Privacy Policy

Piano Racer is operated by Velotone LLC, a California limited liability company (“Velotone,” “we,” “us,” or “our”). Velotone is responsible for the personal information described in this policy. Where this policy says that Piano Racer collects, uses, or discloses information, it describes Velotone’s practices through the service.

For privacy questions or requests concerning your information, contact privacy@pianoracer.com.

For general questions and technical support, contact support@pianoracer.com.

By mail: Velotone LLC, Attn: Privacy, 2108 N St #4486, Sacramento, CA 95816. By phone: (442) 224-3446.

You must be at least 13 years old to create a Piano Racer account.

When you create an account, Piano Racer asks for your month and year of birth. It uses the answer only to check that you are 13 or older: the answer is not stored and is never sent to us. If the answer is under 13, no account is created, and the browser remembers that for a day so the question cannot simply be answered again.

Piano Racer is not directed to children under 13 and does not knowingly collect personal information from them. If you believe that a child under 13 has created an account or provided personal information, contact privacy@pianoracer.com. If we learn that we have collected personal information from a child under 13, we will delete the account and that information, keeping nothing about it except what the law requires us to keep.

In the iPad app, before you sign in or create an account, and when the app opens while you are signed in, Piano Racer asks Apple to share your age range (under 13, 13–15, 16–17, or 18 and over) through Apple’s Declared Age Range feature. Where the law of your region requires it, the app also asks when it opens for players who are not signed in; there, Apple may share the range without asking you. Where Apple provides them, we also receive how the range was set (for example, by you, by a parent or guardian, or confirmed by Apple) and whether your region requires age checks. You may decline to share anywhere, but where the law requires the check, declining, or a check that fails, means you cannot sign in or create an account in the app, and are signed out, until a later check succeeds. We use your age range only to decide whether you may use an account and to comply with the law. It stays in the app’s memory while the app is open and is discarded when the app closes: it is never stored on your device or our servers, and never sent to analytics or to anyone else. If it shows a player who is not signed in is under 13, guest play continues, and the app sends no product analytics for the rest of that session.

One fact does reach us. If Apple says the Apple Account on the iPad belongs to someone under 13 while a Piano Racer account is signed in, the app tells our server that, and nothing else. We then put that account on hold: no one can sign in to it, and its profile becomes private. We delete the account 30 days later unless someone shows us that its holder is 13 or older, for example a parent who was signed in on a child’s iPad. During the hold we keep only the date of the hold and the date set for deletion, not the age range, and the account no longer appears to other players anywhere.

Apple lets a parent or guardian withdraw consent for a teenager’s use of the app. So that we can respect that on the website and other devices too, the iPad app gives our server Apple’s signed record of your download of the app whenever you are signed in, and we keep only a one-way code made from that record’s download identifier, beside your account. If Apple tells us a parent has withdrawn consent for that download, we suspend the accounts linked to it in the same way, without a deletion date, until the family asks us to restore or delete them. The code is deleted with your account.

Players aged 13 to 17 get the same protections as everyone, because we treat every account as if it could belong to a teenager: profiles are private by default; we do not sell personal information, show advertising, use information for targeted advertising or profiling, or collect precise location; there is no chat or messaging; Google Analytics does not run while you are signed in; and we use account information only to run the game you asked for, keep it safe, and meet our legal duties. If you are under 18 and live in California, you can remove content you posted that other players can see: change your username or avatar, make your profile private, or delete your account in Profile settings, or ask us at privacy@pianoracer.com to remove a particular leaderboard entry or Ghost. Removal may not remove every copy, for example where another player has already saved or shared it.

