Home • About • Fair play • Support • Changelog
Privacy policy
Last updated: 17 October 2026
Who we are
RALLY52 is run by Rally52, 21 Midsummer Court, Midsummer Boulevard, Milton Keynes MK9 2UB, United Kingdom ("we"). For anything about your data, email hello@rally52.com. We are the data controller for the information described here.
What we collect and why
| Information | Why | Legal basis (UK GDPR) |
|---|---|---|
| Your email address, or the Google / Discord account you sign in with | To create your account and sign you in | Contract |
| Your username, name effect, team, and a picture of each car you race (with your paint and wheels) | Shown on the public leaderboards | Contract |
| Your runs: times, results, car, and a replay of each drive (the car's position over time) | Leaderboards, your stats, checking runs are fair, and replays. The replay of your best time on a stage can be raced as a ghost by other players | Contract and legitimate interests (fair play) |
| Guest play: an anonymous ID and the same run data, with no name or email | So guests can play and their runs can be checked | Legitimate interests |
| Streak reminders, only if you ask for them (the game offers them once your streak reaches 3 days, and Settings switches them on or off): your email address, your streak and whether you finished each day's stage. We send at most one email a day, about 4 hours before the stage resets, while your streak is 3 days or more and you haven't finished that day's stage. If you let 3 in a row go by, we stop. Every email has a link to turn them off | To remind you before your streak ends, as you asked | Consent |
| Rally Pass subscription status. Payments are handled by Stripe; we never see your full card number. If you open the Rally Pass checkout and don't finish, we email you once, a couple of hours later, with a link back to it (the checkout says so before you pay). Every reminder has an unsubscribe link, and you can also email hello@rally52.com; after that we don't send them again. Stripe checkout picks the currency from where you are, based on your IP address: pounds in the UK, euros in the eurozone, Canadian dollars in Canada, Australian dollars in Australia and US dollars everywhere else | To give you premium features, show prices in your currency and manage billing | Contract |
| A random ID kept in your browser (local storage and a cookie, both named rd_bid) and a scrambled code made from your IP address and browser, stored with each run; and the IP address each sign-in comes from, recorded by our sign-in provider (Supabase) | Preventing one person from racing on many accounts: limiting ranked attempts per device, and spotting linked accounts for review. Only our admins see the sign-in IP addresses, and only to review linked accounts; clearing site data removes the ID | Legitimate interests |
| Crash reports: the error message, the page address, your browser type and your account ID if signed in | To find and fix bugs | Legitimate interests |
| Standard server logs, including IP addresses, kept by our hosting providers | Security and preventing abuse | Legitimate interests |
We do not sell your data. Free players see ads (see Advertising below); Rally Pass members see none.
Gameplay analytics (only if you allow it)
The first time you play, we ask whether you'll allow gameplay analytics. If you say yes, the game sends PostHog (our analytics provider, EU data centre) information about how the game is used: which screens you open and buttons you press, when runs start and end, how far along the stage you got, your time and result, how smoothly the game ran, load times, errors, your device type and currency, the Rally Pass plan and price if you buy one, and your account ID if you're signed in (never your email). The same choice covers this site's information pages (home, guides, stages, cars): if you've said yes in the game, they record which pages you view. We may also record replays of your screen in the menus, with anything typed into text boxes hidden. We use this to find bugs, fix hard spots and improve the game. The legal basis is your consent.
If you say no, nothing is sent. You can change your mind at any time in Settings → Gameplay → Analytics; turning it off deletes the analytics identifiers stored in your browser. PostHog stores an identifier in your browser's local storage and a cookie so it can tell your visits apart. We keep analytics events for 12 months and screen replays for 30 days, and IP addresses are dropped from analytics events.
Advertising (free players)
Free players see ads, served by Google AdSense: ads on the pages of this website (guides, help and information pages), and an optional video ad in the game you can watch for an extra attempt. Ads never show while you drive, and Rally Pass members see none. Google may use cookies or similar identifiers to show and measure ads; where the law requires it (UK, EEA, Switzerland), Google asks for your consent first, and you can choose non-personalised ads. See how Google uses information from sites that use its services.
Storage on your device
The game saves your settings, customisations, saved replays and progress as a guest in your browser's local storage. This storage is needed for the game to work, so we don't ask for consent to it. Clearing your browser data removes it.
Who we share it with
We share data only with the services that run the game:
- Supabase: database, sign-in and replay storage (EU, Ireland)
- Stripe: payments and subscriptions
- Resend: sends the one reminder email about an unfinished Rally Pass checkout, and streak reminders if you asked for them
- PostHog (EU): gameplay analytics, only if you allow it
- Google (AdSense): ads for free players
- Cloudflare: serves the game and protects the site
- Google Fonts, cdnjs and jsDelivr: fonts and code libraries; they see your IP address when your browser loads them
- Google / Discord: only if you choose to sign in with them
Some of these providers may process data outside the UK. When they do, they use approved safeguards such as the UK International Data Transfer Addendum.
How long we keep it
We keep account data and runs while your account exists. Replays are kept so leaderboards can be checked; we may delete old replays at any time. Crash reports are kept for up to 90 days. If you ask us to delete your account, we remove your profile, runs and replays within 30 days. We may keep billing records for as long as the law requires.
Your rights
You can ask us to access, correct, delete or export your data, or object to how we use it. Email hello@rally52.com. You can also complain to the Information Commissioner's Office (ico.org.uk).
Children
RALLY52 is not meant for children under 13. We don't knowingly collect data from them. If you think a child has signed up, contact us and we'll delete the account.
Changes
If we change this policy in a way that matters, we'll say so in the game.