Privacy Policy
Last updated 29 July 2026
Pico Race is a racing game. This policy describes what it stores about you, why, and how to get rid of it. It is written to match what the software actually does rather than to cover every eventuality, so if something here is not listed, we are not doing it.
The short version
- You can play the whole game without an account.
- If you do sign in, we store your email address, the driver name, team and country you choose, and your results.
- There is no advertising, no third-party analytics and no tracking of any kind. Nothing is sold or shared for marketing.
- You can have your account deleted. That erases your email address and the link to your sign-in provider; results already on a record table keep only the driver name you raced under, and we will remove those too if you ask.
Playing without an account
Single-player racing, time trials and championships run entirely on your own device and send us nothing. Your driver name, team, country, settings and best laps are stored locally by the app.
For online racing you need a session. You can take a guest session, which is not linked to an email address and carries only a generated identifier and the driver name you type. Before issuing one we run a Cloudflare Turnstile check, which is there to stop automated abuse of the matchmaker; it is a challenge, not a tracker, and it does not profile you across sites.
What we store if you sign in
Sign-in is handled by WorkOS, our identity provider. You give your credentials to them, never to us — the game opens the provider’s own page in a system browser sheet and cannot see what you type into it.
| What | Why |
|---|---|
| Email address, and your name if the provider supplies it | To recognise you when you come back, and to reach you about your account |
| An identifier issued by WorkOS | To link your sign-in to your player record |
| Driver name, team name and country | These are what appear on the grid, the timing screen and the record tables. You choose all three, and none has to be your real name |
| A device label — the platform name, such as “macos” or “android” | So you can see and revoke sessions. It is not a device fingerprint and does not identify your hardware |
| A hash of your session refresh token | To keep you signed in, and to detect a stolen token. The token itself is never stored |
| Your game settings | So they follow you between devices |
| When your account was created, and when it was last used | Housekeeping, and removing dormant accounts |
What we store when you race
- Results. The circuit, the car, your finishing position, laps completed, total time and best lap, alongside the driver name, team and country you are racing under.
- Lap records. If you set a time worth putting on a record table, we store the time and a replay of the control inputs that produced it. The physics is deterministic, so replaying those inputs reproduces the lap exactly — which is how a record is verified rather than taken on trust. A replay contains steering, throttle and brake, and nothing else.
- Championship standings derived from those results.
Records and results are public within the game: that is what a leaderboard is. They show the driver name, team and country you chose, and never your email address.
Approximate location
When you look for an online race, Cloudflare tells our server which continent the request came from and roughly which longitude. We use it for one thing — putting you on a race server near you, because a race decided by latency is not a race — and we do not store it against your account.
Cookies and local storage
The browser version sets one cookie: your session, marked
httpOnly so that scripts on the page cannot read it. The
installed versions keep the equivalent in the operating system’s
own app storage. Both also use local storage for your settings, your
best laps and your profile.
There are no advertising or analytics cookies. There is no consent banner because there is nothing to consent to.
Who else handles it
| Who | What for |
|---|---|
| Cloudflare | Hosting, the database, record storage and the race servers. Cloudflare keeps standard request logs, including IP addresses, as any host does |
| WorkOS | Sign-in, and the account credentials behind it |
| Your sign-in provider, if you use one (for example Google) | Authenticating you, and telling WorkOS your email address and name |
That is the whole list. Data is processed in the countries where those providers run their edge networks, which for a globally distributed service means it may be handled outside your own.
What we do not do
- No advertising, and no advertising identifiers.
- No third-party analytics, telemetry or session recording.
- No selling or sharing of personal data.
- No profiling, and no automated decisions with legal effects.
- No access to your contacts, photos, microphone, camera or precise location. The app does not ask for those permissions.
How long we keep it
- Your account for as long as you have one.
- Sessions until they expire or you sign out, after which the stored hashes are useless.
- The short-lived record of a sign-in in progress for minutes; it expires by itself.
- Results and records for as long as they stand, because a record table with holes in it is not a record table. See below for what deleting your account does to them.
Your choices
You can change your driver name, team and country at any time from the title screen, and sign out from the app.
Deleting your account revokes every session immediately and erases your email address and the identifier linking you to your sign-in provider. What it does not do by itself is empty the record tables: a lap record and a race result carry the driver name, team and country you raced under, and those stay so that a leaderboard remains a leaderboard. They no longer point at an email address or an account. If you would rather they went as well, say so and we will remove them.
Where the law gives you rights over your data — to see it, correct it, export it, restrict its use or have it erased — you have them here regardless of where you live, and we will not ask you why.
To make any of these requests, write to privacy@picorace.net. Please send it from the address you signed in with, or tell us your driver name, so we can find the right account.
Children
Pico Race is not directed at children under 13, and you should not create an account if you are under 13 — or under 16, where your country sets the age for consent to data processing there. There is nothing stopping a younger player racing offline, which needs no account and sends us nothing.
Security
Everything travels over HTTPS. Session tokens are short-lived and signed; refresh tokens are stored only as hashes and are rotated on every use, so a reused one revokes the session rather than extending it. The game never holds our provider credentials.
No system is perfect. If you find a problem, tell us at security@picorace.net and we will not be difficult about it.
Changes
If this policy changes in a way that matters, we will change the date at the top and say so in the game before the change takes effect.