Depending on how you use Piano Racer, the service may collect or process:

• Account information through Firebase Authentication, including a Firebase user identifier and, depending on the sign-in method, an email address, display name, the address of your Google profile photo (which Piano Racer does not use or show), authentication-provider information, and account-related timestamps. If you choose email-and-password authentication, the password is submitted to Firebase Authentication for verification and is not written to Piano Racer’s Firestore databases or product analytics. If you use Sign in with Apple, Apple shares your name (only the first time you sign in) and either your email address or, if you choose Hide My Email, a private relay address that forwards to it.
• Account settings, saved preferences, profile visibility, favorites, saved progress, race history, practice history, scores, player statistics, leaderboard entries, and Ghost-race performance data. Race history may include aggregate hit-quality counts (and, for races played before Polish mode was retired on October 3, 2026, stop counts) and a limited set of score-relative trouble locations. Private customization progress includes XP, level, coin balances, earned and spent coin totals, owned and equipped cosmetic items (race characters, keyboard skins, and profile looks), and reward and coin transaction records. These are used to save your progression and cosmetic purchases, and are deleted with your account.
• If you buy coins, records of each purchase: on the website, the order details and the buyer information Stripe makes available to Velotone, and on iPad, Apple’s record of the App Store purchase. “Service providers and disclosures” describes what each includes and how long it is kept.
• Profile information that you choose to make visible within Piano Racer.
• Which versions of the Terms of Service and this Privacy Policy you accepted, when you accepted them, and how you created your account. When you delete your account, we keep only that, under one-way codes made from your account and email address instead of the account or address itself, for four years, so we can show what was agreed if a dispute arises. We keep none of it for an account deleted because its holder is under 13.
• Support or privacy communications, including the contents of your message and the contact information you provide.
• Hosting, network, authentication, security, and operational information processed by Firebase and Google Cloud when you use the service. This includes Google Cloud’s logs of requests to our servers, which record each request’s IP address, browser user agent, address and timing and are kept for 30 days.
• Website-usage information collected through Google Analytics and through Piano Racer’s first-party product analytics, as described below.

Profiles are private by default. Your accepted Piano Racer friends may view your profile information and the aggregate statistics you choose to show on a private profile. If you choose Public, other signed-in Piano Racer users may also view that information. The profile information shown to other users does not include your email address, Firebase UID or other account identifier, authentication-provider details, login metadata, complete race history, or internal moderation information.

Whatever your profile setting, other signed-in players can find your username and avatar through player search, and both appear on friend requests you send and on invitation links you share, including to a signed-out person who opens your link.

Your profile picture is an avatar you choose from Piano Racer’s collection, or your initials. Piano Racer does not use or show your Google or Apple account photo. Piano Racer asks you to choose your username; if a profile is created before you do, it receives a randomly generated starter username that is not based on your name or account identifier. You can change your username and avatar in Profile settings.

Please do not send passwords, authentication tokens, or unnecessary sensitive information in support messages. In-app feedback includes your account identifier, message, submission time, app version, browser information, and current song and play mode when available. You may choose whether the team may contact you at your account email; if you do, we keep a copy of that address with your message. Feedback and internal review notes are private to authorized staff, stored in Firebase, and removed when you delete your account. Do not include sensitive information in messages.

If you report another player, we keep your account identifier, theirs, the reason you chose, anything you write (up to 500 characters), a copy of their username and avatar as they were when you reported them, the time, our review status and private notes, and the outcome we tell you, which names the player’s current username. Only authorized staff see reports, and the reported player is never told who made one. If we act on a report, the notice we send that player says that another player’s report led to our review. A report is deleted two years after we close it, or with your account if you delete it first. If the reported player deletes their account, the report remains but loses the link to that account and the copy of their username and avatar.

If you send a notice of illegal content through the form at pianoracer.com/report, with or without an account, we keep where you said the content is, why you believe it is illegal, your name and email address (which you may leave out for a notice about child sexual abuse or exploitation), your good-faith statement, the time, and our review status and private notes. A notice is not linked to any account, including yours. Only authorized staff see it, we use your details only to handle the notice and tell you our decision, and we do not tell the player concerned who sent it unless the law requires it. We may share a notice with the police or another authority where the law requires it. We keep notices as long as we need them to handle the notice, any challenge to our decision, and our legal duties. To stop the form being flooded, it counts notices from each internet address for a day, under a one-way code that is not your address and is deleted within a few days.

