Template: fill in the [bracketed] parts and have this checked by someone qualified before RÁS goes on sale. Delete this note when it's done.

Legal

Privacy Policy

Last updated: [date]

("we") makes RÁS, a cycling game for Android and Windows. This policy explains what we collect when you use a RÁS account, why, and the choices you have. Questions: .

What we collect

Your account: your email address and a password. The password is stored only as a secure hash by our accounts provider. We never see it.
Your rider: the rider name, height, weight, FTP, nation, bike and kit choices, coins, achievements and workout count you set in the game. The game sends these to your account so they follow you between devices and show on your account page.
Your rides: a summary of each ride you finish: name, date, distance, time, climbing, power, cadence, speed and energy. Heart rate isn't sent. It stays in the ride's FIT file on your device.
Your membership: your plan, its status and renewal date, and the access codes you've redeemed. Payments are taken by Stripe. Your card details go straight to Stripe and never reach us. We keep the Stripe customer reference that links your account to your subscription.
Technical records: our providers keep short-lived logs (such as IP addresses and request times) to run the service securely.

Why we use it

To run your account and let you sign in to the game (performing our contract with you).
To take payment for and manage your membership, and to keep the financial records the law requires (contract and legal obligation).
To show your rider and rides on your account page and keep your progress the same on each device (contract).
To keep the service secure and fix problems (our legitimate interests).

We don't sell your data, and we don't use it for advertising.

Who helps us

Supabase: hosts the accounts, the database and the server functions. [Region: e.g. London / EU]
Stripe: takes payments and manages subscriptions.
[The email service that sends sign-up and password emails, if you use your own.]
Strava: only if you connect it in the game. The game then uploads your rides to Strava for you.

Where a provider handles data outside the UK, it does so under safeguards the law recognises (such as standard contractual clauses).

How long we keep it

For as long as you have an account. When you delete your account (on your account page, or by asking us), your account, rider and rides are deleted from our servers straight away. Payment records held by Stripe are kept for as long as tax law requires [e.g. six years].

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to send it to you in a portable format. Contact . If you're unhappy with our answer, you can complain to the Information Commissioner's Office (ico.org.uk) [or your local regulator].

Children

RÁS accounts are for people aged [13] and over.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the game before the change takes effect.