Privacy policy

01 · Who we are and what this policy covers

ReactionRacing is operated by CC Technologies GmbH, Eschersheimer Landstrasse 42, 60322 Frankfurt am Main, Germany. CC Technologies GmbH is the controller for the personal data described in this policy unless a third party is identified as acting independently.

This policy covers the ReactionRacing website, iOS and Android apps, player accounts, races and competitions, the Reaction Index, the shop, partner-facing website features, support, marketing and campaign measurement, and related ReactionRacing services.

For privacy requests, contact privacy@reactionracing.pro. For ordinary account or gameplay support, contact support@reactionracing.pro.

02 · Data we collect

Website and technical data. Our servers may receive your IP address, requested page, date and time, browser or app version, device type, operating system, language, referrer, error information, security events and similar technical information needed to deliver and protect the service.

Account and profile data. This can include your email address, Racing Name or display name, password or authentication data in protected form, country or region, age or eligibility information, account preferences and session information.

Gameplay and performance data. We process the events needed to run the game and calculate results, including race entries, reaction and response times, taps and target outcomes, attack and defend gestures, timing and accuracy events, race results, standings, ranks, progression, car and garage state, boosters and turbos, competition participation, anti-cheat signals and the performance events used to calculate and improve the Reaction Index.

The Reaction Index is an in-game performance measure. Ordinary gameplay data is not treated by us as a medical diagnosis or clinical assessment, and we do not intentionally collect health records through normal gameplay.

Shop and purchase data. For merchandise orders we may process your name, email address, shipping and billing details, country, order contents, delivery status and payment status. Stripe processes website merchandise payments; Printful may receive the information needed to produce and ship merchandise; SendPulse may be used to send transactional order and shipment emails. We do not normally receive full payment-card details from Stripe. In-app purchases may be processed by Apple, Google or another supported app-store provider under its own terms and privacy notice.

Communications and research. We process information you send in support requests, complaints, feedback, partnership enquiries or other messages. If you separately volunteer for an independent research study, the study will explain any additional data, purposes, recipients and consent before participation.

03 · How we use personal data

• create and manage accounts, authentication and player profiles;
• run qualifying, races, battles, championships, tournaments, rankings and leaderboards;
• calculate and display progression, Race Credits, Gears, purchases, garage state and the Reaction Index;
• detect cheating, fraud, account compromise, abuse, technical manipulation and security incidents;
• provide support, service messages, purchase confirmations and other requested communications;
• operate the website, shop and merchandise fulfilment;
• measure reliability, performance and how players and visitors use our services so we can improve them;
• attribute installs, registrations and selected conversion events to our own advertising campaigns, measure campaign performance and optimize how we acquire and re-engage players;
• select, display and measure sponsor branding, sponsored liveries, branded events and other partner content, including by country or region and, where appropriate, by gameplay context, rank, progression or performance segment;
• prepare aggregated or campaign-level reports for sponsors about delivery and engagement, such as impressions, reach, country or region, competition context and broad rank or performance segments, without giving sponsors direct access to individual player profiles;
• operate optional sponsor or partner programmes, promotions, competitions or features in which you can choose whether to share specified account, contact, demographic, gameplay or performance information with an identified sponsor or partner for a stated purpose;
• send marketing where you have opted in or another lawful basis applies; and
• comply with legal, accounting, tax, consumer-protection, sanctions and regulatory obligations and establish or defend legal claims.

04 · Legal bases

Where the GDPR or similar law applies, we rely on the legal basis appropriate to the purpose. This can include performance of our contract with you for account, gameplay, competition and purchase functions; our legitimate interests in security, fraud prevention, service reliability, product improvement, operating and measuring our sponsorship programme, contextual sponsor selection and appropriately configured campaign measurement; your consent for optional analytics, advertising measurement, marketing, research, device tracking, personalized sponsor selection, or sharing specified personal data with an identified sponsor or partner where consent is required; and legal obligations that apply to us.

Consent is voluntary and can be withdrawn for future processing. Refusing optional analytics, advertising measurement, sponsor personalization or participation in an optional data-sharing partner programme does not prevent you from using the normal website or playing the game, unless the programme itself is an optional feature whose operation requires that data sharing. In that case, you can simply choose not to participate. We may still show general or contextual sponsor branding where lawful.

05 · Website analytics and advertising measurement

Self-hosted Umami. With your permission, the website loads our self-hosted, cookieless Umami analytics at analytics.reactionracing.pro. We use it to understand page use, selected interactions and website reliability. It is not used to build third-party advertising profiles or to show ads to you.