If you block another player, we keep a record of the two accounts and when you blocked them, so we can keep you apart, including on leaderboards and in Ghost races. Only you can see your blocked list; the blocked player is not told. The record is deleted when you unblock them or either account is deleted. Staff acting on reports may rename a player to a random username, make their profile private, or disable their account. When we do, we tell that player what we did, why, and how to contest it: in the app, or by email to the account address if the account is disabled. We keep that notice, including any earlier username, until the account is deleted. A username removed this way stays reserved so it cannot be claimed again. If the law or a safety risk prevents us from telling a player, for example while a report to child-safety authorities or an authority’s order is open, we keep the notice we would have sent as a staff-only record and give it to the player when that reason ends.

Some records are kept after an account is deleted because the law requires it or a legal claim may need them: a notice withheld for the reason above, and a legal hold, which preserves a copy of an account’s records while a dispute, an authority’s request, or a report to child-safety authorities is open. We keep each only while that reason lasts, and staff alone can see them.

When microphone input is enabled, pitch analysis is performed locally on your device. Piano Racer does not intentionally record, retain, or upload microphone audio.

Piano Racer does not retain raw MIDI messages, microphone audio, or the pitches or velocities you played. For a signed-in player’s best eligible run, Piano Racer may retain a compact Ghost replay: a checkpoint, timed to the millisecond from the start of the song, each time your progress, score, or miss count changes, with the cumulative progress, score, and miss count at that moment. This timing trace lets another race show your relative position during the song without storing audio or which notes you played. It is visible to the players who can see your leaderboard entry, as described below.

To provide private learning statistics, a race summary may also include totals for Perfect, Early, and Late hits (and, for races played before Polish mode was retired on October 3, 2026, the number of times it stopped for correction), and up to eight trouble locations expressed only as positions within the score. These summaries do not include the pitch or velocity played, exact input timestamps, audio, or raw MIDI.

Only completed, human-played runs at the song’s original tempo are eligible. Autoplay runs are excluded from Ghost replays and Leaderboards.

Piano Racer uses two separate analytics systems. This section describes the first-party system operated through Piano Racer’s own application backend. Google Analytics is described in the following section, and the two do not share data with each other.

The first-party system helps measure approximate visitor reach, page and feature usage, onboarding and gameplay progress, broad engagement, MIDI reliability, browser compatibility, and coded product errors.

This includes fixed screen and introduction milestones; the song identifier and whether it is built in or from the library; selected play mode, bot difficulty, input, sheet style, opponent, and tempo category; coarse preparation and loading times, play duration, exit-progress, and accuracy ranges; library search success or empty results; fixed account-access and connection outcomes, including which sign-in method was used; and, for a page view, the broad kind of source that led to it (for example, a search engine or another website), never the referring address. Search text is not collected. Autoplay is reported separately from human play. Events are combined into daily counts, and short-lived daily visitor values also deduplicate milestone reach.

The Piano Racer iPad app sends the same events as the website, marked as coming from the app, so we can tell the two apart; TestFlight and App Store builds of the app send them. Development and automated-test browsers, development (Debug) builds of the iPad app, administration pages, and browsers with a saved analytics exclusion do not send first-party product events. These controls reduce testing traffic but do not guarantee that all recorded visits are human.

Product analytics is separate from account-owned race history and player statistics.

Product-analytics event records do not include:

• Firebase UID, email address, username, or Google profile information
• Authentication tokens
• Raw error messages or stack traces
• Full URLs, query strings, or raw referrers
• Individual notes, microphone audio, raw MIDI, or race replays

Piano Racer does not store account identifiers in its product-analytics records.

Piano Racer uses Google Analytics 4, a web-analytics service provided by Google, to understand how many people visit, which pages and features they use, and how the site performs across browsers and devices. Google Analytics is a third-party service, and information collected through it is processed by Google under Google’s own terms and privacy commitments.

Google Analytics is enabled across the production Piano Racer website, including this page, except on player profile and invitation pages, in excluded browsers, and in a browser where someone is signed in to Piano Racer: it stops when you sign in and does not load again in that browser until you sign out. Development and automated-test visits are excluded. Google Analytics also does not load in a browser set to a time zone in the United Kingdom, the European Economic Area, Switzerland, or elsewhere in Europe. The Piano Racer iPad app does not use Google Analytics. Piano Racer does not send Google Analytics any custom events. It collects what the Google Analytics tag collects automatically, which typically includes:

• The page address you visit, including any query string, along with the page title and the referring address
• Browser, operating system, device type, screen size, and language settings
• Approximate location, such as country, region, and city, derived by Google from your IP address
• A randomly generated analytics identifier stored in a cookie on your browser, used to recognize repeat visits to Piano Racer
• Page views, session activity, and time on the site

Google receives your IP address as a necessary part of the network request. Google states that it uses the IP address to derive approximate location and does not store IP addresses in Google Analytics. Piano Racer does not have access to raw IP addresses through Google Analytics.

