Privacy Policy

01Scope of This Policy

This Privacy Policy explains how personal data is handled when you visit the ReactionRacing website, create an account, use the game or app, use the shop, connect a wallet, previously joined a whitelist or waitlist, contact support, participate in a promotion or competition, or otherwise interact with ReactionRacing services.

The controller responsible for the processing described in this Privacy Policy is:

ReactionRacing is a brand operated by CC Technologies GmbH. Third-party wallets, public blockchains, app stores, payment services, and other independent services may process information under their own terms and privacy notices when you choose to use them.

02What Data We Collect

Website and technical information

• IP address and basic request information received by our servers;
• browser or app version, device type, operating system, language, requested pages, timestamps, errors, security events, and performance diagnostics;
• optional website-usage and campaign-attribution information where you allow analytics, including page views, selected interactions, referrer information, and UTM parameters;
• optional X Ads conversion-measurement information where you allow advertising measurement, including the current page and referring page, timestamps, IP address, browser or device information, X click identifiers such as twclid, and pixel or conversion-event identifiers;
• mobile install and campaign-attribution information processed through Kochava for X campaigns, including app and SDK identifiers, app version, device and operating-system information, install and session timestamps, IP address, store referrer or campaign information, a pseudonymous install identifier, and Apple SKAdNetwork attribution data where available;
• Google campaign-measurement information processed through Google Analytics or Google Analytics for Firebase where enabled, which may include campaign and referrer parameters, app or browser events, app-instance or similar pseudonymous identifiers, device and app information, timestamps, and coarse location inferred from IP address;
• cookies, localStorage, and privacy-preference information described in Section 7.

Account and profile information

• Racing Name or display name;
• first and last name where you provide it or where it is needed for account, consent, transaction, or compliance purposes;
• email address, securely protected login credentials, verification status, account preferences, and session information;
• country, age, eligibility declarations, and parent or guardian contact or consent records where a permitted minor-access flow requires them.

Gameplay, leaderboard, and economy information

• reaction times, race entries, results, standings, ranks, achievements, progression, and anti-cheat or anti-abuse signals;
• vehicle or garage state, upgrades, performance points, Cup or season participation, and reward history;
• FREE, VESTED, and staking-related RRX balance states displayed in supported interfaces;
• referral, promotion, onboarding, historical whitelist, and reward-eligibility records.

Wallet, transaction, shop, and payment information

• public wallet addresses and wallet-connection status where you choose to connect a compatible wallet;
• transaction hashes, timestamps, settlement status, and related technical or support records for tokenized gameplay actions;
• shopping-cart contents, order details, payment status, and billing or delivery information where required;
• information received from app stores or payment providers that is needed to confirm, administer, refund, or support a transaction. We do not normally receive or store full payment-card details where a payment provider handles them.

Communications and support

• emails submitted to an app-availability waitlist, support tickets, legal complaints, survey responses, feedback, fraud reports, and other messages you send us;
• marketing-consent and unsubscribe records;
• information reasonably needed to verify identity, age, consent, eligibility, ownership, or legal compliance where required.

03How We Use Personal Data

We use personal data only for defined operational, security, product, and legal purposes, including to:

• create and manage accounts, authenticate logins, maintain sessions, and verify email or eligibility status;
• deliver gameplay, calculate results, update ranks and leaderboards, maintain vehicle state, and settle in-game rewards or balance changes;
• operate the shop, process or support transactions, and provide requested account or customer service;
• support wallet-linked features and transaction troubleshooting where those features are available;
• detect, investigate, and prevent fraud, abuse, cheating, account compromise, security incidents, and violations of our terms;
• send necessary service messages such as verification emails, password resets, security notices, transaction or competition confirmations, policy updates, and support replies;
• administer promotions, referral programs, onboarding campaigns, competitions, and reward eligibility;
• with your permission, measure website use, campaign attribution, and service performance through our self-hosted, cookieless Umami analytics so we can improve the Platform and monitor reliability;
• with your separate permission, use the X Ads pixel to attribute visits or conversions to advertising campaigns, measure campaign performance, and optimize ReactionRacing advertising;
• use Kochava's mobile Measurement SDK to attribute app installs to X campaigns, measure campaign performance, prevent attribution fraud, and send configured install postbacks to X;
• use Google Analytics or Google Analytics for Firebase, where enabled, to attribute visits, installs, and conversions to Google campaigns and measure campaign performance;
• send the one-time iPhone availability notice you request by submitting your email address in the App Store availability form;
• send optional news and promotional emails where you have consented or another lawful basis clearly applies;
• comply with law, keep required records, resolve disputes, enforce rights, and protect users, CC Technologies GmbH, and third parties.

