Privacy Policy

Stuntway is published by Daniel Peter Nagy, an independent self-employed developer based in Germany, operating under the name “ChillScale Games”. Daniel Peter Nagy is the controller responsible for the processing of your data. For any privacy question or request, write to info@danielnagy.dev or use the contact form on this website. The postal address is in the Impressum.

Contact form: Send us a message

• The game has no ads, no analytics, no crash reporting and no in-app purchases, and it needs no account.
• It plays fully offline. Your progress, your times and your own tracks live on your device.
• Data reaches our server only through the optional online features: the leaderboards and their public ghosts. What that involves is described below.

The game keeps these in the app’s own storage on your device: your settings, your personal-best times with the input recordings that replay them as ghosts, the tracks you build in the editor, ghosts you imported, a few play statistics used for achievements, your driver name, and the random guest ID described below. Uninstalling the app deletes all of it.

The app keeps this data out of the automatic Android backup to your Google account. Only when you move to a new phone yourself (Android's device-to-device transfer) does it travel with your other apps. If you share a track as a file, or a lap time, it goes only where you send it; it does not pass through our server.

When you set a personal best on a campaign track and your device is online, the game uploads that run to our server; a run that could not be sent waits on your device and is sent next time. When you open a leaderboard or race someone’s ghost, the game downloads it from our server. Our server stores:

• a random guest ID the game creates on your device (22 characters). It is how the server recognises you, so it works like a password: it is never shown publicly and is not linked to your identity;
• the driver name you typed in the game (until you change it, it is “Driver” and a random number);
• the run’s input recording: your steering, throttle and brake for every tick of the run, up to the finish;
• the verified time, the split times, the number of respawns, when the run was submitted and the game version;
• the real time the run took on your device (wall-clock time), which we compare with the simulated time as an anti-cheat check;
• anti-cheat measurements: how similar the inputs are to other players’ runs on the same track, and review flags;
• when your player record was created and when it was last used.

Our server drives every uploaded run again from its inputs, and only the time it gets itself goes on the board. A run that copies another player’s ghost is refused. A run whose measurements look unusual is marked for review; the mark is visible only to us.

Public: your driver name, your time, your rank, the date and the ghost (the input recording) of your ranked run. Anyone can download a ranked run’s ghost and race it in the game. Boards identify players only by a pseudonymous ID derived from the real one with a secret key, never by the real ID.

If you upload a track to the community (only possible when signed in with Google Play Games), our server stores the track itself (its name and layout), your player ID, your finishing test drive (its input recording, time and splits, stored and shown like a ranked run above), the upload and review dates, the review status and, if a track is rejected, the reason. A moderator reviews every track before it goes public.

Public once approved: the track’s name and layout, your name as its author, its share code, how many players have raced it and its leaderboard. If you report a track, we store which track you reported, why (one of three choices) and when; this is never shown publicly.

Where the game offers Google Play Games sign-in, it is optional. If you sign in, the game receives a one-time code from Google that our server exchanges with Google to confirm your Play Games player ID. We then store that player ID and your Play Games gamertag, which is shown on the leaderboards instead of the driver name, in the same way as the guest data above.

Google also stores your achievements and a cloud save in your Google account (Play Games saved games: your settings, your personal bests with their recordings, and your own tracks), so you can continue on another device. That data is managed by Google and does not reach our server.

Our server, which runs the leaderboards and this website, is hosted by netcup GmbH in Germany. netcup processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

When you visit this website or the game connects to our server, the web server writes an access log entry: your IP address, the time, the requested address and the browser or app identifier (user agent). These logs are deleted automatically after 10 days (14 days on our test system). The leaderboard application itself does not store IP addresses in its database; to limit abuse it keeps them only briefly in memory. This website sets no analytics or advertising cookies; it only remembers your language choice in your browser.

If you write to us through the contact form, we store your message, the time it was sent, the language and page it was sent from and, if you give them, your name and a reply email address. Messages are stored on our server, only we can read them, and they are deleted after 180 days. Your IP address is used only briefly to limit abuse and is not stored with the message.

• Google Play distributes the app. Google processes the data of the download and installation as an independent controller under its own privacy policy.
• Google Play Games Services (sign-in, achievements, cloud save), only if you sign in. Google acts as an independent controller.
• netcup GmbH (Germany) hosts our server as our processor (see “Hosting and server logs”).

We do not sell your personal data, and we do not share it with anyone for advertising.

Our own server is in Germany. Google may process data in the United States and other countries outside the European Economic Area. For these transfers Google relies on the EU-US Data Privacy Framework, under which Google LLC is certified, and on the European Commission’s standard contractual clauses. Details are in Google’s privacy policy.

Where the GDPR applies, we process data on these bases:

• Performance of the service you use (Art. 6(1)(b) GDPR): the leaderboards and public ghosts, and the Play Games sign-in if you use it.
• Our legitimate interest (Art. 6(1)(f) GDPR): preventing cheating (re-driving runs, comparing inputs, the wall-clock check), protecting our server (access logs, rate limiting) and answering your messages.
• Storing data on your device (§ 25(2) TDDDG) is limited to what the game or this website needs for the service you asked for: your progress, your settings and your language choice.

You have the right to access the data we hold about you, to have it corrected, to have it erased, to restrict its processing, to receive it in a machine-readable format (data portability), and to object to processing that is based on our legitimate interest.

In the game: open Settings → Online. “Download my data” gives you everything our server holds about you as a machine-readable file (JSON). “Delete my online data” permanently deletes every run and ghost you uploaded and your player record from our server; your runs leave the public boards immediately, and your times on the device stay. You can change your driver name in the same place; it is updated with your next upload.

For any other request, or if you can no longer open the game, write to info@danielnagy.dev or use the contact form.

Step-by-step deletion instructions, including what to do if you can no longer open the app, are on a separate page: Delete your data

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe the infringement took place. In Hungary this is the National Authority for Data Protection and Freedom of Information (NAIH).

• Your best run on each track (time, splits, ghost and anti-cheat data): kept until you delete it.
• Community tracks you upload, with their leaderboards, and the reports you send: kept until you delete the track or your data. A track stays stored while it waits for review or after it was rejected, so you can see the decision.
• Runs later beaten by your own better time, and runs the server rejected: their recordings are not kept, and the rest is deleted after 30 days.
• Runs we remove from a board for breaking the rules: kept with their recording until you delete your data, so the decision can be reviewed.
• Web server access logs: deleted after 10 days (14 days on our test system).
• Contact form messages: deleted after 180 days. No IP address is stored with them.
• Data on your device: kept until you uninstall the app. Cloud save: kept until you delete it in Google Play Games.

For recovery after a fault, the server keeps backup copies of its database: at most 4 copies, normally none older than 30 days. A copy made before you deleted your data may still contain it until that copy is removed. Backups are never used to bring deleted data back: if a backup is ever restored, every player deleted since that backup was made is erased again automatically before the server goes back online. For this we keep a one-way fingerprint (a hash) of each deleted player ID, never the ID itself, and the time of deletion.

Stuntway is intended for players aged 13 and over. We do not knowingly collect personal data from children under 13. Where the law of your country sets a higher age for consenting to online services (in some EU countries up to 16), a parent or guardian has to give or approve that consent. If you believe a child has given us personal data, contact us and we will delete it.

Data sent between the game and our server is transmitted over encrypted connections. No system is perfectly secure, but we take reasonable measures to protect the limited data we hold.

We may update this policy as the game evolves, for example if we add new online features. Material changes will be reflected by an updated effective date on this page.

Questions about this policy or your data: info@danielnagy.dev.

Or use the contact form: Send us a message