Privacy
Last updated 24 September 2026
Arithmetic Racer is a small math racing game. This page describes exactly what it stores, who else sees it, and how to have it deleted. It is written to be read, not to cover anyone legally.
You can play without an account
No sign-up is required. If you never create an account, we never learn your email address or your name.
What is stored in your browser
These stay on your device in localStorage and are not passwords or
tracking cookies:
- A device ID — a random identifier so your race history survives a page refresh while signed out.
- A player ID and handle — the temporary name shown to other players in a room.
Clearing your browser data for this site removes all of them.
What is stored on the server
| Data | When |
|---|---|
| Race results — difficulty, finish time, problems attempted and correct, accuracy, longest streak, and when you played | Every race, signed in or not. Linked to your device ID, and to your account if you have one. |
| Email address, display name, and username | Only if you create an account. |
| A password hash | Only if you sign up with a password. The password itself is never stored. |
| Google account identifiers and sign-in tokens | Only if you sign in with Google. |
| Login session records, which include your IP address and browser user-agent | While you are signed in. Created and expired by the authentication library. |
| A record of each time anonymous races are moved to an account — the account id, the device ID, how many races moved, how many were left behind as too old, and when | When you create an account, even if no races moved. Kept after the account is deleted, with the account id removed. |
| Room handles and chat-free game messages | While a multiplayer room is active. Rooms are discarded after 24 hours. |
| Anything you send through the contact form — your message, the email address you give if you give one, the device ID from your browser, and your account id if you are signed in | Only when you submit the form. The device ID always goes with a contact message, so a request can be matched to the races saved against this browser — which is what makes it possible to act on one from someone without an account. Sending the form also means your sign-in cookie travels with the request, which is how the account id is known, and your IP address is counted by Cloudflare's rate-limiting service over a one-minute window so the form cannot be flooded — the address and a number, nothing else, expiring on its own. Kept until the request is dealt with. |
| A bug report — what you wrote, plus a technical snapshot taken as you send it: your browser and operating system, the identification string your browser sends with every request, your screen size, the size of the window and its pixel ratio, the page on this site — or the game screen, such as the race or the results — you came to the form from (a path only, never the query string), the app version and which release of the site was running, whether you were signed in and your account id if you were, and the device ID from your browser | Only when you submit the bug report form. All of it goes automatically — there is nothing to tick and nothing to turn off, which is why this page rather than that form is the full account of what a report carries. Sending one also means your sign-in cookie travels with the request, which is how the account id is known, and your IP address is counted by Cloudflare's rate-limiting service over a one-minute window so the form cannot be flooded — that record holds the address and a number, nothing else, and expires on its own. Kept until the bug is dealt with. |
If you create an account after playing anonymously, races from the last 7 days that are tied to your device ID are re-attributed to your account so your recent history carries over. Older races stay anonymous.
Who else sees it
- Cloudflare — hosts the game and its database. All traffic and stored data passes through their infrastructure.
- Loops — sends account emails such as the welcome and password-reset messages. Receives your email address only if you create an account.
- Google — only if you choose to sign in with Google.
- Google Fonts — the page loads its typefaces from Google's servers, which means Google receives your IP address when the page loads, whether or not you have an account. We intend to self-host these fonts to remove that.
Your data is not sold, and there are no advertising or analytics trackers.
Deleting your data
A self-service delete button is not built yet. Until it is, use the contact form to request deletion and everything tied to your account will be removed.
One deliberate friction: a form submission cannot prove who sent it, so we will contact you to confirm you control the account before deleting anything. Without that step anyone could delete anyone else's account by typing their email address into a form.
To remove anonymous race history, clear this site's browser data — that discards the device ID, after which the old rows are no longer linked to you.
Children
The game is suitable for children, and an account is never required to play. We do not knowingly collect personal information from children under 13. If a child has created an account, use the contact form and it will be deleted.
Changes
This page is updated in place when practice changes, with the date at the top revised. The game is in alpha, so expect it to change.
Contact
Questions about any of this go through the contact form.