Privacy policy

This policy covers Neon Slot Car Racing (NSCR) for iOS and Android and its associated game services. It does not describe unrelated Lutraha apps or general website browsing.

1. Who is responsible

Lutraha LLC is responsible for the personal data processing described here, except where a platform or provider independently controls its own processing. Our business address is 30 N Gould St #46579, Sheridan, WY, 82801, USA. For privacy questions and requests, email [email protected]. For game support, email [email protected].

2. Who can play

NSCR is for players aged 13 and over. We use age eligibility information to apply appropriate privacy choices. Where local law requires parental authorization for a younger teenager’s optional data processing, we require that authorization or leave the processing disabled. If you believe a child under 13 has provided personal data, please contact us so we can investigate and take appropriate action.

3. Information we process

• Account and identity: a randomly generated installation identifier, your game account ID, player name, authentication/session information, and records needed for account recovery or deletion. An automatically created account is still identifiable to our backend. If you choose Apple or Google account linking, we receive the provider identifiers and authentication information needed to verify that link; we do not receive your provider password.
• Game activity: progression, level and experience, cars and inventory, virtual balances, rewards, race results, saved track and ghost data, multiplayer participation, friends, invitations and challenges.
• Purchases: product and transaction identifiers, verification results, purchase status, and your in-app purchase entitlements. Apple or Google handles payment details; we do not receive your full payment-card information.
• Technical and security information: IP addresses, request/error logs, device and app information, and records of security, account administration and fraud-prevention events.
• Diagnostics and optional analytics: crash traces, diagnostic context and, with your consent, gameplay events such as tutorial progress, race attempts and feature interactions, as explained below.
• Privacy and support: your selected choices and their record, correspondence you send, and limited evidence of how we handled requests.

Other players may see your player name and relevant race, profile and challenge information through multiplayer and social features. The game has no free-text chat or user uploads. Reactions are predefined. Please do not put your real name or contact details in your player name.

4. Why we use information

Where the GDPR applies, we use account, progression, multiplayer and purchase information to provide the service you request and perform our agreement with you. We use proportionate technical, security and administration records for our legitimate interests in operating a reliable service, preventing abuse and resolving disputes. We use required financial records to meet legal obligations.

We use minimized crash diagnostics for our legitimate interest in finding and fixing defects and operating a reliable service. Optional gameplay analytics and advertising-related processing start only after the applicable consent. Declining optional processing does not prevent ordinary gameplay. At launch, analytics and advertising remain off for players who select the 13–17 age group. We do not treat acceptance of the Terms of Use as consent to optional processing.

5. Crash reports and gameplay analytics

Firebase Crashlytics (Google) receives crash and nonfatal error reports, device/app information, identifiers, and limited diagnostic context to help identify problems. We do not attach your NSCR account ID to these reports. We filter sensitive information from our own diagnostic context, but reports are not anonymous. Crash reporting is enabled by default and can be disabled independently in Settings.

With your permission, GameAnalytics receives device/app information, identifiers and events about tutorials, races and feature use to help us understand and improve the game. We configure a randomized analytics identifier and do not attach your NSCR account ID. The randomized identifier can still associate activity with one installation, so this is pseudonymous rather than anonymous analytics.

You can withdraw analytics or advertising consent and object to future crash reporting in Settings. These changes do not automatically erase information already sent. Contact us for a deletion request. See Firebase privacy information and GameAnalytics privacy information.

6. Optional rewarded advertising

NSCR uses Unity LevelPlay mediation with ironSource Ads and Unity Ads for optional rewarded advertisements. Launch advertising is contextual, not personalized based on activity across other apps or websites. Contextual advertising can still process IP addresses, device/app information, permitted identifiers, ad impressions and interactions for delivery, measurement, frequency limits and fraud prevention.

We apply age-appropriate settings and obtain any required consent before the relevant collection. If you decline a choice necessary to provide an ad, that rewarded-ad opportunity may be unavailable; you can continue ordinary gameplay. A platform tracking permission is separate from our privacy choices. See Unity’s game-player privacy policy for the providers’ processing and privacy-request options.

7. Service providers and international processing

We use cloud hosting and database providers in the United States for game accounts, backend services and backups. Our service providers also include Google/Firebase, GameAnalytics and email providers. Apple and Google process store purchases and optional platform sign-in. Advertising partners process information as described above. We may disclose limited information where necessary to comply with law, protect rights or address security incidents.

Providers may process data in other countries as described in their notices. US backend hosting does not mean all game-related data stays in the United States. Where transfer safeguards are required, the standard provider terms include mechanisms such as the EU Standard Contractual Clauses and the UK Addendum. You can read the relevant terms from DigitalOcean, Firebase, GameAnalytics and Unity, or request information from us at [email protected].

8. How long we keep information

• Account and progression: while you use the game, then deletion after 24 months without player sign-in or gameplay, unless you request deletion earlier. Background maintenance does not count as player activity.
• Routine server and access logs: up to 90 days.
• Database backups: a rolling maximum of 30 days. Deleted information may remain in restricted recovery copies until expiry; it is not used for ordinary operations, and deletions are reapplied if a backup is restored.
• Ordinary support correspondence: 12 months after the issue closes.
• Routine security and administration records: 12 months after the event.
• Minimal consent and request-handling evidence: three years after consent is withdrawn or replaced, or the request is closed. This does not justify retaining a complete deleted profile.
• Purchase entitlements and restoration identifiers: for as long as necessary to honor the purchase. Required accounting and tax records follow applicable statutory periods. These records are separated from routine progression cleanup.
• Crashlytics: Google states that crash traces, extracted minidump data and associated identifiers are retained for 90 days before removal from live and backup systems begins.
• GameAnalytics: its published schedule currently retains raw and annotated data for one month, Player Warehouse data for one year, and player lookup data used to calculate retention for 18 months.
• Advertising providers: according to their published policies and for as long as needed to deliver and measure contextual ads, prevent fraud, meet security and accounting needs, and comply with legal obligations.

We may retain the specific records necessary for an actual dispute, security investigation or legal obligation for a justified longer period. We limit access and review the continuing need. Truly anonymous statistics may be kept longer; replacing an account ID with a hash does not by itself make data anonymous.

9. Account deletion and your rights

You can delete your account from Profile, or request deletion by email without reinstalling the game. See Account & data deletion. Deletion removes your account and associated progression, subject to the limited retention exceptions above. It does not automatically refund store purchases. Some restricted purchase, security and request-handling evidence can remain, and backups expire separately.

Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of earlier processing. You may complain to your local data-protection authority, including the authority where you live or work in the EEA.

Email [email protected]. We may request proportionate information to verify ownership; do not send passwords or sign-in codes. We respond within applicable legal deadlines, normally one month under the GDPR, and explain any permitted extension. We coordinate requests with providers where appropriate; independently operated store or advertising services may also offer their own request channels.

10. Changes

We will update this page when our practices change and provide additional notice of material changes where required. New processing that requires consent will not be authorized merely by updating this policy.