Privacy Policy

HitRally: Time Attack · Last updated: October 18, 2026

This policy applies to the “HitRally: Time Attack” apps for iOS and Android and to the web version where it is connected to our server.

In short

• No ads, no tracking, no analytics. We do not pass data to third parties for their own purposes and we never sell data.
• No login, no email address, no real name. On first launch the game creates an anonymous game account with a random ID.
• We only store online what the game features need: username, the shop items you have equipped, best times, ghosts of your best times, the recordings of your runs for verification, likes, friends, duels, blocks and reports you submit.
• Account backup is optional and encrypted: if you create a recovery code, our server stores a copy of your progress that can only be read with your code. We never receive the code.
• Purchases are handled by Apple or Google. We never receive payment details.
• You can delete your account at any time: in the game under “Account & data”, or without the app at https://hitrally.net/time-attack/delete-account.html.

1. Controller

3D Daniel Obenland (owner: Daniel Obenland)
Henkelgraben 21, 74360 Ilsfeld, Germany
Email: info@obenhinaus.de

We are not legally required to appoint a data protection officer. Please send privacy questions to the email address above.

2. What we process and why

2.1 Anonymous game account

On first launch with an internet connection, the app creates a game account on our server. It consists of

• a random account ID (used, for example, to link your leaderboard entries),
• a secret access key that is stored only on your device (the server keeps only a one-way check value of it); the app sends it, encrypted, with every request so the server knows the request comes from your account,
• the creation time and the day of last use,
• only if needed, a suspension flag if we suspend the account for breaking the terms of use (e.g. an offensive name); we then remove the name and leaderboard entries.

Purpose: your entries belong to you and nobody else can change them. Legal basis: Art. 6(1)(b) GDPR (providing the online features of the game that you use); for the suspension flag Art. 6(1)(f) GDPR (protecting other players). Blocked usernames are also kept in a block list that is not linked to any account.

2.2 Online features

Legal bases: Art. 6(1)(b) GDPR (the game features you use); for re-computing times also Art. 6(1)(f) GDPR (our legitimate interest in fair leaderboards without cheating).

Please choose a username that does not reveal your real name. Username, equipped shop items, best times, ghosts, check results and likes can be retrieved by other players through the game features (leaderboards, player profile, ghosts). Not retrievable are the access key, your run recordings, friends, requests, blocks, invite code, duels (except by your duel opponent), your reports and your account backup.

The app uploads new best times automatically whenever it is online. Without a connection everything stays on the device and is uploaded later.

2.3 Technical connection data

Every connection to our server technically transmits your IP address. The server uses it only to limit abuse (number of requests per address, including attempts to restore a backup, section 2.8). For that purpose it keeps the address only in memory (while a live connection for the leaderboards is open and afterwards for at most 10 minutes after your last request) and does not write it to logs or files. Server logs contain only time, request type, result and duration. They contain no IP address, no account ID, no name and no content. Legal basis: Art. 6(1)(f) GDPR (security and stability of the service).

Our hosting provider Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus may keep its own connection logs: Hostinger International Ltd. only provides the data centre, network and the virtual server, which we operate ourselves, and processes connection data only under the data processing agreement (for example to fend off network attacks). Our own web server keeps no access log.

2.4 Purchases

In-app purchases (Challenge Pass, Season Cups, Legends) are handled by Apple (App Store) or Google (Google Play). We receive no payment details, no name and no email address. The store tells the app which product was bought, with a transaction ID, date and a receipt signed by the store. The app stores product, ID and date on your device so the unlock also works offline.

Purchase verification: so that unlocks cannot be faked and refunds are respected, the app sends the receipt to our server. The server verifies it (Apple: the signature; Google: via the Google Play Developer API) and stores with your account: product, platform, purchase date, transaction or order ID, status (valid/refunded) and the time of the check. It does not store the receipt itself or any payment details. When you buy, the app passes the store a random identifier of your game account (not your account ID, not your name) so the purchase can be matched to your account. Apple and Google notify our server about refunds; the unlock is then removed. Legal basis: Art. 6(1)(b) GDPR (providing the purchased content) and (f) (preventing abuse). “Restore Purchases” asks the store directly. Apple and Google are responsible for processing purchases; their privacy policies apply.

2.5 Only on your device

The app stores the following only on your device, in the app’s protected storage. It never leaves the device, except through your operating system’s backup (e.g. iCloud or Google backup), which you control, and, encrypted, through the optional account backup (section 2.8):

• game progress: medals, points, purchased and earned items, settings (including those of tilt steering) and the complete local copy of your best times, ghosts and run recordings (what of this is stored online is listed in section 2.2),
• your access key and, if created, your recovery code,
• clips: they are created on the device and shared only if you use the share sheet yourself; the terms of the app you pick there apply.

Motion sensor (“Tilt” steering): when you use “Tilt” or try it in the test area of the settings, the app reads your device’s orientation. It does so through the standard interface of the built-in browser view or, if that delivers no values, directly from the operating system. The sensor values are used only to steer in the moment; they are never stored or sent. As with every other steering mode, only the steering input calculated from them (−100 % to +100 %) becomes part of the run recording (section 2.2).

