1 · Who is responsible — Powderline (the game at powderlinegame.com and this website) is operated by Roman Princ, ID No. (IČO) 21782571, registered office Hluboká 4591/10, Mšeno nad Nisou, 466 04 Jablonec nad Nisou, Czech Republic ("we"), who is the data controller within the meaning of Regulation (EU) 2016/679 (the "GDPR"). For any privacy matter, including exercising your rights under section 10, write to powderlinegame@gmail.com or to the postal address above. We are not required to appoint a data protection officer.
2 · The short version — the game is playable without an account. We collect only what the features you choose to use require. The pages of this website may show advertising served by Google AdSense (section 14) — never inside a run, and in the EEA only after you have made a choice in the consent dialog. We ourselves do not track you across other websites. Our website statistics run on our own server without cookies and without storing your IP address. We never sell personal data and never share it for marketing. You can erase your account and everything in it yourself, in one click. The sections below list every category of data we touch, why, and for how long.
3 · Playing without an account — game state and preferences (rider name, time of day, sound, graphics quality, your best run, a stashed invite code, the session of any account you sign in to, and a same-day flag so a returning visit is not counted twice) are stored only in your browser's localStorage and never leave your device unless a feature below sends them. We set no cookies. The only data an anonymous player sends us is a leaderboard post you explicitly choose to make: the rider name you typed, score, distance and a timestamp.
4 · Website statistics — the pages of this website (not the game itself) load a statistics script from analytics.princdev.com, which is our own self-hosted installation of the open-source Umami software on our own EU server — not a third-party service. It records the page viewed, the referring site, browser and operating-system type, device type, screen size, language and the country derived from your IP address. The IP address itself is not stored, no cookie is set, and visitors are counted by a salted hash that is rotated regularly, so a person cannot be recognised across longer periods or across other sites. Legal basis: our legitimate interest in knowing how the site is used (art. 6(1)(f)). You may object at any time (section 10); browsers with "Do Not Track" enabled are respected where the software supports it.
5 · Traffic counters in the game — the game counts page loads as aggregate numbers per calendar day: total loads, first-loads-of-the-day and signed-in loads, and a count per coarse category — device class (touch or desktop), the site that linked to the game and any games portal it is embedded in, interface language, graphics quality and screen orientation. These counters contain no IP address, no identifier and no per-visitor records of any kind — they cannot be linked to you, by us or anyone else. Whether you are a "first load of the day" is decided by a date flag in your own browser.
6 · With a rider account — to run the game and keep your progress (art. 6(1)(b) GDPR, performance of our contract with you) we store: your e-mail address; your password, if you chose one (stored only as a salted hash, never readable by us); rider name; coin balance; cosmetic loadout; best run; game settings (motion blur, sound, the radio, time of day, render quality); ride log (distance, score, coins, duration, top speed, timestamps); quest progress; wheel-spin and unlock history; your invite code and — if you joined through an invite link — which rider invited you; and the time and version of the Terms and this policy you accepted (art. 7(1) — proof of acceptance). If you sign in with Google, we receive from Google your e-mail address, your Google display name (used as your initial rider name, which you can change) and a Google account identifier; we never receive your Google password. The sign-in step itself is performed by Google under its own privacy policy, as an independent controller. If you buy a coin pack, we additionally store the purchase record: pack, amount, currency, time and the Stripe checkout session id (art. 6(1)(b), and art. 6(1)(c) for accounting duties). Your e-mail is never shown to other players and never used for marketing. Access to account data is limited to the operator, for running and moderating the game.
7 · Feedback and screenshots — if you send feedback from the game, we store its type, your message, up to three screenshots you choose to attach, the time, and the account it came from, so that we can investigate the report, reply where needed and pay the report reward (art. 6(1)(b) and (f)). Screenshots are stored in EU storage and are visible only to the operator. Please do not include other people's personal data in a report. Reports and their screenshots are deleted when the report is closed and no longer needed, and in any case when you delete your account.
8 · E-mails — we send only transactional e-mails that an account needs: address confirmation, password reset, sign-in links, e-mail-change confirmation and security codes. They are sent from info@powderlinegame.com through Resend, Inc. (USA), which acts as our processor under an art. 28 data-processing agreement and, for any processing outside the EU, the European Commission's standard contractual clauses. Resend receives your e-mail address and the message content and retains delivery logs for a limited period. We send no newsletters and no marketing e-mail.
9 · 1v1 races — races connect the two players directly, peer-to-peer (WebRTC), so, like any direct connection, your IP address is visible to your opponent. During matchmaking your IP and a random peer id pass through third-party connection services: the PeerJS cloud signaling server, Google STUN servers and — only if a direct connection cannot be established — PeerJS TURN relays (EU/US, so your IP may briefly transit outside the EU). We store none of this, and it happens only while you race (art. 6(1)(b): providing the race you requested).