We do not use our self-hosted Umami analytics to build advertising profiles or serve targeted advertising. X Ads website conversion measurement is a separate optional purpose and is not enabled by the analytics choice. Mobile install attribution is described separately in Section 7 and does not use the website privacy-choice storage. Marketing consent is voluntary and is not required to create an account or access ordinary ReactionRacing features.

04Why We Process Data

Depending on the purpose, we rely on one or more of the following legal bases:

• Contract and requested pre-contract steps. Processing needed to create and operate your account, provide gameplay and shop functions, administer requested competitions or transactions, provide support, and deliver the services you request.
• Consent. Optional self-hosted analytics, Google Analytics website campaign measurement, optional UTM or referrer attribution, optional X Ads website conversion measurement, optional marketing emails, the requested iPhone availability notice, and other processing for which we specifically ask permission. You may withdraw consent at any time for future processing.
• Legitimate interests. Protecting accounts and systems, preventing fraud and cheating, maintaining service availability, diagnosing essential technical problems, defending legal claims, improving the security and core performance of ReactionRacing, and measuring privacy-preserving mobile campaign performance without advertising IDs. We consider the impact on users before relying on this basis and seek consent first where applicable law requires it.
• Legal obligations. Processing required for accounting, tax, consumer-protection, regulatory, sanctions, law-enforcement, court, or other binding legal requirements.

Where providing particular information is necessary to enter into or perform a contract, failing to provide it may mean that the relevant account, transaction, competition, or feature cannot be provided.

05Who We Share Data With

We disclose personal data only where reasonably necessary to operate ReactionRacing, complete a requested transaction or blockchain interaction, protect the Platform, obtain professional advice, or meet a legal obligation. Recipients may include:

• Infrastructure, hosting, storage, security, and content-delivery providers used to operate and protect the Platform;
• authentication, email, and customer-support providers used to manage accounts and communications;
• app stores, payment processors, and transaction providers used when you download an app, make a purchase, or request a payment-related service;
• Kochava Inc. for privacy-preserving mobile install measurement and attribution for X advertising campaigns;
• Google LLC and its service providers where Google Analytics or Google Analytics for Firebase is enabled to measure Google campaign visits, installs, and conversions;
• X Corp. and its service providers when you explicitly allow X Ads website conversion measurement or when Kochava sends a configured mobile-install postback, so visits, installs, and conversions can be attributed and measured;
• blockchain and wallet infrastructure such as supported wallets, public networks, RPC providers, indexers, relayers, or similar technical operators needed for a requested tokenized interaction;
• professional advisers, auditors, insurers, courts, regulators, and law-enforcement authorities where access or disclosure is necessary or legally required;
• corporate transaction participants if CC Technologies GmbH is involved in a merger, financing, reorganisation, acquisition, or transfer of assets, subject to appropriate confidentiality and data-protection safeguards.

Our Umami website analytics is self-hosted and remains separate from Google Analytics, Kochava, and the optional X Ads pixel. Service providers acting on our behalf may process personal data only for agreed purposes and under appropriate contractual, confidentiality, and security obligations.

We do not sell, rent, or trade your personal data. Kochava, Google, and X process information they receive under their applicable agreements, terms, and privacy notices.

06Wallet, Blockchain, and Public Data Considerations

If you connect a wallet or use tokenized gameplay features, some information may become public, persistent, or inferable from blockchain activity.

• Public records. Public wallet addresses, transaction hashes, timestamps, token movements, smart-contract events, and other on-chain data may be visible to anyone using blockchain explorers or analytics tools.
• Irreversibility. Once a valid transaction is recorded on-chain, ReactionRacing may not be able to reverse, delete, or conceal it.
• Self-custody. When you use a compatible self-custody wallet, private keys and signing control remain with you. ReactionRacing will never ask for your private key or wallet seed phrase.
• Public leaderboards. Your Racing Name, rank, results, and certain performance metrics may be visible to other players and visitors where leaderboards, race results, or standings are public.

Do not place private or sensitive information in public blockchain transaction fields. Closing a ReactionRacing account does not erase public blockchain history and may not fully remove gameplay records that were lawfully published, aggregated, or retained for integrity and dispute purposes.

07Cookies, Local Storage, Analytics, and Campaign Measurement

ReactionRacing uses a limited amount of first-party browser storage. No third-party advertising pixel loads by default. The optional X Ads pixel loads only after you explicitly allow advertising measurement and may use cookies or similar identifiers under X's policies. A normal unauthenticated page visit without optional consent creates no ReactionRacing cookie.