X Ads conversion measurement. With your separate permission, the website can load the X Ads pixel to measure visits and conversions from ReactionRacing advertising, attribute campaigns and help us optimize our own ads. The pixel can send page and referrer information, timestamps, browser or device information, IP address and campaign or click identifiers to X under X's own privacy terms.

You can allow, refuse or later change these optional website choices through Privacy settings in the footer. Optional website tags stay unloaded until the relevant choice is enabled.

06 · Mobile analytics, install attribution and campaign optimization

We need to understand which campaigns lead to useful installs and active players. Depending on the campaign, app version and platform, we may use measurement services such as Kochava and Google Analytics for Firebase together with privacy-preserving platform attribution such as Apple AdAttributionKit or SKAdNetwork and Google Play install-referrer mechanisms. Selected advertising platforms, currently including X or Google where a campaign is active, may receive configured conversion results.

Campaign measurement may use app and SDK identifiers, app version, device and operating-system information, install and session timestamps, IP-derived approximate location, store or campaign information, pseudonymous install or app-instance identifiers, and selected conversion events such as install, first open, registration, tutorial completion, race participation or purchase. We do not need to send raw Reaction Index scores or detailed reaction-time telemetry to advertising platforms for ordinary campaign optimization.

If we use an advertising identifier or another form of tracking that requires platform or legal permission, we request that permission first and respect the choice. On Apple platforms, tracking that falls within Apple's App Tracking Transparency rules requires ATT authorization before IDFA access or cross-company tracking. On Android, we respect the availability and settings of the Google advertising ID and applicable Google Play rules. We do not use fingerprinting to bypass platform privacy controls.

If we introduce a materially different advertising or measurement provider, we will update this policy and, where required, the relevant consent or opt-out controls before enabling that processing.

07 · Sponsorships, branded content and optional partner data sharing

ReactionRacing operates a commercial sponsorship programme. The website and game may display paid sponsor names, logos, branded liveries, trackside or interface branding, “presented by” placements, sponsored competitions, prizes, offers or other partner content. These placements help fund and promote ReactionRacing and should not be understood as a promise that the service contains no commercial third-party content.

Our default is not to sell or hand over your individual player data to sponsors. We do not operate as a data broker and do not sell or rent player databases to sponsors or partners for their independent use merely for the sake of monetising personal data. Buying a sponsorship does not give a sponsor access to your account, email address, raw Reaction Index score, detailed reaction-time telemetry or individual gameplay profile.

Sponsor content may be selected or rotated using information already available in the service, for example your country or region, language, platform, competition or event, rank, progression, selected car or livery, Reaction Index or other performance band, and similar gameplay context. We may use this information internally to make sponsorships relevant, manage campaign delivery and avoid repeatedly showing unsuitable placements. Where applicable law requires consent for a particular form of personalized sponsor selection, we will request that consent or use a less personalized or contextual placement instead.

We may provide sponsors with aggregated or campaign-level reporting such as impressions, reach, engagement, country or region, competition context, rank ranges or broad performance segments. Those reports are intended to describe campaign performance rather than identify individual players.

Optional sponsor and partner programmes. From time to time we may offer a programme, promotion, competition, research or product feature in which you can choose to share specified personal data with an identified sponsor or partner. Depending on the programme, this could include information such as your name or Racing Name, email address, country or region, age or eligibility information, competition results, selected gameplay information, Reaction Index information or other performance information. Before any such disclosure, we will explain the sponsor or partner, the categories of information to be shared, the purpose of the sharing and any additional terms or privacy information that applies. We will ask you to make an affirmative choice to join that programme before we disclose your individual personal data to the sponsor or partner for its independent use, and we will obtain any additional consent or authorization required by law.

Participation in these programmes is optional. You can choose which sponsor or partner programmes you want to join. If you do not choose to participate, we will not disclose your individual personal data to that sponsor or partner for its independent use through that programme. Declining a partner programme does not prevent ordinary use of ReactionRacing, although you may not receive the optional partner benefit, prize, offer or feature connected with that programme.

Where you authorize a disclosure to a sponsor or partner that will use the information for its own purposes, that recipient may act as an independent controller and its own privacy notice may apply after the transfer. Withdrawing your ReactionRacing consent stops future disclosures based on that consent, but information already lawfully provided to an independent recipient may also need to be handled through that recipient's privacy rights process.

ReactionRacing is not operated as a third-party behavioural advertising network. We do not allow sponsors to place their own tracking code inside the game merely to build independent advertising profiles of players. If you choose to follow a sponsor link or interact with an external sponsor service, that third party may process data under its own privacy notice.

Some privacy laws use broad terms such as “sale”, “sharing” or “targeted advertising” for certain disclosures or personalized advertising activities even when no money is paid for the data. Where those laws apply to us and a particular measurement, sponsorship, partner programme or advertising activity falls within those definitions, we will provide the consent, notice or opt-out mechanism required by that law.