2.6 Support requests and reports by email

If you email us, we process your email address and the content of your message to answer it (Art. 6(1)(b) or (f) GDPR). We delete the message once the request is closed unless the law requires us to keep it.

If anyone reports illegal content to us under the Digital Services Act (procedure on the support page), we process the reporting person’s name and email address, the reported location (username, track) and the explanation in order to review the notice, confirm receipt and communicate our decision. This also applies to reports from people who do not use the app. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 of Regulation (EU) 2022/2065 (Digital Services Act). We delete these emails once the case is closed, at the latest 6 months after our decision. The affected player is not told who reported them unless this is strictly necessary.

2.7 Reporting and blocking

Next to other players’ names (leaderboard, friends, requests, duels) and on the end card of another player’s run you can use “⋯” to report a name or block the player.

• Report: the server stores the time, your account ID (only to prevent abuse of the report function and for follow-up questions, never public), the account ID and the name at that time of the reported player, the reason from a fixed list (offensive, abusive, cheating, other), the track and time if cheating is suspected, and our decision with its time. There is no free text. We review reports within 24 hours and remove inappropriate names or suspend accounts (terms of use §5). Legal basis: Art. 6(1)(f) GDPR (protecting players from offensive content and cheating).
• Blocking takes effect on your device immediately: the app stores the account ID, name and time in your game progress and hides the player. As soon as you are online, the app also tells our server; the server stores the block with its time together with both of your account IDs so the blocked player can no longer send you friend requests or duels. The blocked player is not told that you blocked them. Undo it under “Account & data” → “Blocked”. Legal basis: Art. 6(1)(b) GDPR.

2.8 Account backup and restore (optional)

Under “Account & data” → “Back up account” you can create a recovery code. With it you can bring your account and progress back on a new device or after reinstalling. Without a code there is no backup on our server.

• How it works: your device generates the code at random (128 bits, shown as 26 characters). From the code the device derives two independent values: a key that encrypts your progress before it is uploaded (AES-256-GCM), and a lookup value that lets the server find your backup when you restore it. The code and the key are never sent to us (the code is kept only in the app’s protected storage and therefore, if applicable, in your operating system’s backup, section 2.5); the key cannot be calculated from the lookup value. Encryption uses the cryptography built into the operating system or the built-in browser view, with no additional encryption library. If it is not available on a device, the game does not offer the backup there.
• What is inside, encrypted: your game progress (as in section 2.5, including the run recordings of your best times and of runs not yet uploaded, the purchase cache and the list of blocked players) and your account credentials (account ID, access key) so a new device can take over your account.
• What the server stores: with your account, the encrypted parts of the backup, a name for each part (e.g. “core” or the ID of a track on which you hold a best time) and a checksum, the total size, a revision number, the time of the last backup and a one-way check value (hash) of the lookup value. The server cannot read the content, and neither can we.
• When it backs up: only if you have created a code. It then backs up after changes at most every 10 minutes, when the app goes to the background and when you tap “Back up now”, uploading only the parts that changed. Without a connection, it backs up later.
• Restoring: when you enter your code on a device, the device sends only the lookup value to the server, downloads the encrypted parts and decrypts them on the device. Your account then gets a new access key; the old one stops working immediately, so a lost or old device is signed out. If the game had already created an empty account on the new device, that account is deleted. So that nobody can try out codes, the server limits attempts per IP address and answers wrong codes just as fast as correct ones.
• Lost code = no restore. Without your code we can neither read nor restore the backup, and we cannot issue a replacement code. Keep the code safe (e.g. written down or in a password manager) and do not share it: anyone who knows it can take over your account. If you copy or share the code via the share sheet, the terms of the app you pick apply.
• New code: “Create new code” replaces the old one. The backup is uploaded again with the new key, we delete the old parts, and the old code no longer works.
• Delete backup: “Back up account” → “Delete backup” removes the backup from the server immediately and the code stops working. Your progress on the device and your account stay.

Legal basis: Art. 6(1)(b) GDPR (the backup feature you switched on). Retention: until you delete the backup or your account, or until your account has not contacted the server for 24 months (section 5); after that, restoring is no longer possible even with the code.

3. No tracking

• no ads and no advertising identifiers (IDFA/Advertising ID), no App Tracking Transparency prompt, because there is nothing to track,
• no third-party analytics, crash reporting or marketing services, no cookies, no profiling,
• the app consists of the game and a slim app shell of our own. It contains no third-party software libraries (SDKs) except the respective store’s purchase interface (Apple’s StoreKit or the Google Play Billing Library) and, on Android, standard libraries (AndroidX, Kotlin runtime); none of them is used for advertising or analytics,
• the app loads no content from third-party servers (fonts and graphics ship inside the app) and connects only to our server and to the App Store or Google Play.

