Privacy policy

1. Controller

Marian Peer Knigge, DIY Elektronik by Knigge, Friedenstraße 1, 31228 Peine, email: craftingcrates24@gmail.com, telephone: 015905394087.

2. Hosting and technical logs

The application is hosted on a STRATO server. Regular Nginx access logging is disabled for this website. Technical errors may cause server and system logs to record the time, IP address and details of the failed request. These serve the application's stability and security under Article 6(1)(f) GDPR. Server rotation currently retains such logs for no more than 14 days, unless longer retention is required to investigate a specific security incident.

3. Multiplayer and WebSockets

For lobbies and races we process the WebSocket connection, chosen player name, temporary lobby code, selected car appearance, vehicle states and game actions. This is necessary to provide the requested game under Article 6(1)(b) GDPR. Lobby data is held in game-server memory and is not stored as identifiable data in long-term telemetry after the lobby ends.

LoopCoins guest account and garage

Opening the game creates a pseudonymous LoopCoins guest account. A necessary HttpOnly cookie named looprace_guest enables access again in the same browser and lasts up to two years. The server stores only a hash of the random access key, plus balance, unlocked parts, designs, challenges, achievements and confirmed race transactions. Economy data is separate from game telemetry and retained to continue the guest account. Player names and full position histories are not included in coin transactions. Browser storage also holds copies of vehicles; the server determines balance and purchases. Deleting the cookie removes access on that device, not automatically the server-side account data. Contact us above about deletion. Without sign-in or a transfer function, there is no automatic recovery or synchronisation on other devices.

4. Internal game telemetry

The server stores event type, time, randomly generated anonymous identifiers and game metrics suitable for aggregation. This supports fault detection, capacity planning and game improvements under Article 6(1)(f) GDPR. Full IP addresses, player names, lobby codes and continuous position data are not stored there. Detailed game-event, session and race data is automatically deleted after 90 days; only aggregated daily values may remain permanently.

Daily challenge and public leaderboard

The randomly generated track, rules and daily period are stored permanently for the daily challenge. If you expressly choose publication, we store and publish your chosen nickname, best server-confirmed total time and the time that run was achieved in the daily leaderboard under Article 6(1)(a) GDPR. Your guest account is linked internally, but neither its identifier nor your access key is published. Other lobby names and chat messages are not copied into the leaderboard. Without this choice, you drive in practice mode with no public entry. Use a nickname without personal information. Weekly leaderboards remain archived until you withdraw and remove your entry using Delete my public entry, or a valid deletion request is processed. You must retain the same guest-account cookie to delete your own entry. Contact us above for assistance. No IP addresses or full driving histories are stored in the leaderboard.

5. Optional pit radio

After a completed series you may voluntarily submit an idea, bug report or handling feedback. We store message text, category, time, game mode, and the numbers of tracks raced and participants. Player names and lobby codes are not linked to the message. Please do not include personal information in the free-text field. Processing serves game improvement and troubleshooting under Article 6(1)(f) GDPR. An editorial summary of an implemented request and solution may be published on the updates page without a player identifier. The original stays in the protected inbox. Messages are automatically deleted after no more than twelve months.

6. Optional Umami audience analytics

Umami runs on our own infrastructure and loads only with your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. It processes the page visited, time, referrer, browser, operating system, device class and an approximate country. The IP address technically used during transmission is not stored in full in the analytics database. Umami does not set tracking cookies for audience measurement. Withdraw consent at any time through Privacy settings, with effect for the future.

7. Advertising

The homepage loads Google's AdSense tag to integrate Google's European regulations consent dialog. Ad requests are paused during this overhaul. Loading the tag and dialog already establishes connections to Google, technically transmitting the IP address, browser information and requested page. Pausing ad requests does not prevent these connections. The EEA provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data in third countries, particularly the USA. Google's consent-management platform stores your choices. Optional device-storage access and subsequent ad delivery depend on consent given there, under Article 6(1)(a) GDPR and section 25(1) TDDDG. Providing and storing necessary consent management serves our data-protection obligations under Article 6(1)(c) GDPR and section 25(2)(2) TDDDG. The lobby, editor and races do not load an AdSense tag. Use Privacy settings to reopen Google's dialog on the homepage and change your choices. The dialog identifies participating providers; see also Google's policy at https://policies.google.com/privacy.

8. Local browser storage

Your language choice is stored for up to one year in the necessary looprace_language cookie. It contains only de or en and is not used for tracking.

Your browser's local storage saves voluntarily entered preferences: driver name, car appearance, audio settings and optional analytics choice. These preferences remain on your device; the name and car are additionally sent to the active lobby when you join. Google's dialog separately manages advertising consent and may use cookies or other local consent records; participating providers and retention periods are available there. Storing choices and technically necessary settings is based on section 25(2)(2) TDDDG. Remove optional convenience data by clearing browser data.

9. Admin session

Only the protected administrator area sets a necessary random HttpOnly session cookie after successful sign-in. In production it uses Secure and SameSite=Strict and expires after 30 minutes.

10. Recipients

STRATO receives data necessary for hosting. Umami is self-hosted. Visiting the homepage gives Google technical connection data for the AdSense tag and consent dialog even while ad requests are paused. Optional advertising processing is enabled only after the necessary consent.

11. Your rights

Under the GDPR you have rights including access, rectification, erasure, restriction, data portability and objection, as applicable. Withdraw consent at any time with effect for the future. You may also complain to a data-protection supervisory authority. Contact craftingcrates24@gmail.com for requests.