not advertising profiles.

Hosting and service providers

Cloudflare hosts the website and backend using Workers, D1 for accounts, and Durable Objects for presence, multiplayer state and leaderboards. Google provides identity authentication and optional YouTube playback. These services necessarily receive connection information such as your IP address. We do not sell personal data.

Cloudflare and Google operate internationally, so their processing may occur outside your country, including outside the EEA. See Cloudflare’s privacy policy and Google’s privacy policy for their processing and transfer information. Contact us for information about safeguards applicable to your data.

Why we process data

Under the GDPR, processing needed to provide your requested account, saved progress, social and racing features is based on performance of our agreement with you (Article 6(1)(b)). Security checks, connection limits and abuse prevention rely on our legitimate interest in keeping the service safe and available (Article 6(1)(f)). Optional YouTube playback starts at your request; Google describes its own legal bases. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Retention, export and deletion

Account profiles, imported progress and social records remain until you delete your account; there is no automatic inactivity deletion. Sessions expire after 30 days, sign-in challenges after 10 minutes and invitations after 2 minutes. Expired account sessions, challenges, rate-limit records and invitations are removed by a daily cleanup job. Short rate-limit windows do not guarantee immediate physical deletion. Multiplayer state is saved for active games and reconnects; disconnected sessions normally expire after about 90 seconds. Presence is short-lived connection state, not a permanent activity history.

Leaderboard records have no fixed time-based expiry. Cloudflare boards retain up to the fastest 200 drivers per board, with a faster result replacing a slower result for that driver. Account deletion does not automatically remove these separate records or clear browser storage.

In the game, open Account from your driver/profile control and choose Export my data to download a JSON file of your account profile, saved progress, provider identifier, friendships (including requests and blocks) and invitations. Choose Delete account, type DELETE and confirm to remove your account, sign-in identities, sessions, friendships and invitations. Clear site data in your browser to remove local progress and cached settings. For a leaderboard export or removal, or if you cannot sign in, email aflekkas@gmail.com with enough information to locate your record. We may need to verify ownership.

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability and object to processing based on legitimate interests. You may also withdraw consent where applicable and complain to your data protection authority, including the Hellenic Data Protection Authority. Email aflekkas@gmail.com to exercise your rights. We aim to respond within one month, with any lawful extension explained. See the EU’s guide to data protection rights.

Minimum age and changes

You must be at least 13 to use Athens Racing, or at least 16 where national law requires that age. We do not knowingly offer accounts to children below the applicable minimum. Contact us if you believe a child below that age has supplied personal data so we can investigate and remove it.

We will update this page when our practices change and show the new effective date.