10 · Your rights — under arts. 15–21 GDPR you may request access to your data, a copy for porting, correction, erasure, restriction of processing, or object to processing based on legitimate interests (including the statistics in section 4), and you may withdraw any consent at any time without affecting past processing. Write to powderlinegame@gmail.com from the account's e-mail address so that we can verify it is you; we respond within one month (art. 12(3)), extendable by two further months for complex requests, in which case we tell you. You may also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz) or with the supervisory authority of your own country.
11 · Infrastructure and recipients — our database, login provider and file storage is Supabase, hosted in the EU (Frankfurt), acting as our processor under an art. 28 data-processing agreement. The game and this website are served from an EU-hosted server whose web server keeps standard, short-lived access logs (IP address, time, requested URL, browser identification) for security and operations (art. 6(1)(f)); they are rotated away after about two weeks and are not combined with game data. Coin-pack payments are processed by Stripe: your card details go directly to Stripe and never reach us, and Stripe also retains its own records of your payments as an independent controller for its legal obligations (it may process payment data outside the EU under its own safeguards — see stripe.com/privacy). E-mail delivery is described in section 8 and Google sign-in in section 6. Beyond these providers, we disclose personal data only where the law requires it, or where it is necessary to establish, exercise or defend legal claims (art. 6(1)(f)).
12 · Retention and deletion — account data is kept for as long as the account exists. When you delete the account it is erased immediately and permanently: profile, rides, quests, coins, skins, invite relations, feedback and screenshots, and leaderboard entries posted while signed in. Delete it yourself under ACCOUNT → DELETE ACCOUNT (it takes effect at once), or e-mail us. Our copy of any purchase record is erased with the account, except where accounting law obliges us to keep an invoice record, and Stripe keeps its own payment records for as long as its legal obligations require. Anonymous leaderboard posts are not linked to you — e-mail us to have one removed. Aggregate daily counters (section 5) and website statistics (section 4) contain nothing personal and are kept for the game's statistics.
13 · Security — all traffic is encrypted in transit (TLS), passwords are stored only as salted hashes, and every database table is protected by row-level security so one player can never read another's data. We collect little precisely so that little can leak. No system is perfectly secure; should a breach nevertheless affect your data, we will notify the supervisory authority and, where the GDPR requires it, you, without undue delay.
14 · Advertising (Google AdSense) — the content pages of this website (the home page, the guides, updates, about, contact, credits and this policy) include the Google AdSense script, and once Google has approved the site they show advertising served by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The game screen itself carries no ads during a run. To serve ads, cap how often you see the same one, measure that an ad was shown and detect fraud, Google and its certified advertising partners may use cookies and similar identifiers (including the DoubleClick IDE cookie) and may, with your consent, personalise ads based on your visits to this and other websites. In the EEA, the United Kingdom and Switzerland we ask for that consent through Google's own consent dialog, which follows the IAB Transparency & Consent Framework and lists every partner; if you decline, Google shows ads that use no cookies for personalisation, or none at all. You can change your choice at any time via the "Privacy settings" link in the footer of every page. Legal basis: your consent (art. 6(1)(a) GDPR and the ePrivacy rules on cookies) for anything stored on your device or personalised; our legitimate interest (art. 6(1)(f)) in funding a free game for non-personalised ads. How Google uses the data it collects on partner sites is described at policies.google.com/technologies/partner-sites; you can opt out of personalised advertising at adssettings.google.com and, for other vendors, at youronlinechoices.eu. The "free spin" rewarded-video screen in the shop is still an inert placeholder: if rewarded videos ever go live, this section will say so first, and they play only when you press the button.
What we still don't do — no cross-site tracking of our own, no fingerprinting, no profiling, no automated decision-making with legal or similar effect, no AI processing of your data, no selling or sharing of data for marketing. Advertising data collected by Google is governed by Google's privacy policy, not stored by us, and never joined to your rider account.
15 · Children — the game is playable without an account and collects no more data from children than from anyone else. Creating an account requires the age set out in the Terms (15, or a parent's or guardian's permission). Parents or guardians can write to us at any time to have a child's account, posts or feedback removed.
16 · Changes — changes to this policy are published here with a new version number and effective date; material changes are additionally announced in the game before they take effect.
Version 5 — published 6 October 2026, adding your game settings to what section 6 lists as stored with a rider account, so they follow you to every device you sign in on. Version 4 — published 15 September 2026, adding section 14 on advertising (which concerns this website's pages and stores nothing about your rider account). Otherwise unchanged from version 3 of 6 September 2026, which is effective immediately for new accounts and from 20 September 2026 for existing riders (version 2 of 18 August 2026 applies to them until then).