Unlike the first-party system described above, the Google Analytics tag reports the full page address of the pages where it runs. Because profile links contain a username and invitation links contain a friend-invite token, Google Analytics does not run on profile or invitation pages. When you reach another page from one of them, the referring address is reported with the username or token replaced by a placeholder. Piano Racer does not send Google Analytics your email address, Firebase UID, username, authentication state, authentication tokens, individual notes, microphone audio, raw MIDI, or race replays.

Piano Racer has disabled Google Signals and advertising personalization for its Google Analytics property. Piano Racer does not use Google Analytics for advertising, remarketing, audience building, or cross-site behavioral advertising, and does not link Google Analytics data to a Piano Racer account.

Google Analytics stores event-level data for a limited period configured in the Google Analytics property, after which Google retains aggregate reporting information. Google’s handling of this information is described in Google’s Privacy Policy and in Google’s documentation on how it uses data from sites that use its services.

You can save an exclusion from both Google Analytics and first-party product analytics for this browser on our browser exclusion page. The preference applies across networks but must be set separately in each browser and may be lost when you clear site data or use private browsing. It does not remove past data or affect account-owned race history and statistics. You can also prevent Google Analytics from collecting information about your visit using browser controls, tracking-protection features, content blockers, or Google’s own Google Analytics opt-out browser add-on. Clearing your browser’s cookies removes the Google Analytics cookies described below, though they may be set again on a later visit.

The first-party product analytics described above measures aggregate reach and product use without account identifiers.

The product-analytics database does not store raw IP addresses or raw browser user-agent strings. Network and hosting providers necessarily process request information to deliver and secure the service.

To estimate approximate daily visitors, Piano Racer may temporarily combine the current UTC date, request IP address, a coarse browser category (for the iPad app, the app itself), a device category, and a server-side secret. This creates a short-lived pseudonymous value used only to reduce duplicate counting during the same day.

That value rotates daily, expires after approximately 48 hours, is not sent to the browser, and is not connected to a Firebase UID, email address, or username. It is not used to deliberately recognize anonymous visitors across different days.

Visitor totals are approximate. Shared networks, VPNs, mobile-network changes, privacy relays, and similar factors may cause one person to be counted more than once or multiple people to be counted together.

Piano Racer’s analytics system is designed to record only approximate country and first-level regional information, such as a U.S. state, when that information can be obtained from trusted infrastructure.

When reliable geographic information is unavailable, the system records the location as unknown. The current hosting platform does not provide trusted location information, so first-party analytics currently records every location as unknown. Piano Racer does not accept browser-supplied country or state values for this purpose and does not collect GPS coordinates or precise location through product analytics.

From the moment you start to sign in or create an account, and while you are signed in, Piano Racer uses Google reCAPTCHA Enterprise, through Firebase App Check, to help confirm that requests to our servers come from the genuine Piano Racer website rather than from automated software. This protects leaderboards, rewards, purchases, and other players from abuse.

To do this, reCAPTCHA collects information such as your IP address, browser and device characteristics, cookies, and how you interact with the page, and sends it to Google, which uses it to estimate whether the request is automated. Piano Racer receives only that assessment, not the underlying information, and does not connect it to your race history or statistics. Google processes this information on Piano Racer’s behalf, as our service provider, to deliver the check.

reCAPTCHA does not run for visitors who never start to sign in, and Piano Racer does not use it for analytics or advertising. It is not used in the Piano Racer iPad app.

The iPad app protects the same features with Apple’s App Attest service instead, through Firebase App Check, from the moment you start to sign in. Your iPad creates a cryptographic key in its secure hardware, Apple certifies that the key belongs to a genuine copy of the Piano Racer app on a genuine Apple device, and Firebase checks that certification before our servers accept the request. App Attest does not tell Piano Racer who you are, and the check is not connected to your race history or statistics.

