Draft for legal review. Check it against the data-protection laws where you launch (for example the NDPA in Nigeria and the GDPR in the EU) before launch.
Privacy Notice
This notice explains what Fly Roadstar collects, why, and what you can do about it.
What we collect
- Account: username, email, a salted scrypt hash of your password, your 18+ confirmation, settings and cosmetics.
- Gameplay: the inputs of each run (when you pressed and released), the course seed, score, distance, Cores, quests, check-ins, duels and crates. We need the inputs to verify runs and to show ghosts in duels and on the Daily Course.
- Wallet and rewards: the public wallet address you link (on Robinhood Chain), the sign-in message you signed (Sign-In with Ethereum) and its signature, the address’s $FRS balance history read from the public blockchain, your points, credits and balance, and each claim you make with its transaction. Signing the sign-in message only proves the wallet is yours: it moves no funds and costs nothing.
- Purchases: what you bought, its price and how it was paid: from your balances (how much came from In-game $FRS and how much from $FRS you won), or the exact $FRS amount and the transaction that paid it from your wallet.
- Orders for In-game $FRS: the pack, its price and currency, the payment provider (Stripe or Paystack) and its session and payment references, the order’s status, any refund or chargeback, and when you asked for immediate delivery (your acknowledgement of losing the 14-day right to cancel). For Paystack, an email address for the receipt if your account has none; it is kept on that order only. Stripe and Paystack collect your card or bank details on their own pages: we never see them.
- Ads: for each ad the game tries to show, its placement (after a match, before one, or a rewarded offer), the ad provider, whether it was viewed, dismissed or unavailable, and how long it took (“ad events”), tied to your account; and the rewards you claimed for rewarded ads (a revive, Bolts or a Fuel Cell) with their tickets. We use these to keep ads within their limits and to spot abuse.
- Security: your IP address and user agent for rate limits, fraud checks and session records.
Why
To run your account, verify runs, match duels, sign your claims, credit your purchases and orders, handle refunds and chargebacks, keep ads within their limits, stop cheating and keep the service secure. We don’t sell personal data.
Who else sees it
Our email provider for password resets and wallet-change alerts, our hosting provider, the key service that holds our claim-signing key (AWS KMS, which sees the claims it signs), and our payment providers when you buy In-game $FRS: Stripe (cards, Apple Pay, Google Pay) and Paystack, each under its own privacy policy. Leaderboards and duels show your username, distance, paint and nameplate. For your wallet:
- RPC providers connect us to Robinhood Chain: Alchemy, with a second provider as a backup (QuickNode or Chainstack; we name the one we use here before launch). Our servers use them to read balances, payments and claims and to send claims, so they see the wallet addresses and transactions we look up or send. In your browser, the game reads balances and receipts through Robinhood Chain’s public RPC or a provider key of ours limited to the game, which sees your IP address and the addresses the game looks up.
- Reown (the WalletConnect service) relays the connection between the game and a wallet app on your phone or another device, when you connect that way: by QR code or by a link that opens your wallet. It sees connection data such as your IP address, and checks the game’s web address so your wallet can show it is genuine. Reown’s own privacy policy applies.
Ads and consent
- House ads are our own cards (for example No Ads or the Daily). They use no personal data and need no consent.
- Google ads (H5 Games Ads, part of Google AdSense) are only loaded for players who have confirmed they are 18 or older. Until you do, the game never loads Google’s ad script, so no Google request, cookie or consent message reaches you. After you confirm, Google may use cookies and device data to show and measure ads. In the EEA, the UK and Switzerland, Google’s certified consent message asks for your choices first, and “Privacy choices” in Settings lets you change them at any time. Google’s own policies apply to what it collects.
- Versions of the game published on a game portal (CrazyGames, Poki or GameDistribution) show that portal’s ads under its own consent tools and privacy policy.
- No ad ever gives points or $FRS.
Wallet addresses, claims and payments are public on Robinhood Chain by design: anyone can see them on a block explorer such as Blockscout, and they can’t be changed or deleted, by us or anyone. Your wallet app (Robinhood Wallet, MetaMask, Trust Wallet or another) and its own network provider see what you sign and send; their privacy policies apply. Robinhood Chain’s operators see the transactions sent to it, as every network’s operators do. This website loads no third-party scripts. The “Get the $FRS token” link opens an exchange in a new tab, and that exchange’s own policies apply.
Cookies
One session cookie keeps you signed in. The game also stores your settings (some per device, like landscape matches and Training speed), equipped cosmetics and an unfinished checkout in your browser. Google may set its own ad cookies, but only after you have confirmed you are 18 or older and, where the law requires it, given your consent.
How long
Account data stays until you delete your account. Run records, the reward ledger, purchases and orders for In-game $FRS are kept, without your username or email, for as long as needed for accounting, tax, refunds and fraud prevention. Ad events are deleted after 90 days, and unused rewarded-ad tickets after 7 days. What is on the blockchain stays there: deleting your account doesn’t remove your wallet’s public transactions.
Your choices
Delete your account in Settings. Change your ad choices with “Privacy choices” in Settings (after the 18+ confirmation, where Google ads are shown), or remove ads between matches with No Ads. Ask us for a copy of your data or to correct it through the official channels linked from this site.