Legal — Rip & Ride

Privacy Policy

Last updated: 2026-10-24

A professional translation of this document into your language is pending. The English version below is the authoritative text for now.

This policy explains what personal data Rip & Ride collects, why, and your rights over it. It is written to the GDPR. We keep data collection to what the game actually needs.

1. Who is responsible

The data controller is RarxNetwork (Tax ID B39947607), Marià Fortuny, 38, 08830 Sant Boi de Llobregat, Barcelona, Spain. Contact: [email protected]. Data-protection contact: [email protected].

2. What we collect

We do not store your IP address against your account. IP addresses are processed only transiently to prevent abuse (rate limiting) and are not kept in your account record. We do not use any advertising or analytics trackers.

  • Account: your email, username and display name, and a securely hashed password (we never store your password in plain text).
  • If you sign in with Google or Apple: the provider, an identifier, and the email they share with us.
  • Preferences: your interface language and privacy ("incognito") choice; an optional profile avatar you upload.
  • Sessions: which sessions are active, a device label you provide (e.g. "Web browser") and their dates — so you can review and sign out of devices.
  • Gameplay: your collection, pack openings, wallet and ✦ ledger, market listings, auctions, bids, trades, showcases, milestones, referrals, notifications and any content you contribute.
  • Purchases: when real-money purchases are enabled, a record of each purchase (provider, product, status) — payment card details are handled by the payment provider, not by us.

3. Why we use it, and our legal basis

PurposeLegal basis
Create and run your account; provide the game; trades, market and social featuresPerformance of a contract (Art. 6(1)(b))
Verify your email and send essential service messages (verification, password reset)Performance of a contract (Art. 6(1)(b))
Keep the service secure and prevent abuse and cheatingLegitimate interests (Art. 6(1)(f))
Process real-money purchases (when enabled)Performance of a contract (Art. 6(1)(b)); legal obligation for tax/accounting
Non-essential cookies/scripts, if any are ever addedConsent (Art. 6(1)(a)) — via the cookie banner

4. Who processes data for us, and transfers

We use a small number of service providers who process data on our behalf:

  • Google and Apple — only if you choose to sign in with them (authentication).
  • Our email provider — to send verification and password-reset messages.
  • Our hosting provider Hetzner Online GmbH (Germany, EU) — to run the site, the API and the database.
  • Stripe (web) and Apple/Google (in mobile apps) — to process real-money purchases, once purchases are enabled. They act as independent controllers/processors for payment data under their own policies.

Some providers (such as Google and Apple) are based in the United States, so using those features involves an international transfer, made under appropriate safeguards (e.g. standard contractual clauses or an equivalent framework).

5. How long we keep it

We keep your account data for as long as your account exists. When you delete your account we erase or anonymise your personal data; we retain purchase and payment records for 6 years, unlinked from your identity, to meet tax and accounting obligations (Spanish Commercial Code). Sessions expire 28 days after sign-in. We do not keep server logs tied to your account, and your IP address is used only transiently for abuse prevention and is never stored.

6. Your rights

You can access, correct, delete, restrict or object to the processing of your data, and ask for a portable copy. Several of these are built in:

  • Access & portability: download a complete copy of your account data at any time from your account ("Export my data").
  • Rectification: edit your profile and replace or remove your avatar in the app.
  • Sessions: review and sign out of individual devices, or everywhere.
  • Social logins: unlink Google or Apple from your account.
  • Erasure: a self-service delete button is not available yet. To have your account and data erased, contact us at [email protected] and we will action it. We honour erasure requests subject to legal retention obligations.

You can withdraw any consent at any time, and you have the right to complain to your data-protection authority (in Spain, the AEPD).

7. What other players can see

Your username, display name and avatar are visible to other players through features like the market, trades, showcases and public collections. Your email is never shown to other players. The "incognito" setting reduces your public visibility.

8. Children

Rip & Ride is not intended for children under 16. We do not knowingly collect data from under-16s. Real-money purchases are limited to users 18 and over. We do not verify age beyond self-declaration; if you believe a child has given us data, contact us at [email protected] and we will remove it.

9. Cookies

We use only essential cookies, and browser storage for your preferences. See the Cookie Policy for the full list and how to manage your choice.

10. Changes

We may update this policy. If changes are significant we will give reasonable notice. Questions: [email protected].