Piano Racer does not show advertising and does not use analytics for advertising.

Piano Racer uses one external analytics provider, Google Analytics, as described above. Google Analytics stores a persistent analytics identifier in a browser cookie. Piano Racer has disabled Google Signals and advertising personalization for that property.

Piano Racer does not use an advertising pixel, a session-replay service, or a cross-site behavioral advertising system, and does not use browser fingerprinting to track or identify you. Google reCAPTCHA, described above, evaluates browser and device signals only once someone starts to sign in, to protect the service from automated abuse.

This policy will be updated before materially different tracking or advertising technology is introduced.

Piano Racer uses information to:

• Create and authenticate accounts
• Keep users signed in
• Operate and secure the service
• Save requested settings, preferences, and progress
• Store race history and calculate player statistics
• Provide song Leaderboards and asynchronous Ghost races
• Provide profile and social features that are actually enabled
• Respond to support and privacy requests
• Deliver coin purchases and handle refunds, payment disputes, and financial records
• Detect abuse, fraud, and security threats
• Diagnose technical problems
• Measure aggregate product use
• Improve gameplay, reliability, accessibility, and performance
• Enforce the Terms of Service
• Comply with applicable legal obligations

Piano Racer does not sell personal information or share it for cross-context behavioral advertising.

Firebase Authentication uses browser storage to keep you signed in across page refreshes and ordinary browser restarts.

Piano Racer may also use browser storage for features you request, such as local settings, favorites, appearance, race-setup and practice settings, interface and audio preferences, microphone calibration, whether a MIDI device has connected before, and a flag that lets guests return to the menu. We also remember whether you completed or skipped the introduction on this browser, any analytics exclusion preference you choose, whether someone is signed in (so Google Analytics stays off), and, for a day, that the account age question was answered under 13. None of these is an identifier or an age.

While you are signed in, Firebase keeps an offline copy of account data the app has loaded, such as your favorites, race history, coin balance, and your own profile, in your browser’s IndexedDB storage so the app loads quickly and uses fewer database reads. Piano Racer deletes this copy from the browser when you sign out or delete your account, including when you sign out in another tab. If the browser prevents the deletion or the page closes before it finishes, the copy can remain until you clear this site’s data in your browser settings.

Clearing browser data, using private-browsing mode, changing browser privacy settings, signing out, or revoking a session may remove or prevent locally stored settings or authentication persistence.

Google Analytics sets cookies on your browser, named _ga and _ga_ followed by a property identifier. They store a randomly generated analytics identifier used to recognize repeat visits to Piano Racer, and they persist for up to about two years unless you clear them. They are set for the Piano Racer domain and are not used for advertising. You can remove them by clearing your browser’s cookies or by using the browser controls described above.

Once you start to sign in, Google reCAPTCHA may store cookies or similar data in your browser to perform the security check described in “Abuse protection.” Firebase App Check also keeps the short-lived token that results from that check in your browser’s storage until it expires.

The first-party product analytics system counts introduction milestones, such as verifying an input or completing the lesson, without collecting which notes you played. It does not create analytics cookies, a persistent analytics visitor ID, a persistent analytics event queue, or a local anonymous profile. It does not use localStorage, sessionStorage, IndexedDB, authentication state, or another persistent browser mechanism to recognize anonymous analytics visitors across days.

When coin packs are offered on the website, they are sold through Link: Sold through Link, LLC, a Stripe company, is the merchant of record, and Stripe processes the payment. At checkout, Stripe and Link collect your email address, name, billing address, payment details, any phone number or tax ID you provide, and device/network data. They use this information to take the payment, calculate and remit tax, send receipts, provide payment support, handle refunds and disputes, and prevent fraud, as described in Stripe’s Privacy Policy and the Sold through Link Terms.

