SG Bumper Cars: Privacy Policy

SG Bumper Cars ("the Game", "we", "us") is an arcade driving game. We built it to be privacy-friendly: we do not ask for your name, email, phone number, or location, we do not sell personal data, and there is nothing to buy. (There is a voluntary tip jar; it is a gift, it unlocks nothing, and we never learn who used it: see section 4.) The Game is ad-supported: ads are served by Google, which uses cookies as described in sections 5 and 6. To power online leaderboards and cloud save, the Game creates an anonymous game account for you automatically, with no sign-up and no personal details (see section 3). This page explains the data the Game handles, in plain language.

The short version. Nothing at all is collected until you choose it. Analytics are off until you accept. The pages of this website carry no ad script and no tracking pixel of any kind, and only one of them, the tip jar, counts anything at all: two anonymous events, with no cookie and nothing stored on your device (section 2). Your progress lives on your device. The only thing about you that is ever public is the display name you pick for the leaderboard.

Who is responsible. The data controller is Kopitiam Games, an independent, self-funded game studio in Singapore, contactable at kopitiam.games@gmail.com (see Contact). We are small enough that the same address reaches the person who wrote the code. This policy covers the browser version at sg-bumpercars.app, the pages on this website, and the Android app currently in closed testing. There is no iOS version. Your use of the Game is also governed by our Terms of Service.

1. Data stored on your device

Your game progress is saved locally on your device using browser/app local storage: unlocked levels, star ratings, best scores, selected car, coins, achievements, and your settings (including your analytics choice). You can erase it at any time with Settings → Reset Save Data (or by uninstalling the app). A copy of your progression also syncs to your anonymous game account so it can follow you across devices (see section 3); device settings never leave your device.

2. Anonymous analytics (opt-in)

With your consent, the Game sends anonymous usage data to our analytics providers so we can see which levels are too hard, find crashes, and fix them. Analytics are off by default and only start if you tap Accept on the consent banner or turn Settings → Analytics to ON. Ignoring the banner counts as no. Here is everything that is collected once you say yes:

• Gameplay events. A run started, a level cleared, game over and what caused it, a bonus mode opened, a menu screen viewed, a score shared, and (in the Android app) the fact that the game asked the Play Store to show its review card. We are never told whether that card appeared, or whether you wrote a review.
• Page views inside the game, including the address of the page and the site you arrived from.
• Taps and clicks. Our analytics provider records button presses automatically, including the label on the button. This is a standard feature of the tool rather than something we ask for by name, which means the record is broader than the events in the first bullet.
• Device and browser context. Browser, operating system, device type, screen size, game version, and whether you play with touch or a keyboard.
• An approximate location, worked out from your IP address by our provider and kept at country and city level. We never see or store the IP address itself.
• Crash reports. The error message, the first part of the technical detail, and what the Game was doing at the time. These are capped at a handful per session, your Recovery Licence code is stripped out before anything is sent, and your saved progress is never attached.

We do not collect your name, email, phone number, contacts, photos, precise location, or any advertising identifier, and we do not build a personal profile of you: the analytics are configured to hold loose events rather than a person record per visitor. You can withdraw consent at any time via Settings → Analytics → OFF, which stops collection immediately.

These website pages are a separate matter, and all but one of them collect nothing. There is no ad script and no tracking pixel on any page of this website, and no page runs any code from another company. The only thing any of them fetches from another company is a YouTube video on the videos page, and only once you click play on it.

The exception is Buy Uncle a Kopi, which counts two things so we can tell whether anybody reads the tip jar and whether they go on to Ko-fi: this page was opened, and a Ko-fi link on it was clicked, with a note of which link. That is the entire list. No cookie is set, nothing whatsoever is stored on your device, no page address, referrer or search term is sent, no clicks other than those two links are recorded, and no profile of you is created: each visit is a fresh random number that exists only while the page is open, so we cannot tell a returning reader from a new one. Because nothing is stored on your device and nothing identifies you, this needs no cookie banner, but it still stops for anyone who asks it to. It sends nothing if your browser has Do Not Track or Global Privacy Control turned on, or if you have declined analytics in the Game.

