OVERDRIVE — Privacy Policy

Effective date: 5 October 2026 Applies to: the OVERDRIVE game for iOS, iPadOS and Android (`al.max.overdrive`), version 0.1.0 and later Provided by: Maxal (“we”, “us”) · contact: `[email protected]`

This policy explains what information OVERDRIVE collects, why, where it is kept, for how long, and the controls you have. OVERDRIVE has no advertising and no in-app purchases, does not ask for your real name or your age, and does not sell your information to anyone.

1. What we collect

When you start the game (a guest account)

OVERDRIVE creates an account for you automatically, so you can race straight away.

A device sign-in identifier. It is made from your device’s identifier for apps (on iOS, the identifier for this vendor; on Android, an identifier derived from the device’s Android ID), or a random identifier if that is not available. It is used only to sign your guest account back in.
A player ID and a username. The player ID is assigned by our server. Guests get a starter name like Driver1234, which you can change.

If you register an account

Your email address, a username (3–14 characters, unique across Maxal games) and a password. We never store the password itself, only a one-way (bcrypt) hash of it.
Registering links these to your existing guest account, so your progress is kept.

While you play

Your game progress: coins earned and spent, XP and level, the cars, parts and wraps you own, how each car is painted and fitted, your equipped streak, best lap times, and race counts (races, wins, podiums).
Race results. In an online race, our race server sees your car’s inputs and position, and the results it reports for the leaderboards and your coins.
Social information, if you use it: your friends list, friend requests, private-room invites, and whether you are online or in a race. Friends lists are shared across Maxal games.
Leaderboard entries: your username with your level/XP, wins and best laps.

Technical information

IP address. Your device’s IP address is necessarily seen by our servers when it connects. The race server keeps it in memory only for the duration of a race. Our account server uses a one-way hash of it (not the address itself) to limit abusive requests, such as repeated password attempts.
Push notification token (only if you allow notifications): a token from Apple or Google that lets us send a notification to your device. We store up to five, one per device.
Server logs. Our servers write operational logs for security and troubleshooting, which can include your player ID, username and IP address.

Google Analytics for Firebase

OVERDRIVE uses Google’s Firebase software to deliver push notifications. The Firebase software in the game also includes Google Analytics for Firebase, which automatically collects basic, pseudonymous usage information: an app instance identifier, events such as the app being opened and how long a session lasts, the device model, the operating system and app version, and an approximate location (country or region) that Google infers from your IP address. On Android it may read the device’s advertising identifier. We do not use this information for advertising, we do not combine it with your account, and we do not use it to track you across other companies’ apps or websites. Google processes it under its own privacy policy: https://policies.google.com/privacy

What we do not collect

We do not collect your real name, phone number, contacts, photos, precise location, microphone or camera, and we do not ask for your age. OVERDRIVE has no text or voice chat and no way to upload content: car decals and wraps come from a fixed library built into the game.

2. Why we use it

Purpose	Information used	Legal basis (where GDPR-style laws apply)
Running your account and keeping your progress	device sign-in identifier, player ID, username, email, password hash, game progress	performing our agreement with you (providing the game)
Online races, matchmaking and rooms	player ID, username, race data, IP address	performing our agreement with you
Friends, invites and leaderboards	username, friends list, leaderboard entries	performing our agreement with you
Password reset	email address	performing our agreement with you
Push notifications (friend requests and race invites only)	push token	your consent (the system permission prompt, shown the first time you open FRIENDS)
Security, preventing abuse, fixing problems	hashed IP address, server logs	our legitimate interest in keeping the game secure and working
Understanding how the app is used	Google Analytics for Firebase data	our legitimate interest in improving the game

3. Who we share it with

We do not sell or rent your information, and we do not share it for advertising. It is shared only with:

Other players, who can see your username, level and your car in races, on leaderboards and in friends lists.
Google (Firebase), which delivers push notifications and provides Google Analytics for Firebase, acting as our service provider.
Apple Game Center (iOS) and Google Play Games (Android). If you are signed in to these, the game sends your XP score to the platform’s leaderboard, under Apple’s or Google’s own terms. Your Game Center or Play Games identity is not sent to our servers.
Authorities, if the law requires it.

4. Where it is kept

Your account and progress are stored on servers operated by Maxal (gamecenter.max.al) in a CockroachDB database. Connections to the account server are encrypted (HTTPS/TLS). Live race traffic is sent over UDP; it is signed so it cannot be forged, but it is not encrypted. Google may process Firebase data in the United States and other countries, under the safeguards described in its policy.

The game also keeps a copy of your save on your device. Test builds of the game can write a session log to the game’s folder on your device to help diagnose problems; it never leaves your device unless you choose to send it to us.

5. How long we keep it

Your account, progress, friends and leaderboard entries: until you delete your account.
Push tokens: while notifications are on for that device, and they are deleted with your account.
Password reset codes: 15 minutes. Our mail relay keeps a copy of the reset emails it sends, up to the most recent 500 messages.
Race data: the race server keeps nothing about you once the race ends, except the results it reports to your account.
Deletion record: when you delete your account we keep a dated record that an account was deleted, so a deleted account cannot be restored by mistake.
Google Analytics for Firebase data: according to the retention set in Firebase (Google’s default is 2 months for user-level data).

6. Your controls and rights

Everything below is in the game, under the profile button (top right) › Account:

See what we hold: PRIVACY & YOUR DATA explains it in the game.
Get a copy: EXPORT MY DATA saves a file with everything your account holds (your profile, garage, identities and linked devices, in a readable JSON format) to the game’s folder on your device.
Correct it: change your username or password in the game.
Delete it: ⋮ › ACCOUNT OPTIONS › DELETE ACCOUNT removes your account, sign-in identities, username, garage, friends, invites and leaderboard entries, and then the save on your device. You can also ask us to delete it by emailing [email protected] from the address on your account.
Log out everywhere: signs out every device that uses your account.
Notifications: turn them off at any time in your device’s settings.

Depending on where you live, you may also have the right to object to or restrict how we use your information, and to complain to your local data protection authority. Write to [email protected] and we will reply within 30 days.

7. Children

OVERDRIVE is not directed at children under 13, and we do not knowingly collect personal information from them. The game does not ask for an age or a real name and has no chat. If you believe a child under 13 has registered an account, contact us at [email protected] and we will delete it.

8. Security

We protect your information with encrypted connections to our account server, one-way hashing of passwords and of the identifiers used to limit abuse, signed race tickets, and access restricted to the people who run the service. No system is perfectly secure, but we work to keep your information safe.

9. Changes to this policy

If we change this policy, we will update the effective date above, and if the change is significant, we will tell you in the game before it takes effect.

10. Contact

Maxal · [email protected] · https://max.al