Strictly necessary website authentication cookie

• Name:__Host-rr_web_session
• Created: only after you register or sign in on the website, or when a still-valid website session is securely renewed;
• Purpose: authenticates the account feature you requested without exposing the login token to website JavaScript;
• Expiry: 24 hours after issue or renewal, and it is removed when you sign out;
• Settings:Secure, HttpOnly, SameSite=Lax, host-only, and path /.

This cookie is strictly necessary only when you request account sign-in. It is independent of your optional analytics choice, so changing or renewing an authenticated session does not show the privacy banner again.

LocalStorage and similar browser storage

• Privacy choice: remembers whether you allowed or refused optional analytics, attribution, and X Ads conversion measurement so the website can respect your decision.
• Shopping cart: remembers products you add to the cart until checkout, removal, expiry, or clearing of browser data.
• Daily reaction-time result: remembers the result generated after you use the homepage demo and automatically removes it after no more than 24 hours. ReactionRacing no longer creates a reaction-time cookie.
• Campaign UTM and referrer attribution: may be stored only after you allow optional analytics so we can understand how visitors reached ReactionRacing or a registration campaign.
• Umami opt-out: the umami.disabled value may be read or stored to ensure analytics remains disabled where you have opted out.

Self-hosted Umami analytics

With your permission, we use our own self-hosted Umami installation to measure website use, selected interactions, referral sources, and service reliability. Umami is configured without analytics cookies and is used only to produce our own website and product insights. We do not use it for advertising, cross-site tracking, or advertising profiles, and we do not sell the resulting data.

Optional Umami analytics and optional UTM or referrer attribution must remain disabled unless and until you enable Cookieless analytics or select Allow all optional. Selecting Essential only leaves those optional functions disabled and does not prevent you from using the normal website or core account features.

Google Analytics for Google campaigns

Where enabled for a Google campaign, ReactionRacing uses Google Analytics on the website and/or Google Analytics for Firebase in a supported mobile app to attribute visits, installs, and conversions to that campaign and measure campaign performance. Google may process campaign and referrer parameters, event and conversion information, app-instance or similar pseudonymous identifiers, device and app information, timestamps, and IP-derived coarse location.

Google Analytics website tags remain disabled until you allow optional analytics. Our current mobile configuration removes access to Google's Advertising ID; it does not use that identifier for campaign measurement. You can review Google's Privacy Policy.

Kochava mobile install attribution for X campaigns

The ReactionRacing iOS and Android apps use the Kochava Measurement SDK to determine whether an app install resulted from an X advertising campaign, measure campaign performance, prevent attribution fraud, and send the configured install result to X. Kochava may process app and SDK identifiers, app version, device and operating-system information, install and session timestamps, IP address, store referrer or campaign data, a pseudonymous install identifier, and Apple SKAdNetwork data where available.

The current integration deliberately excludes Kochava's optional cross-site tracking modules and does not request or access Apple's IDFA or Google's Advertising ID. Kochava mobile measurement runs in the native app and is therefore separate from the website's Privacy Choices. You may object to processing based on legitimate interests by contacting us. You can review Kochava's Privacy Policy.

X Ads conversion measurement

If you explicitly enable X Ads conversion measurement, the website loads X's Universal Website Tag from static.ads-twitter.com and configures ReactionRacing pixel re4by. The pixel may send the current page and referrer, timestamp, IP address, browser or device information, X click identifiers such as twclid, and pixel or conversion-event identifiers to X. X may use cookies or similar technologies for conversion attribution, campaign measurement, fraud prevention, and advertising optimization under its own policies.

The X pixel remains unloaded when you select Essential only or leave the advertising measurement toggle off. Withdrawing this consent stops future X pixel loads and events from ReactionRacing; it does not undo processing already completed by X. You can review X's Privacy Policy and X's Cookie Policy.

You can allow, refuse, or later withdraw optional analytics or advertising measurement through Privacy Choices in the website footer. Withdrawing consent stops future optional analytics, attribution, or X pixel events from ReactionRacing. Browser storage needed for features you actively request, such as sign-in, the cart, privacy choices, or the reaction-time demo, may remain active. You can also clear website data through your browser settings.

08How Long We Keep Data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including operating the Platform, maintaining account and transaction integrity, preventing fraud, resolving disputes, complying with law, and protecting ReactionRacing and its users.