Under those terms, Stripe makes order information available to Velotone LLC in its Stripe account: your name, email address, phone number, billing address, limited payment-method details (for example, card type and last four digits), any tax ID, and order details such as the date, price, and tax. Piano Racer does not receive or store full card numbers or security codes. Velotone uses this order information only to deliver purchases, answer purchase and refund requests, handle payment disputes and fraud, keep accounting and tax records, and comply with law, and does not copy it into Piano Racer’s own database. That database keeps an account-linked order reference, pack and coin amount, currency and payment total, payment/session identifiers, receipt link, purchase consent versions and timestamps, refund/dispute status, and, for a payment refused because its billing address is in a country where the website does not sell coins, that country. Stripe receives the order reference, a one-way value that cannot identify your account without our records, and not your Piano Racer username, game history, or Firebase account ID.

In the Piano Racer app for iPad, coin packs are sold through Apple’s App Store. Apple takes the payment from your Apple Account, and Velotone does not receive your payment details or your Apple Account information. With each purchase, the app gives Apple a purchase token: an identifier derived from your Piano Racer account, the same for all of its purchases, that cannot identify you without our records. Apple returns a signed record of the purchase, and tells our server directly when it refunds a purchase or reverses a refund. We keep with your order Apple’s transaction identifiers, the product, the price and currency charged, the App Store country, the purchase date, the purchase token, whether it was a test purchase, and any refund, and use them to deliver coins, apply refunds, prevent fraud, and keep financial records. Apple uses the information it collects as described in Apple’s Privacy Policy.

Piano Racer uses Firebase and Google Cloud for authentication, database services, Cloud Functions, hosting, network delivery, security, and operational logging. Piano Racer currently has no user file-upload feature.

Piano Racer uses Google Analytics, provided by Google, for website analytics as described above. Your browser contacts Google directly to load the analytics tag, so Google necessarily processes ordinary network-request information, which may include your IP address, browser and device information, and the address of the page you are viewing.

From the moment you start to sign in, and while you are signed in, Piano Racer uses Google reCAPTCHA Enterprise through Firebase App Check to protect the service from automated abuse, as described above. Your browser sends reCAPTCHA information to Google directly.

If you sign in with Google in the iPad app, Google’s sign-in software runs in the app and collects what Google says it needs to sign you in securely and to measure how that software works, such as an identifier for your Google account, information about the device and its use of the sign-in software, and your IP address, from which Google may estimate your general location to prevent fraud. Google uses this under its own privacy policy; Piano Racer receives only your name, email address and Google account identifier.

Apple provides Sign in with Apple, if you choose it, and the App Attest check and the age range in the iPad app described above. Apple processes the information involved under Apple’s own terms and privacy policy. If you choose Hide My Email, messages we send to your relay address pass through Apple’s private email relay.

Our email addresses run on Google Workspace and our phone number on Google Voice, so Google holds the messages, calls, voicemails and texts you send us.

These providers process information to provide and protect their services under their applicable service terms and data-protection commitments.

Piano Racer may also disclose information when reasonably necessary to comply with law, respond to valid legal process, protect the rights or safety of Piano Racer, its users, or others, investigate fraud or abuse, enforce the Terms of Service, or complete a merger, acquisition, financing, reorganization, sale, or transfer involving Velotone or Piano Racer. If Piano Racer is transferred, information will remain subject to this policy unless you are notified otherwise.

Piano Racer does not authorize service providers to use account information for behavioral advertising through Piano Racer.

Piano Racer keeps at most one best eligible performance for each player, song version, play mode, and set of scoring rules. A newer performance replaces that record only when it ranks higher. When we change how a mode is scored, records made under the earlier rules stop appearing on leaderboards and as Ghosts, and are kept until you delete your account. The stored record includes the summarized result and the compact checkpoints described above; it is separate from immutable race history so the replay is not stored twice.

A Public profile may appear on the Global leaderboard and its Ghost may be selected by other signed-in players. A Private profile does not appear globally. Your accepted friends may see your leaderboard entry and select your Ghost in the Friends view even while your profile is Private. Changing your profile to Private removes Global access, and removing a friend ends that player’s friend-based access.

Ghost data is downloaded before a race and used locally while the race runs. Piano Racer does not read Firestore continuously during gameplay.

