Privacy Policy
Last updated 2 October 2026
Who is responsible
DCameron, trading as Apex Drawn, United Kingdom, is the controller of your personal data. To contact us, message @apexdrawn on TikTok.
What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Username, email address, password (stored scrambled, never readable) | To run your account, sign you in and send password reset links (Stripe emails your receipts) | Contract |
| Game progress: lap times, recorded laps ("ghosts"), saved circuits, cars and items, XP, streaks | To provide the game, leaderboards and the Apex Pass | Contract |
| Purchases: what you bought, when, the amount, your email | To deliver items, keep records and handle refunds. Card details go straight to Stripe; we never see them | Contract; legal obligation (records) |
| IP address and basic request details | Security, stopping abuse and spam, checking laps are genuine, counting visits | Legitimate interests |
| How lap times were driven (the path round the circuit) | Checking that laps are genuine | Legitimate interests |
| Settings and drawings kept in your browser (local storage) | Remembering your circuit and settings on your device. This stays on your device | Legitimate interests |
| How the game is used: time on each part of it and counts of things like exports and races finished, in total and anonymously | To see what is used and what isn't, and make the game better | Legitimate interests |
| Messages you send us with Contact us, and the reply address you give (optional). Bug reports also carry your browser type and screen size | To answer you, fix bugs and consider ideas and partnership enquiries | Legitimate interests |
| Advertising cookies (Google AdSense) | Showing ads that pay for the game | Consent, where the law requires it |
What other players can see
Your username, lap times, the car you used, any title you wear, and, for the fastest lap of each daily challenge, the recorded lap other players race against as a ghost. Your email is never shown.
Who we share it with
Only the services that run the game for us, and only what each one needs:
- Render: hosts the website, servers and database.
- Stripe: takes payments.
- Resend: sends password reset emails.
- Google: AdSense shows ads. Google Fonts serves the site's fonts, so your browser contacts Google to download them.
- Cloudflare (cdnjs): serves a code library the game uses.
Some of these are based outside the UK, mainly in the US. Where they are, the transfer is covered by the UK's approved safeguards (the UK Extension to the EU–US Data Privacy Framework, or standard contractual clauses). We will also share data if the law requires it.
Ads and cookies
The ads on Apex Drawn are served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your earlier visits to this site and to other sites. Google's use of advertising cookies lets it and its partners serve ads to you based on those visits.
In the UK and the EU we ask first: a consent message from Google appears before any advertising cookie is set, and you can change your answer at any time with the "Privacy and cookie settings" link at the foot of the About page in the game. Without consent, Google may still show ads that are not personalised, using only limited data to count and protect them.
You can turn off personalised advertising from Google in Ads Settings, and from many other vendors at aboutads.info or youronlinechoices.eu. How Google uses data from sites that show its ads is explained at policies.google.com/technologies/partner-sites.
How long we keep it
- Account and game data: while your account exists.
- Purchase records: six years, for tax.
- Recorded laps shown as ghosts: until the next day's challenge starts.
- Lap times removed by moderators: 90 days, in case the removal was a mistake.
- Server logs: a few weeks.
- Messages you send us: until we have dealt with them, or with your account if you were signed in. Ask and we will delete one sooner.
Your rights
You can ask us for a copy of your data, to correct it, to delete it and your account, to limit or object to how we use it, or to receive it in a portable format. Contact us and we will reply within a month. You can withdraw consent to ad cookies at any time through the "Privacy and cookie settings" link on the game's About page. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Children
Accounts are for people aged 13 and over. If you think a child under 13 has made an account, contact us and we will delete it.
Changes
If we change this policy, we will update the date at the top, and tell account holders about any important change.