3. Leaderboards, duels and cloud save (anonymous account)

When the Game starts, it signs you into an anonymous account (a random identifier with no email, password, or personal details) hosted on Supabase. This account stores:

• Your leaderboard display name: an auto-generated name like "Player1234" that you can change in Settings. It is shown publicly on the global leaderboards next to your scores, so don't put personal information in it.
• Your best scores (per level, per bonus mode, campaign total, daily and weekly boards), shown publicly on the leaderboards.
• A progression snapshot (unlocked levels, stars, achievements, coins) used for cloud save, private to your account, never shown to anyone.
• A daily activity tally: for each day you play, how many times the Game was opened, how many times it synced, how many runs you finished, and which platform you played on. It is how we can tell whether the Game is worth coming back to, so unlike the analytics in section 2 it is kept whether or not you have turned those on. It holds no scores, no times, and nothing about what happened in a run; it is private to your account and never shown to anyone.
• Kaki Duels you take part in. When you challenge another player or answer a challenge, we store the duel so it can appear in the other player's inbox: which level or mode it is, the score to beat, the result, and both display names. Duels expire on their own. A challenge sent as a link needs none of this, because the score travels inside the link and no account is involved at either end.
• Two short integrity records: a log used to spot scores that are not physically possible, and a note of any account recovery, which is what stops a restored Recovery Licence leaving you with two entries on the same leaderboard.

We cannot link this account to you as a person. To have your leaderboard entries and cloud save deleted, contact us (section 15) with your display name, or simply reset your save; abandoned anonymous accounts hold no personal data.

If you ask the Game for a Recovery Licence so you can move your account to another device, it sets a password on that anonymous account derived from a recovery code shown only to you. We do not store the code and cannot recover it. Never send it to us or to anyone else; see the Terms of Service.

4. Service providers

Data is processed by:

• Supabase: anonymous accounts, leaderboards, cloud save.
• PostHog: product analytics in the Game (only with your consent), and the two anonymous, cookie-less counts on the tip jar page described in section 2.
• Vercel: web hosting for the game and this website, plus cookie-less page-view counts (browser version only).
• Google: advertising (AdSense in the browser, AdMob in the Android app; see section 5).
• Ko-fi: voluntary tips. Not a processor of ours: see the note below.

These providers act as our processors, except Google, which acts as an independent controller for advertising, and Ko-fi. Each is bound by its own privacy terms, linked above.

On tips. Buy Uncle a Kopi is a plain outbound link: in the browser game it opens Ko-fi, and in the mobile apps it opens the tip jar page on this website, which is where you decide whether to go any further. It sets no cookie, loads no third-party script and sends Ko-fi nothing about you. We do count that the link was clicked, anonymously and without storing anything, as described in section 2. Nothing comes back either. There is no callback, no webhook and no record of a tip in your save, on your device or on our servers, so we cannot tell whether any given player has tipped, and a tip can never be linked to a game account. Whatever you enter on Ko-fi is between you and Ko-fi under their privacy policy. Tips unlock nothing in the game, which is also why there is nothing here for us to store.

5. Advertising

The Game is free because it is ad-supported. There are exactly two kinds of ad and nothing else: an occasional full-screen ad on the results screen between runs, never during one, and rewarded videos you choose to watch for an in-game perk such as bonus coins. Ads are served by Google: in the browser by Google AdSense, and in the Android app by Google AdMob. No ads run on the other pages of this website.

Cookies and ad serving. Third-party vendors, including Google, use cookies (and similar technologies, such as a device advertising identifier in the mobile apps) to serve ads based on your prior visits to this or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visits to this site and/or other sites on the Internet. Even when ads are non-personalized, cookies are still used for things like frequency capping, aggregated ad reporting, and combating fraud and abuse. You can read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.

• Opting out of personalized ads. You can opt out of personalized advertising by visiting Google's Ads Settings, or opt out of some other third-party vendors' use of cookies for personalized advertising at www.aboutads.info.
• Non-personalized by default. The Game asks Google for non-personalized ads. A non-personalized ad is chosen from the page and the moment rather than from a profile of you. Cookies are still used for frequency capping, aggregated reporting and fraud prevention, as described above.
• EEA, UK and Switzerland. Where consent is required, a Google-certified consent management platform shows you a consent message before ads that use cookies are served, and your answer there governs what happens next: if you consent to personalised advertising, ads may be personalised; if you decline, they stay non-personalized. Either way you get the whole game. Your choice is stored by that platform and you can reopen it at any time from the Privacy or Manage options link the message leaves on the page. In the Android app, Google's own consent form does the same job when the app starts.
• Everywhere else, no personalised advertising is requested at all, so there is nothing you need to switch off.
• Rewarded ads are always optional. They only play when you tap a clearly labelled "watch an ad" button, and the reward is shown up front. Nothing in the Game ever asks you to tap an ordinary ad, and there is no reward for doing so.
• You cannot pay to remove ads, because there is nothing to buy. The Game has no purchases of any kind, and a voluntary tip does not remove them either.

6. Cookies and similar technologies

The pages of this website set no cookies at all, and store nothing on your device by any other means either: the two counts on the tip jar page (section 2) keep no identifier anywhere. The table below describes the game at sg-bumpercars.app, which is the only place any of this applies.