Piano Racer keeps information only as long as it needs it for the purposes in this policy. These are the periods:

• Your account and what it holds, including your profile, progress, race history, statistics, favorites, coins and cosmetics, friendships, and best Ghost and leaderboard records: until you delete your account. We may also delete an account that no one has signed in to for three years, after emailing its address at least 30 days before.
• What you agreed to: four years after you delete your account, in the minimal form described above.
• Friend invitation links: they stop working 14 days after you create them and are deleted after that.
• Player reports: two years after we close them, or until the player who made the report deletes their account, if that comes first. Notices about our moderation decisions sent to you: until you delete your account. Notices of illegal content: one year after we close them.
• Records kept for a legal reason, such as a withheld notice or a legal hold: as long as that reason lasts. A copy kept because of a report to child-safety authorities: one year, or longer if the authorities ask us to keep it.
• Coin purchase records: seven years from the purchase, as described below.
• Emails, calls, voicemails and texts to our support and privacy contacts: two years after your last message, or longer while they are evidence of a request or dispute. Our log of privacy requests: three years after we close each request.
• Google Cloud’s logs of requests to our servers, which include IP addresses: 30 days. Database backups: up to 14 days, so a deleted account can remain in a backup until it expires.
• Temporary analytics visitor-deduplication values: about 48 hours. Aggregate product metrics contain no Firebase UIDs, email addresses, or usernames and are kept to compare use over time.

Google Analytics keeps event-level data for 14 months, the period set for the Piano Racer property, and keeps aggregate reporting information after that under Google’s own practices. Because Piano Racer does not link Google Analytics data to an account, Piano Racer cannot identify or delete an individual visitor’s Google Analytics records.

You may edit supported profile information and choose between Private and Public visibility through the service. You may remove a friend at any time, which ends that person’s friend-based access to your private profile.

You may request account deletion through account settings or by contacting privacy@pianoracer.com.

Account deletion deletes the active Firebase Authentication account and associated active Piano Racer records, including applicable saved progress, race history, player statistics, song statistics, Ghost replays, leaderboard entries, settings, preferences, favorites, coin balances and cosmetics, feedback and the player reports you made, friendships and invitations, blocks you made and blocks of you, and public profile information. If you signed in with Apple, Piano Racer also tries to have Apple revoke its access to your Apple ID, after you confirm with Apple once more; if Apple cannot, you can remove Piano Racer in your Apple Account settings.

Financial order and payment reconciliation records are retained separately for up to seven years from checkout creation (for App Store purchases, from the purchase date) for accounting, fraud prevention, and disputes, with automated expiration configured in our database. Account deletion removes the direct account ID from these orders; a hashed account reference remains for payment replay and deletion protection. These are restricted financial records, not anonymous data. Stripe and Link retain their own payment records, including the order information available to Velotone in its Stripe account, under their legal obligations and retention policies. Under the Sold through Link Terms, you can ask Link to delete your purchase information, and Stripe then removes it from Velotone’s Stripe account as well. Apple retains its own records of App Store purchases. A website payment completed after its account has been deleted is refunded instead of recreating the account’s wallet; Velotone cannot refund App Store purchases, so an App Store purchase not yet delivered when its account is deleted is refunded only if you ask Apple. Deleting an account that never started a website checkout leaves a hashed account reference marked as deleted for 30 days, so that a checkout started at the same moment cannot recreate the account; any App Store orders it made are kept as described above.

Provider operational logs, separately retained support or legal records, and any copies in ordinary provider backup systems may remain where reasonably necessary for security, legal compliance, dispute resolution, enforcement of the Terms, or backup expiration.

Aggregate product metrics may remain because they do not contain Firebase UIDs, email addresses, or usernames and are not designed to be linked back to an account.

Piano Racer may take reasonable steps to verify that you control the relevant account before fulfilling an access, correction, or deletion request.

Piano Racer does not sell personal information and does not share personal information for cross-context behavioral advertising. Google Analytics is used for website analytics only, with Google Signals and advertising personalization disabled, and Piano Racer does not use it to build advertising audiences or to serve advertising.

You may prevent Google Analytics collection using the browser controls described above.

You may contact privacy@pianoracer.com to request access to, correction of, or deletion of information associated with your account. Piano Racer may take reasonable steps to verify the request.

Certain information may be retained where reasonably necessary for security, fraud prevention, compliance with law, dispute resolution, enforcement of agreements, or ordinary backup expiration.

