Privacy Notice

Accounts and Google sign-in

We use your game username, email address, password hash and account records to provide access to the game. When you connect Google, we receive your Google account identifier and verified email address. We use these to identify your linked account, verify your email and support sign-in and password recovery.

We do not receive your Google password or request access to your Gmail inbox, contacts or files. Google access tokens are used only during sign-in; we do not request offline access or retain refresh tokens. Google account information is not sold or used for advertising.

New registrations require Google linking and a verification code sent to the returned email address. Existing accounts can keep using their game credentials. Google data is handled in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

Email and payments

We send account verification, password recovery, security notices and confirmed top-up notifications from [email protected]. This sender is not a customer-support inbox.

PayMongo processes checkout payments. Our service keeps the order, amount, Cash Points, payment references and credit status so we can credit accounts and investigate payment issues. Card credentials are entered with the payment provider, not stored by this website.

Game activity and security

We retain game profiles, inventory, race results, reports, connection records, IP addresses, timestamps and moderation records to operate the service and investigate abuse. Player names and race results may appear in rankings and race announcements. Device-related collection is described in our Game Use & Security Policy.

Access to private account records is restricted to authorized operators. Hosting, network-protection, email and payment providers process information needed to deliver their services. Google handles authentication under its own privacy policy.

Retention and your choices

Verification codes expire after ten minutes and password-reset links after fifteen minutes. Pending email content is encrypted and erased after successful delivery or expiry. Email delivery records are retained for thirty days; identity audit events for up to 180 days. Account links remain until the account or link is removed. Transaction and moderation records may be retained longer for disputes, security investigations and applicable obligations. Backups may retain earlier records until they expire.

You can revoke Google access for the app through your Google Account permissions. Revoking access does not itself delete your Crazy Kart account or previously stored records. To request access, correction, unlinking or deletion, contact an Administrator privately through the official Crazy Kart Discord. We will verify account ownership before making account changes.