Privacy Policy

Last updated: November 13, 2026

This Privacy Policy explains how Math Racer ("we", "us", "our") collects, uses, and protects information when you use mathracer.com (the "Service"). It also describes the rights you have under the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA (collectively, "CCPA/CPRA"), as well as similar laws in Canada (PIPEDA), Brazil (LGPD), and other jurisdictions.

1. Information we collect

Information you provide

  • Account information — when you create an account, we collect your username, email address, and password (stored hashed). If you sign in with Google, we receive your email and basic profile information from Google.
  • Gameplay data — game results, problems answered, timing, ratings, and similar metrics you generate while playing.
  • Communications — anything you send us by email or support form.

Information collected automatically

  • Device and connection data — IP address, browser type and version, operating system, device type, language, time zone, and referring URL.
  • Usage data — pages viewed, features used, session timestamps, errors encountered.
  • Cookies and identifiers — see the Cookies section below.

2. How we use information

  • Provide and operate the Service (matchmaking, leaderboards, account management).
  • Maintain security, prevent fraud and abuse, and enforce our Terms.
  • Diagnose technical issues and improve performance.
  • Communicate with you about your account, security, or changes to the Service.
  • Process subscription payments (see Payments).
  • Comply with legal obligations.

3. Cookies and similar technologies

We use cookies, local storage, and similar technologies for the purposes described below. You can clear or block cookies in your browser settings; blocking strictly necessary storage will degrade parts of the Service. If you are in the EEA, UK, Switzerland or California, a consent banner appears on your first visit, and you can change your choice at any time with the "Privacy & cookie settings" link in the page footer.

Category Purpose Examples
Strictly necessary Required for the site to work — sign-in sessions, security, load balancing. These cannot be turned off. Auth tokens in localStorage, session cookies, CSRF tokens.
Functional Remembers your preferences (e.g. theme, last-used game mode). Theme selection, lastGameType in sessionStorage.
Analytics Helps us understand how the Service is used so we can improve it (PostHog, first-party). Visitors without an account are measured without any persistent identifier (in-memory only; no analytics cookie is set); signed-in users are measured with a persistent identifier tied to their account. PostHog identifiers (signed-in users only).
Advertising Used by Google and its advertising partners to show, limit and measure ads on our written guides and article pages, and to personalise ads where you have consented or the law allows. See Advertising. Google advertising cookies and identifiers (e.g. __gads, __gpi), set only on pages that display ads.

4. Advertising

We display ads served by Google AdSense on our written guides, articles and similar content pages. We do not show ads on gameplay screens, sign-in pages or account pages.

  • Third-party vendors, including Google, use cookies and similar technologies to serve ads based on your prior visits to this site and other sites on the internet.
  • Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.
  • You can opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalised advertising at www.aboutads.info.
  • To learn how Google uses data from sites that use its services, see How Google uses information from sites or apps that use our services.
  • In the EEA, UK and Switzerland, ads are shown and personalised only according to the choices you make in the consent banner, which uses a consent management platform certified under the IAB Transparency & Consent Framework. In other regions you can still use the footer link to review or change your choices.
  • We do not pass your name, email address or account details to Google for advertising. The Service is not directed to children, and ad requests are not made with knowledge that the visitor is a child.

5. Payments

Optional paid subscriptions ("Math Racer Plus") are processed by Stripe. Your card details are entered on Stripe-hosted pages and never touch our servers; we receive and store only your subscription status, plan, billing period dates, and a Stripe customer reference. See Stripe's Privacy Policy.

6. Third-party services

  • Stripe — subscription payment processing. See Stripe's Privacy Policy.
  • PostHog — first-party product analytics (usage measurement, funnels, retention). See PostHog's Privacy Policy.
  • Google AdSense — serves and measures advertising on content pages (see Advertising). See Google's Privacy Policy.
  • Google OAuth — if you sign in with Google, Google authenticates you and shares your email/profile data with us.
  • Hosting and infrastructure — our servers process the data described above to deliver the Service.

We do not sell personal information for money. Advertising cookies set by Google and its partners can count as "sharing" for cross-context behavioral advertising under some laws; see California rights for how to opt out.

If you are in the EEA, UK, or Switzerland, we rely on the following legal bases under the GDPR / UK GDPR:

  • Contract — to provide the Service you've requested (e.g. account, matchmaking).
  • Legitimate interests — to keep the Service secure, prevent abuse, and improve it. We balance these interests against your rights.
  • Consent — for advertising cookies and personalised ads (collected through the consent banner) and for other optional features that require it (e.g. marketing email reminders, which are off by default and carry a one-click unsubscribe). You can withdraw consent at any time.
  • Legal obligation — where we must process data to comply with applicable law.

8. Your rights (EEA / UK)

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your data ("right to be forgotten").
  • Restrict or object to processing.
  • Data portability — receive your data in a portable format.
  • Withdraw consent at any time, without affecting prior lawful processing.
  • Lodge a complaint with your local data protection authority.

To exercise these rights, email us at admin@mathracer.com.

9. California rights (CCPA/CPRA)

If you are a California resident, you have the following rights:

  • Right to know what personal information we collect, use, disclose, sell, or share, and the categories of sources and recipients.
  • Right to delete personal information we have collected from you (subject to legal exceptions).
  • Right to correct inaccurate personal information.
  • Right to opt out of "sale" or "sharing" of personal information, including cross-context behavioral advertising. We honor the Global Privacy Control (GPC) signal as a valid opt-out request.
  • Right to limit use of sensitive personal information (we do not use sensitive personal information for inferring characteristics).
  • Right to non-discrimination for exercising these rights.

We do not sell personal information for money. Because ads on our content pages are served by Google using cookies, that activity may be considered "sharing" for cross-context behavioral advertising. To opt out, use the "Privacy & cookie settings" link in the page footer, turn on Global Privacy Control in your browser, or opt out in Google Ads Settings. You will still see ads, but they will not be personalised. If you have any question about your data, email us at admin@mathracer.com.

Categories of personal information collected in the past 12 months: identifiers (account ID, email, IP address), internet/network activity (usage data, device info), gameplay records, approximate geolocation derived from IP, and (for subscribers) billing status received from our payment processor. We disclose data only to the service providers listed in Section 6, acting on our behalf, and to Google for advertising as described in Section 4.

10. Canada (PIPEDA)

If you are in Canada, you have the right to access and correct your personal information and to withdraw consent at any time. Quebec residents additionally have the right to data portability under Law 25. Contact us at admin@mathracer.com to exercise these rights.

11. Children's privacy

The Service is not directed to children under 13 (or under 16 in the EEA / UK). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at admin@mathracer.com and we will delete it.

12. Data retention

We retain account data for as long as your account is active, and gameplay records for as long as needed to power leaderboards and statistics. We delete or anonymize data when retention is no longer necessary, or upon a valid deletion request, except where we are legally required to keep it.

13. Security

We use industry-standard technical and organizational measures (encryption in transit, hashed passwords, access controls) to protect your data. No system is perfectly secure; we cannot guarantee absolute security.

14. International data transfers

The Service is operated from the United States and your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses to transfer data internationally.

15. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date at the top. Your continued use of the Service after a change constitutes acceptance of the updated policy.

16. Contact

For privacy questions or to exercise your rights, email us at admin@mathracer.com. See also our Terms of Service.