Piano Racer does not disclose personal information to third parties for their own direct-marketing purposes.

Additional rights may apply under California or other applicable law depending on the circumstances. Piano Racer will respond to legally applicable requests as required and will not discriminate against you for exercising a privacy right.

Velotone LLC is the controller of your personal information, at 2108 N St #4486, Sacramento, CA 95816.

We rely on these legal bases:

• Our contract with you (the Terms of Service): to run your account and the features you ask for, including sign-in, saved progress, race history, statistics, friends, profiles, leaderboards, Ghost races, favorites, coins and cosmetics, and purchases where offered.
• Our legitimate interests in a safe, fair, working service, weighed against your interests: abuse protection, cheat checks and rate limits; the username filter, player reports, blocks and moderation; operational logs; aggregate product analytics, which set no cookies; the iPad app’s age check; and keeping financial records and complying with US laws that apply to us. Google Analytics does not run for browsers set to a European time zone.
• Your consent: letting our team contact you about feedback you sent. You can withdraw it at any time.
• Legal obligations under UK or EU law, such as answering a lawful request from an authority there and handling notices of illegal content.

You have the right to access your information, correct it, delete it, receive it in a portable format, restrict how we use it, and object to uses based on our legitimate interests. You can correct your username and avatar, make your profile private, and delete your account yourself in Profile settings. For a copy of your information, or anything else, contact privacy@pianoracer.com. We answer within one month (30 days in Switzerland) and may ask you to confirm that the account is yours.

We make no decisions about you with legal or similarly significant effects by automated means alone. The username filter automatically refuses some names; you can choose another, and contact us if you think it refused one wrongly.

Velotone is in the United States, so we receive your information there. Our service providers protect information transferred to the United States under the EU–US Data Privacy Framework, its UK Extension, or the Swiss–US Data Privacy Framework where they are certified, or otherwise under the European Commission’s standard contractual clauses and the UK’s addendum to them. Contact us for details.

Accounts are for players 13 and older. Teenagers get the same protective defaults as everyone: profiles are private, and there is no advertising or marketing profiling. We do not collect your precise location, and we do not record your general location ourselves; Google’s sign-in software in the iPad app may estimate it from your IP address to prevent fraud, as described above.

You may complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the authority in your country; in Switzerland, the Federal Data Protection and Information Commissioner. We would appreciate the chance to resolve your concern first.

Some browsers offer a “Do Not Track” setting.

There is no consistent industry standard for how a site must respond to that signal, and Piano Racer does not currently change its analytics practices in response to it. The browser controls and opt-out add-on described above do prevent Google Analytics collection.

Piano Racer does not use analytics for cross-site tracking or behavioral advertising. The Google Analytics cookie is set for the Piano Racer domain, and Google Signals and advertising personalization are disabled for the Piano Racer property, so Piano Racer does not use Google Analytics to follow you across unrelated websites. Piano Racer does not permit advertising networks to track your activity across unrelated websites through Piano Racer.

Firebase, Google Cloud, and Google Analytics process request and service information as described in this policy, and Google’s own use of the information it receives is governed by Google’s terms and policies.

Piano Racer uses safeguards designed to protect information, including access controls, authentication, server-side validation, restricted database rules, data minimization, provider security features, and separation between account records and aggregate product analytics.

No website, database, transmission method, or storage system can guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for signing out of devices you do not control.

Velotone is based in the United States. Firebase, Google Cloud, Google Analytics, Google reCAPTCHA, Google Workspace and Google Voice, Apple, and Stripe (including Link) may process information in the United States and other locations where they operate.

Information may therefore be processed outside the state, country, or region where you live, subject to the service providers’ applicable contractual and data-protection safeguards.

The section for the UK, the EEA, and Switzerland describes the safeguards for information from those places. This policy does not represent that every jurisdiction’s privacy law necessarily applies to Piano Racer. Where a privacy law legally applies, Piano Racer will respond to applicable requests and obligations as required.

Piano Racer may update this Privacy Policy as the service changes.

An updated policy will include a revised effective date. When appropriate, Piano Racer may also provide notice through the service or request additional acknowledgement or consent where required.

Published historical versions are retained in project records.