Apple and Google may offer to send crash and usage statistics to them and to app developers. You control this in your device settings; we only receive aggregated figures that cannot be linked to you.

4. Recipients and location

• Hosting: our server runs at Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus in Germany (European Union). The game data is kept in a database on the virtual server, which we operate ourselves. The provider processes data only on our behalf (data processing agreement under Art. 28 GDPR).
• Server backups are additionally stored, encrypted, with a storage provider in the EU. It only receives encrypted archives, cannot read them and acts only on our behalf (Art. 28 GDPR).
• Other players see the data marked as visible in section 2.2.
• Apple and Google distribute the app and process purchases (their own responsibility, see 2.4).
• Authorities receive data only where we are legally obliged, for example if Art. 18 of the Digital Services Act requires us to report a suspected criminal offence that threatens the life or safety of persons (Art. 6(1)(c) GDPR).
• We do not share data with anyone else. We do not transfer data outside the EU/EEA unless the server location above is outside it; in that case the safeguards under Art. 44 et seq. GDPR are: not applicable, the server is located in the EU. Where the hosting provider may access data from outside the EEA as part of its services, the EU Standard Contractual Clauses in its data processing agreement apply.

5. Retention

• Online data (sections 2.1, 2.2 and 2.8) is kept as long as your account exists. When you delete the account, the server removes all related data immediately. Copies in the server’s encrypted backups are overwritten after at most 30 days.
• Runs: for each track and ranking (all-time, every Weekly Cup week, every Season Cup) your best run with its recording is kept as long as your account exists. Other accepted runs are kept for 30 days as a short entry without recording (for duels). Finished duels remain visible for 14 days.
• Unused accounts (24 months without contacting the server) are deleted automatically together with all online data and the account backup. The server stores the last access only by day.
• Reports (section 2.7): open ones until our decision, closed ones for another 90 days, then deleted. When your account is deleted, we delete reports about you and remove your account ID from reports you submitted.
• Purchase verification (section 2.4): as long as your account exists; removed when you delete the account. Exception: for a refunded purchase we keep only its ID, product and refund time, without any link to an account, for up to 24 months so the same receipt cannot be redeemed again.
• Proof of deletion: so that restoring a server backup cannot bring a deleted account back, the server keeps a one-way check value of the deleted account ID with its time for up to 30 days, but without any content.
• IP addresses: only briefly in memory (section 2.3).
• Data on your device stays until you reset it in the game or delete the app.

Important: deleting the app does not delete your online account or your account backup. Delete the account in the game first (or request deletion, section 6).

6. Deleting your account and data

• In the game (immediately): Menu (☰ top left) → “Account & data” → “Delete account”. This removes your account and all online data (username, best times, ghosts, run recordings, likes, friends, blocks, duels, check results, purchase verification, account backup) from the server and then also resets the progress on your device (points, medals, shop items, settings). Your recovery code is worthless afterwards. Without an internet connection nothing is deleted. The game shows an error instead.
• Without the app: at https://hitrally.net/time-attack/delete-account.html or by email to info@obenhinaus.de with your username and the deletion code shown in the game under “Account & data”. Without a deletion code we only delete after a follow-up question that shows the account is yours. We handle requests within 30 days.
• Purchases remain on record with Apple or Google and can be restored after a reinstall with “Restore Purchases”.

7. Your rights

Under the GDPR you have the right to

• access your data (Art. 15); you can also get a copy of all online data (including your run recordings and your own reports; for the account backup only time, size and parts, because we cannot read its content) directly in the game under Menu → “Account & data” → “Export data”,
• rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20); the export is a machine-readable JSON file,
• object to processing based on our legitimate interest (Art. 21),
• lodge a complaint with a data protection authority (Art. 77), for example the authority responsible for us: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

Because we know neither your email address nor your real name, we can only match a request to an account if you give us your username and the deletion code (or short ID) from “Account & data” (Art. 11 GDPR). The easiest way is to use the functions in the game.

8. Children

HitRally has no ads, no chat and no way to exchange contact details. Only the freely chosen username and game data are stored online. The game is intended for players aged 13 and over; younger children should use the online features only together with a parent. Parents can have the account deleted at any time in the game or by email.

9. Security

• All connections between the app and the server are encrypted (HTTPS/TLS); the app does not allow unencrypted connections.
• Your account’s access key is stored only on your device; the server keeps only a check value of it. Only someone with that key can change your data.
• The account backup is encrypted on your device before it is uploaded; only someone who knows your recovery code has the key (section 2.8).
• The app only displays content from its own app package; other websites open in your device’s browser, not inside the app.
• The server can only be reached from outside via HTTPS and is administered only through an encrypted connection. It is backed up daily; the backups are encrypted and kept for at most 30 days.

10. Changes

We update this policy when the game or the law changes. The date at the top shows the current version; we announce material changes in the app.

11. Contact

3D Daniel Obenland (owner: Daniel Obenland) · Henkelgraben 21, 74360 Ilsfeld, Germany · info@obenhinaus.de