Privacy policy

Effective from 1 November 2026

1. Who is the controller

The controller of your personal data is Łukasz Śpiewak, Toruń, Poland (“we”). The OneTouch GP game runs at onetouchgp.com.

Contact for anything about your data: contact@onetouchgp.com. We have not appointed a data protection officer.

2. What data we process, why, and on what legal basis

The legal bases come from the GDPR (Regulation (EU) 2016/679):

• contract — Art. 6(1)(b) GDPR: data needed to run the game under the terms of use (account, results, leaderboards, tracks);
• legitimate interest — Art. 6(1)(f) GDPR: protecting the game from abuse, security and fixing errors;
• consent — Art. 6(1)(a) GDPR: push notifications, if you turn them on.

Player account

A random player ID, nickname, helmet colour, country flag and the date the account was created. The account is created automatically the first time the game connects to the server; the nickname starts out random (e.g. “Kierowca-AB12”) and you can change it. You choose the country flag yourself in your profile — we don’t derive it from your location or IP address. Basis: contract. Kept until you delete the account.

Sign-in and devices

• Devices: a hash (SHA-256) of each device’s sign-in token, and the dates it was added and last used. The token itself is stored only on your device.
• Passkeys: the key ID, public key, signature counter, how the key connects, the key name and dates. The private key and any biometric data never leave your device.
• Recovery codes: only their hashes (HMAC) and the dates they were used; only you see the readable codes, once.

Basis: contract. Kept until you delete the account (recovery codes: until you generate a new set or delete the account).

Signing in to your profile on a device with a guest account: if the device has an automatically created account (a guest, without a passkey) and you sign in to your profile, the game moves the guest’s data to your profile — results (the better time is kept on each leaderboard), published tracks, challenge links, push subscriptions and statistics — and deletes the guest account. Your profile’s nickname, helmet and flag stay. No new data is created. A guest account with a passkey is never merged.

Results and lap replays

Your best time on each track, in the daily challenge and in season rounds, the date of the result, and the replay of the lap (game version, track, control mode, the moments you pressed and released the screen, split times). Replays are used to check that a result is genuine and for the “ghost” you can race against. Basis: contract. Kept until you delete the account — leaderboards don’t expire.

The server automatically re-runs the replay before accepting a result into a leaderboard. This only checks that the in-game result is valid; we make no decisions that have legal effects on you and we don’t profile players.

Season points and standings

When a season round ends, the server records your place in the round, the points you earned and your time, and separately counters of your attempts in the round (the number of runs and laps). The season standings are built from this data. The standings are public: they show your nickname, helmet colour, flag, points, position and number of rounds. The attempt counters are private — only you can see them. Basis: contract (the season is part of the game). Kept until you delete the account; after deletion you disappear from the standings and the places below you move up.

Profile statistics

So that Profile can show statistics from all your devices, the game sends each device’s statistics in the background: counters (e.g. runs, finished runs, laps, distance, time, runs per track, longest streak, daily challenge days) and the dates of days you played and completed daily challenges — only from the last 60 days, without times of day or time zone. Statistics are stored separately for each installation of the game, under a random ID created in the browser and not linked to the hardware. Only you can see them — they don’t appear on leaderboards or public pages, and we don’t profile you based on them. Basis: contract. Kept until you delete the account; statistics of an installation that hasn’t sent any for 400 days are removed earlier.

Challenge links

When you open sharing for a lap on an official track or in a season round, the game saves a short challenge link on the server (onetouchgp.com/c/…) so it can be sent to others: a random link ID, the lap recording, the track, the time, the nickname (unless it is the random starting nickname), the language and the creation date, and once you share the result, also the result card image. The link page and its preview are public to anyone who has the link (section 3). Basis: contract. Links are removed 90 days after creation, or immediately when you delete the account.

Published tracks

When you publish a track from the editor: its code, name, shape, publication date and who the author is. Basis: contract. The track stays in the game indefinitely, because other players may have raced it. If you delete your account, the track stays available in the game, but without an author. If a track name contains personal data you want removed, write to us.

Push notifications (only if you turn them on)

The subscription address in your browser’s push service, keys used to encrypt notification content, your time zone (so the daily challenge arrives at a sensible hour), language, the notification types you chose and the date of the last daily challenge sent. Basis: consent. You can withdraw consent at any time by turning notifications off in the game or in your browser settings; this doesn’t affect notifications already sent. Kept until you turn notifications off, delete the account, or the push service rejects the subscription. Each account can have notifications on at most 10 devices — adding another removes the oldest subscription.

We also record who was sent a “time beaten” or “podium” notification and when (player ID, track, time), so we don’t send them too often. Basis: legitimate interest. These entries are removed after 48 hours, at the next cleanup — cleanup happens with the next send, so an entry may stay longer.

Protection against abuse

We count requests to limit spam and attacks (for example too many sign-ups or results in a short time). A counter is tied either to your player ID or to a hash (HMAC with a secret key) of your IP address or part of it. We don’t store the IP address itself in the database. Basis: legitimate interest. Counters are removed after 24 hours, at the next cleanup. In season rounds we also compare a hash of the toggles from your run with other players’ hashes to reject copied runs; the hash is part of the result row and is removed with it. Basis: legitimate interest. Likewise, one-time passkey sign-in challenges (not linked to any player) are removed after 5 minutes, at the next cleanup.

