Privacy Policy (DRAFT)

Last updated: 2026-10-21

MilkyWay Race respects your privacy and is committed to protecting your personal information. This policy explains what information we collect, how we use it, and your rights regarding that information.

Data Controller

MilkyWay Race is operated by [Full legal name], an individual based in Sweden. The operator is responsible for the processing of personal data described in this policy.

Contact details: [Postal address] and info@milkyway-race.com.

Cookies and Local Storage

The game does not use cookies. Instead, it uses your browser's local storage to remember your login session, including an authentication token, its expiry time, your email address, and your pilot name. This allows you to remain signed in when you reload or reopen the game.

Login sessions expire after 12 hours. Stored login information is removed when you log out or when the game next detects that your saved session has expired. Your password is never stored in your browser's local storage.

Local storage is used solely for essential game functionality, not for advertising or tracking.

Personal Information

When you register, we collect your email address, a password, and your chosen pilot name, which may be a nickname. Your email address serves as your unique player identifier. Your password is stored only in hashed form, not as plaintext.

We also store game information associated with your account, including your progress, scores, achievements, and gameplay history.

When you create your account, we record when you accepted the Terms & Conditions and acknowledged this Privacy Policy, together with the versions of those documents. We use this record to document our agreement and handle related questions or disputes, based on our legitimate interests (Article 6(1)(f) GDPR). Acknowledging this policy is not consent to advertising or to processing that requires separate consent.

We use this information to:

Processing necessary to provide the game and manage your account is based on the performance of our agreement with you (Article 6(1)(b) GDPR). Processing necessary to protect the security and integrity of the game and prevent abuse is based on our legitimate interests (Article 6(1)(f) GDPR), where applicable. Information required by law is processed to comply with legal obligations (Article 6(1)(c) GDPR).

Your email address, password, and pilot name are required to create an account. Without this information, we cannot provide access to the game.

We do not use your personal information for advertising, marketing, or behavioral analytics, and we do not sell personal information.

Public Information

Your pilot name and game scores may be visible to other players through the game's highscore lists. Your email address is not publicly displayed.

If you do not wish to display your real name, please choose a nickname that does not identify you.

Service Providers and Data Sharing

We use Oracle Cloud Infrastructure to host the game and store player information. Our game servers are located in Oracle's Stockholm, Sweden region.

We may also use external providers for essential services, including payment processing. These providers process personal information according to their respective roles, contractual obligations, and applicable data protection laws.

We do not share player information with third parties for their own advertising or marketing purposes.

If the game or its operating business is sold, merged, or transferred to another operator, personal information may be transferred as part of that transaction, subject to applicable data protection laws. Players will be informed of any change in the data controller as required by law. Such a transfer does not automatically authorize the new operator to use personal information for unrelated purposes.

Data Storage and International Transfers

Player account information and game data are hosted in Sweden. Some service providers may process personal information in other countries. Where personal data is transferred outside the European Economic Area, we will ensure that the transfer complies with applicable data protection requirements, including appropriate safeguards where required.

Data Retention

We retain your account information and associated game data for as long as your account remains active, unless a longer retention period is required by law or justified for a specific lawful purpose.

If your account is deleted, we will delete or anonymize associated personal information unless we are legally required or otherwise lawfully entitled to retain certain records. Information retained for such purposes will not be used for unrelated activities.

Your Rights and Account Deletion

Under the GDPR, you have the right, subject to applicable conditions and exceptions, to:

To exercise these rights or request deletion of your account, please email info@milkyway-race.com. We may need to verify your identity before processing your request.

We will respond without undue delay and normally within one month, as required by the GDPR. Certain requests may take longer where permitted by law.

Deleting your account will permanently revoke your access to the game, including any paid access associated with that account. This does not affect any refund or other rights you may have under applicable consumer protection laws.

If you believe that your personal information has been processed unlawfully, you have the right to lodge a complaint with a competent data protection authority, including the Swedish Authority for Privacy Protection (IMY), at www.imy.se.

Payment Information

Payments are processed by [Merchant of Record], an independent provider acting as the seller of record for purchases made through the game. Payment-related personal information is processed in accordance with that provider's privacy policy and applicable law.

MilkyWay Race does not receive or store your payment card details. We receive only the information necessary to confirm and manage your access to the game, such as payment status and relevant transaction references.

Payment and accounting records are retained for the periods required by applicable law and according to the respective responsibilities of the payment provider and the game operator.

Changes to This Policy

We may update this Privacy Policy to reflect changes in the game, our operations, or applicable law. The current version will always be available through the game. Where required, we will notify you of significant changes before they take effect.