1. Leaderboard Submission Data (Stored on Our Server)

We collect and store only what's necessary for leaderboard functionality and fraud prevention:

• OEPlay.net Nickname publicly displayed in the leaderboard (Encrypted)
• OEPlay.net User ID for fraud prevention (Encrypted)
• IP Address for fraud and abuse prevention (retained for one hour)
• Score/Best Lap publicly displayed in the leaderboard
• In-Game Vehicle publicly displayed in the leaderboard
• Platform Type publicly displayed in the leaderboard
• Selected Profile Icon publicly displayed in the leaderboard

Why we need this: To maintain fair leaderboards, prevent cheating, and attribute scores properly.
Public visibility: Nickname, vehicle, platform type, profile icon and score/time appear on leaderboards.
Leaderboard Data Retention: Data is stored only if you opt-in by submitting a score and retained until the next leaderboard reset.
IP Address: Hashed during submission and kept for one hour solely for fraud prevention and service abuse detection.

2. Cloud Save Data (Stored on Our Server)

If you enable cloud saves:

• Your game progress is stored on our servers
• This data does not contain personal information and is deleted if you disable cloud saving, opt out, or delete your account.

3. User Account Data (Stored on Our Server)

When you register for our OEplay.net service:

• Username and password (Stored securely, no email required)
• Friends list (To allow you and your friends see your connection)
• Profile data (Nickname, unique user ID, profile icon and recovery key, stored securely)

Retention: Stored until account deletion or 1 year of inactivity
IP Address: Hashed during account creation and retained for one hour (1 hour) for fraud prevention and service abuse prevention.

3.5 Other Data (Stored on Our Server)

Each time you use our OEPlay.net service, we may collect the following information:

• IP Address (Hashed for security and abuse prevention, retained for one hour)
• Last time you logged in (Used to show your friends when you were last online and to identify inactive accounts for removal)
• Your multiplayer Room (Allows friends or other users to join your session) (Stored Encrypted)

Retention: Stored until account deletion or 1 year of inactivity
IP Address: Retained for one hour for fraud prevention and service abuse prevention.

Analytics Services (Firebase & Google Analytics)

These services help us understand how the app is used and improve it.

If you consent, these services may collect:

• Device information: Model, operating system version, language settings
• Usage patterns: Session length, features used, crash reports
• Approximate location: Derived from network information (not precise GPS)
• Technical identifiers: Randomly generated app instance IDs

You can opt-out in Settings > Information > Your Consent

Advertising Services (Google AdMob, Unity Ads, IronSource, Gadsme)

If you consent, these partners may collect:

• Advertising IDs: Resettable identifiers (AAID on Android, IDFA on iOS)
• Network information: IP address (for security and regional ads)
• Ad engagement: Which ads you view or interact with
• Performance data: Whether ads led to installations or purchases

Manage preferences: Settings > Information > Your Consent

5. User-Generated Content

Mods (via mod.io):

• User-created mods are hosted on mod.io's platform
• We only process mod metadata temporarily (name, version)
• Report inappropriate content: Use mod.io's built-in reporting tools

Local Device Data:

• Screenshots stay on your device (we never access them)
• Cached images auto-delete and can be manually cleared

6. Hosting Environment

Our web service operates on third-party shared hosting. The provider may access data only for:

• Essential security maintenance
• Technical operations
• Under strict confidentiality agreements

Your data may be processed outside your home country, including in the United States. This occurs when:

• Our third-party service providers operate globally
• Our cloud hosting infrastructure spans multiple regions
• You interact with our services across borders

Legal Safeguards We Implement

• For EEA/UK transfers: We use Standard Contractual Clauses (SCCs) approved by the European Commission
• For US-bound data: We rely on the EU-U.S. Data Privacy Framework (DPF) where providers are DPF-certified
• Additional measures: Encryption in transit (TLS 1.2+) and at rest (AES-256)

Provider Compliance Status:

• Google (DPF-certified) View certification
• Unity (DPF-certified) View certification
• IronSource (DPF-certified) View certification

We regularly verify our providers' compliance with these frameworks.

You have these options to manage your data:

• Opt-out paths: Settings > Information > Your Consent
• Revoke permissions: Via device settings
• Reset advertising ID: Android: Google Settings > Ads, iOS: Privacy > Tracking
• Request full deletion: Contact support@oe-games.com