08 · Browser storage and similar technologies

The website uses limited first-party browser storage for functions you request, such as remembering your privacy choice and merchandise cart. Optional analytics and advertising measurement are separate from essential storage.

Under German law, non-essential storage or access to information on your device generally requires informed consent unless an exception applies. Our current website therefore keeps optional Umami analytics and the X Ads pixel off until you choose to enable them.

09 · Who receives data

We disclose personal data only where reasonably needed for the purposes above. Recipients can include hosting, database, security, email and support providers; Apple and Google app stores; Stripe for website payments; Printful for merchandise fulfilment; SendPulse for transactional shop email; Kochava, Google/Firebase and advertising platforms where campaign measurement is enabled; an identified sponsor or partner where you choose to participate in an optional programme, promotion, competition, prize, research activity or feature involving that disclosure and you have been appropriately informed; professional advisers; and public authorities where disclosure is legally required. Ordinary sponsorship reporting is intended to be aggregated or campaign-level rather than a transfer of individual player profiles.

Service providers processing data on our behalf are expected to use it only for the agreed service and to protect it appropriately. Some providers, app stores and advertising platforms also act as independent controllers for parts of their processing under their own privacy notices.

10 · Retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including game integrity, account operation, support, fraud prevention, dispute resolution and legal obligations.

• security and operational logs are normally kept for a limited period unless an incident requires longer retention;
• self-hosted website analytics is normally retained for up to 12 months;
• advertising and attribution providers retain data under our configured settings and their applicable terms, after which campaign-level reports may remain in aggregated form;
• account, gameplay, ranking and economy records may be retained while your account is active and afterwards where needed for historical results, anti-cheat integrity, disputes or legal claims;
• shop, payment, tax and accounting records are retained for the periods required by law;
• marketing records are kept until you unsubscribe or withdraw consent, subject to a limited suppression record where needed to respect that choice; and
• research data follows the retention information given for the specific study.

When data is no longer needed, we delete it, anonymize it or restrict it from routine use unless continued retention is legally required or permitted.

11 · International transfers

ReactionRacing is operated from Germany, but some providers may process data in other countries. Where European data-protection law requires safeguards for a transfer outside the EEA, we use an applicable adequacy decision, approved contractual safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism as appropriate.

12 · Your rights and choices

Depending on where you live, you may have rights to request access to your personal data, correction, deletion, restriction, portability, or information about how it is used; object to processing based on legitimate interests; withdraw consent; and complain to a competent privacy regulator. Some rights have legal exceptions, for example where records must be kept for fraud prevention, accounting or legal claims.

In the EU or EEA, you may complain to your local supervisory authority. The supervisory authority responsible for our establishment is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI).

To exercise a privacy right, email privacy@reactionracing.pro. We may request reasonable information to verify your identity and the scope of the request.

13 · Children and younger players

ReactionRacing is not intended for children under 13, and children under 13 may not create an account or use the service. Players aged 13 to 17 may use ReactionRacing only where local law permits and with any parent or guardian authorization that local law, the app store or a specific feature requires.

Where consent is the legal basis for optional processing involving a younger player, the age at which the player can give that consent personally varies by country. We seek parent or guardian authorization where required. Optional sponsor or partner programmes that involve disclosure of a minor's individual personal data may require parent or guardian authorization or may be limited to adults, depending on the programme and applicable law. We do not knowingly use optional advertising measurement to build advertising profiles of users we know are children. Where applicable law prohibits profile-based advertising or sponsor selection for a user we know with reasonable certainty is a minor, we use non-profiled or contextual sponsor placements instead.

If we learn that we collected personal data from a child in a way that was not permitted, we will take reasonable steps to remove or restrict it. Parents or guardians can contact privacy@reactionracing.pro.

14 · Automated scoring and the Reaction Index

Race results, rankings, progression and the Reaction Index are calculated automatically from gameplay data and game rules. These calculations affect in-game competition and progression; they are not used by ReactionRacing to make decisions that produce legal or similarly significant effects about you outside the game.

15 · Security

We use technical and organizational measures designed to protect personal data, including access controls, encrypted transport, limited administrative access, logging and security monitoring. No online system can be guaranteed completely secure, so you should also protect your account credentials and devices.

16 · Changes to this policy

We may update this policy when the game, website, shop, campaign tools, service providers or legal requirements change. We will update the date above and provide additional notice where a material change or renewed consent is required.

17 · Contact

CC Technologies GmbH
Eschersheimer Landstrasse 42
60322 Frankfurt am Main
Germany

Privacy: privacy@reactionracing.pro
Support: support@reactionracing.pro