• Server and security logs: normally up to 30 days, unless a longer period is needed to investigate an incident, prevent abuse, or establish, exercise, or defend legal claims.
• Self-hosted analytics: up to 12 months after collection, enforced by an automated daily deletion process.
• Google campaign measurement: retained under our configured Google Analytics or Firebase retention settings and Google's applicable policies; campaign-level reports may be kept in aggregated form.
• Kochava mobile attribution: retained for the campaign-measurement and fraud-prevention period configured with Kochava and under its applicable policies; campaign-level reports may be kept in aggregated form.
• X Ads measurement data: retained by X under its applicable retention rules and privacy policies; ReactionRacing retains the local record of your advertising-measurement choice until you change it or clear website data.
• UTM and referrer attribution: up to 90 days or until the relevant registration attribution is completed, whichever occurs first.
• Shopping-cart storage: until checkout, removal, browser-data deletion, or 30 days of inactivity.
• Website authentication cookie: until logout or for up to 24 hours after sign-in or the latest successful session renewal.
• Daily reaction-time stored result: up to 24 hours; no reaction-time cookie is created.
• Account and gameplay records: while the account is active and afterwards for as long as needed for account closure, fraud prevention, dispute resolution, game integrity, and applicable limitation periods.
• Support and complaint records: normally up to three years after the matter is resolved, unless a longer period is required for a legal obligation or claim.
• iPhone availability waitlist: until the requested availability notice is sent, then normally deleted within 30 days unless you ask us to delete it sooner or separately consent to marketing.
• Marketing records: until you withdraw consent or unsubscribe, with a limited suppression or proof record retained where necessary to respect your choice and demonstrate compliance.
• Accounting, payment, transaction, and compliance records: for the retention periods required by applicable law.
• Public blockchain records: potentially indefinitely and outside ReactionRacing's direct control.

When personal data is no longer needed, we delete it, anonymise it, or restrict it from routine use, unless continued retention is required or permitted by law.

09Your Choices and Rights

Subject to applicable law, you may have the following rights in relation to your personal data:

• Information and access. Ask whether we process your personal data and receive access to it and related information.
• Correction. Ask us to correct inaccurate or incomplete personal data.
• Deletion. Ask us to delete personal data where the legal requirements are met.
• Restriction. Ask us to limit processing in certain circumstances.
• Data portability. Receive certain personal data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
• Objection. Object to processing based on legitimate interests, including any direct marketing based on that ground.
• Withdraw consent. Withdraw consent at any time for future processing without affecting the lawfulness of processing completed before withdrawal.
• Marketing and campaign choices. Disable optional website analytics and X Ads conversion measurement through Privacy Choices, unsubscribe from optional marketing emails, ask us to remove your app-availability email, or object to mobile campaign measurement based on legitimate interests by contacting us.
• Complaint rights. Lodge a complaint with a competent data-protection supervisory authority.

To make a privacy request or complaint, contact legal@reactionracing.pro. We may ask for information reasonably necessary to verify your identity and the scope of your request. Some data, including valid public blockchain records and information we must retain for security, transaction integrity, legal obligations, or claims, may not be fully erasable.

You may also contact the supervisory authority responsible for our establishment: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Postfach 3163, 65021 Wiesbaden, Germany. You may instead contact another competent authority, particularly in the EU or EEA country where you live or work or where an alleged infringement occurred.

10Children and Minor Users

ReactionRacing is not intended for children under 13, and children under 13 may not create an account or use the Platform.

Users aged 13 to 17 may access only specifically designated non-token practice or gameplay features where permitted by local law and by ReactionRacing's onboarding flow, with any required parent or guardian involvement or consent.

Users under 18 may not receive or claim RRX, connect a blockchain wallet, stake or unstake RRX, transfer or withdraw RRX, trade RRX, enter an RRX-entry competition, receive token-based referral or promotional rewards, transfer tokenized vehicles, or use other token-enabled financial or governance features.

Where a permitted minor-access flow exists, ReactionRacing may request limited parent or guardian contact, consent, and eligibility records. We seek to avoid writing minor-user information to a public blockchain.

If we learn that personal data was collected from a child in a way that was not permitted, we will take reasonable steps to deactivate the relevant access and delete the data where legally and technically possible, subject to constraints such as valid public blockchain records.

11International Transfers

Some providers, including Kochava, Google, X, public blockchains, app stores, wallets, or other services may process personal data outside Germany or the European Economic Area. Where personal data is transferred to a country without an applicable European Commission adequacy decision, we seek to use legally recognised safeguards such as approved standard contractual clauses, together with supplementary technical or organisational measures where appropriate, or another lawful transfer mechanism.

You may request further information about relevant transfer safeguards by contacting legal@reactionracing.pro.

12Changes to This Policy

We may update this Privacy Policy to reflect changes in ReactionRacing, our data processing, technical architecture, providers, legal requirements, or operational practices.

We will update the effective date, last-updated date, and version shown above. Where a change materially affects users or requires renewed consent, we will provide additional notice through the website, app, account interface, or email as appropriate.

13Contact