Privacy Policy

Last updated 15 October 2026

This policy explains what ApexLab, run by Jasmina Bozic (the data controller), stores about you and why. Contact: mihamihic211@gmail.com.

What we store

• Account: your email address, driver name, country flag, colour, and a scrambled (hashed) version of your password, never the password itself. If you sign in with Google, we receive your email address, name and a Google account ID.
• Sign-in: a cookie (apx_s) that keeps you signed in for up to 60 days. We store only a hash of it. It is needed for the site to work, so no consent banner is used.
• Your game data: saved tracks, game settings, your Career save, tracks you publish, ratings, reports and leaderboard lap times.
• Plays: when someone drives a shared track we count it once a day, using your account or, if you are signed out, a one-way hash of your connection’s IP address.
• Payments: Paddle.com processes payments as Merchant of Record. We never see your card details. We store the Paddle IDs of your purchase or subscription, its status and its renewal date, so we can switch Pro on and off.
• Without an account: tracks and settings are kept only in your browser’s storage, on your device.

Why

To run the game and your account (performance of our agreement with you), to keep the community fair and safe (legitimate interest), and to meet tax and accounting duties for purchases (legal obligation).

Who else handles data

• Cloudflare hosts the site and the database.
• Paddle handles payments, tax and refunds (see Paddle’s privacy notice).
• Google, only if you choose “Continue with Google”.
• Fonts and code libraries load from public content networks (Google Fonts, cdnjs, jsDelivr), which see your IP address when your browser fetches them.

We don’t sell your data and we don’t use advertising or tracking cookies.

What others can see

Your driver name, flag and colour appear next to tracks you publish and on leaderboards. Your Career save and your email address are never shown to other players.

How long

We keep your data while your account exists. Deleting your account (in the account window) erases your account, tracks, laps, ratings and Career save straight away; backups roll over within 30 days. Payment records are kept by Paddle as the law requires.

Your rights

You can see, correct, export or delete your data, and object to how we use it. Most of this you can do yourself in the account window; for anything else, email mihamihic211@gmail.com. If you are in the EU or Serbia you can also complain to your data protection authority (in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection).

Children

ApexLab is for everyone, but if you are under 16 (or the age of digital consent where you live) a parent or guardian should agree before you create an account.