Technical logs

Our hosting provider, Cloudflare, keeps logs of calls to the game server. They may include the time, address and headers of a request, the IP address, the response code and errors. We use them only to fix errors and protect the game. Basis: legitimate interest. Logs are deleted automatically within 3 days at the latest.

Data that stays on your device

The game stores settings, statistics, records with replays, tracks from the editor and your sign-in token in your browser’s storage (localStorage). This data doesn’t reach us, except for: the token (sent with every request so the server knows who you are), your helmet and flag, results sent to leaderboards, statistics with a random installation ID (profile statistics), tracks you publish, and your notification settings. The browser cache (service worker) holds only the game files, so the game works offline. This storage is necessary to run the game you open. You can remove it by clearing the site data in your browser or in the game (Profile → Your data).

3. What other players see

Leaderboards are public — anyone, even without an account, sees your nickname, helmet colour, flag, time and position next to your result. A published track shows the author’s nickname, the track name and shape, and the publication date. The season standings are public too: anyone, even without an account, sees your nickname, helmet colour, flag, points, position and number of rounds. In a season round, your best run may be shown to other players as a ghost labelled only with its position (e.g. “P5”) — without a nickname, helmet or flag. A challenge link shows anyone who has it (including in the link preview in a messaging app) the nickname from the link, the time, the track and the result card image, if one was sent. Profile statistics are not public. When you overtake someone, the “time beaten” notification may show them your nickname. If you don’t want to be recognisable, don’t use your real name as your nickname.

4. Who receives data

• Cloudflare, Inc. — game hosting, database (Cloudflare D1) and logs. Processes data on our behalf under a data processing agreement (DPA).
• Browser push services — only if you turn notifications on: Google (Firebase Cloud Messaging — e.g. Chrome and Edge on Android), Mozilla (Firefox), Apple (Safari, iPhone and iPad), Microsoft (Edge on Windows) — depending on your browser. The service receives the encrypted notification content, which it cannot read, plus the subscription address, time and message size.
• Other players — leaderboard, season standings, season-round ghost, published-track and challenge-link data (section 3). The service where a challenge link is sent (e.g. a messaging app) also fetches its preview.
• Public authorities — only where the law requires it.

We don’t sell data or share it with advertisers.

5. Transfers outside the European Economic Area

Cloudflare operates worldwide and may process data outside the EEA, including in the USA. These transfers are protected by Standard Contractual Clauses approved by the European Commission, included in Cloudflare’s data processing agreement. Browser push services may also process data outside the EEA, under the terms set by their providers. Write to us for a copy of the safeguards.

6. How long we keep data

• Account, devices, passkeys, recovery codes, results and replays — until you delete the account.
• Round results and season points, and attempt counters in rounds — until you delete the account.
• Profile statistics — until you delete the account; statistics of an installation that hasn’t sent any for 400 days are removed earlier.
• Challenge links — 90 days after creation, or until you delete the account.
• Published tracks — indefinitely; without an author after account deletion.
• Push subscriptions — until you turn notifications off or delete the account.
• Notification log — removed after 48 hours, at the next cleanup.
• Abuse-protection counters — removed after 24 hours, at the next cleanup.
• Technical logs — up to 3 days.
• Database backups (Cloudflare D1 Time Travel) — the database can be restored to any point in up to the last 30 days. Deleted data may therefore remain in backups for up to 30 days; after that the backups are overwritten and the data is gone for good. We use backups only for emergency restores. If the database ever had to be restored from a backup, data of accounts deleted in that period could come back.

7. Your rights

You have the right to:

• access your data and get a copy (Art. 15 GDPR);
• rectification (Art. 16) — you can change your nickname, helmet and flag yourself in Profile;
• erasure (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20) — the JSON file from “Download my data”;
• object to processing based on legitimate interest (Art. 21);
• withdraw consent to notifications at any time.

How to use them

• “Download my data” (Profile → Your data) — a file with your data from the server and from this device.
• “Delete account” (Profile → Your data) — immediately removes from the game your results on every leaderboard, your points and places in the season standings, your challenge links, profile statistics, push subscriptions, passkeys, recovery codes and devices; all sign-in tokens stop working. If this device also holds an older profile, the game tries to delete it too. Published tracks stay without an author. Apart from that, only these remain: abuse-protection counters tied to a hash of an IP address (up to 24 hours), database backups (up to 30 days) and technical logs (until their retention period ends).
• “Delete data from this device” — if you have no account on the server, clears the game data in your browser.
• Email: contact@onetouchgp.com. As we don’t know who you are, we may ask for information that confirms the account is yours (for example the player ID from the “Download my data” file). We reply without undue delay and within one month at the latest.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority in the EU country where you live.

8. Do you have to provide data

You don’t have to provide anything that identifies you. Account, results and device data are needed for the game to work with leaderboards; without them you can only play locally, without leaderboards. Notifications are optional.

9. Age

The game is intended for people aged 16 or over. If you are under 16, you may use it — including turning on notifications — only with the consent of a parent or legal guardian.

10. Cookies and analytics

We use no cookies — neither our own nor third-party ones. We use no analytics tools, tracking pixels or ads. The game doesn’t load scripts, fonts or any other resources from third-party services.

11. Changes to this policy

If the way we process data changes, we will update this policy. The current version is always at this address, with its effective date at the top.