The Game itself also sets no cookies of its own. What it stores on your device is browser local storage, which stays on your device and is never sent to an ad network. The cookies that do appear come from Google's ad serving, and only once ads load. In the Android app there are no browser cookies at all: Google uses your device's advertising identifier instead, which you can reset or switch off in Android's own settings. Everything in play is listed below.

How to control them. Analytics are off until you accept, and you can switch them off again at any time in Settings, Analytics, OFF. Ad cookies are controlled through the consent message described in section 5 and through Google's Ads Settings. Every browser also lets you block or delete cookies for a site, and clearing site data erases the local storage listed above. Blocking the strictly necessary entries will lose your progress and settings, but the Game will still run.

7. Reminder notifications (Android app)

The Android app can remind you that a daily challenge is waiting or that someone has sent you a duel. These reminders are put together and scheduled on your phone, by the app itself. There is no push server, we send nothing to your device, and no information about your reminders leaves the phone. They are off until you turn them on, and Android asks your permission first. The browser version has no notifications.

8. Children

The Game is a work of satire intended for a general teen-and-up audience and is not directed at children under 13. We do not knowingly collect personal data from children, and we do not knowingly serve personalised advertising to anyone we know to be a child. Ads are non-personalized unless an adult consents through the message described in section 5, and analytics are off until someone opts in, so nothing at all is collected by default. If you are a parent or guardian and believe a child has given us personal data, write to us and we will delete it.

9. Your rights, and how to use them

We hold no personal identifiers: your game account is anonymous and cannot be linked to you by us. That shapes what we can and cannot do for you, so here is the practical version, which applies to everyone wherever they live.

• Withdraw consent. Settings, Analytics, OFF stops analytics collection immediately. For ads, use the consent message described in section 5.
• Erase your data. Settings, Reset Save Data erases everything stored on your device. For your leaderboard entries and cloud save, email us your display name and we will delete them.
• Access and portability. Ask us and we will send you the rows held against your display name. It is a short list: your scores, a progression snapshot, any duels you are part of, the daily activity tally, and the display name itself.
• Correction. You can change your display name in Settings at any time. Ask us if a score looks wrong.
• Object or restrict. Tell us and we will stop processing the account, which in practice means deleting it.
• Complain. You can complain to your local data protection authority. In the UK that is the Information Commissioner's Office; in the EEA it is the supervisory authority for the country you live in.

Identifying you. Because accounts are anonymous, your leaderboard display name is normally the only handle we have, so include it in any request. If we genuinely cannot match a request to any data, we will tell you rather than guess. We do not charge for any of this, and we answer within thirty days.

How long we keep things. Data on your device stays until you clear it. Leaderboard entries and the cloud save snapshot are kept while the anonymous account exists, and are deleted on request; daily and weekly board entries roll off as those boards reset. The daily activity tally is kept for up to three years, and goes with the account when the account is deleted. A duel stops being answerable after seven days, and a daily duel at Singapore midnight. Analytics events are retained by PostHog for up to 12 months and then deleted. Ad and consent records are retained by Google under its own policy.

10. GDPR and UK GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, this section applies to you in addition to section 9. The controller is Kopitiam Games, Singapore, contactable at kopitiam.games@gmail.com. We are small enough not to require a Data Protection Officer, so that address reaches the person responsible. You have the rights listed in section 9: access, rectification, erasure, restriction, objection, portability, withdrawing consent, and lodging a complaint with your supervisory authority.

Our legal bases:

• Consent (Article 6(1)(a)) for analytics, and for any ad cookies that are not strictly necessary. You can withdraw it at any time, which does not affect processing already carried out.
• Contract (Article 6(1)(b)) for the anonymous account, cloud save and leaderboards: these are the service you asked for by playing.
• Legitimate interests (Article 6(1)(f)) for keeping the Game secure and working, for the daily activity tally that tells us whether players come back, for frequency capping so you are not shown the same ad over and over, and for detecting invalid traffic and fraud. We consider these narrow and low-risk because no personal identifiers are involved.

International transfers. We are based in Singapore and our providers are largely in the United States, so your data is processed outside the EEA and the UK. Those transfers rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) in each provider's data processing terms, or on an adequacy decision where one applies. The links in section 4 lead to each provider's transfer terms.

Automated decision-making. There is none. We do not profile you, and nothing about you is decided automatically in a way that produces legal or similarly significant effects.

11. Singapore PDPA

We are based in Singapore, so the Personal Data Protection Act 2012 applies to us wherever you live. This section says how we meet it, and it sits alongside section 9 rather than replacing it.

• Notification and consent. This page is our notification of what we collect and why. Analytics are collected only with the consent you give on the banner, and you can withdraw it at any time in Settings. Everything else is limited to what is needed to give you the Game you asked for.
• Purpose limitation. The purposes are: saving and syncing your progress, running the leaderboards and duels, keeping scores honest, showing ads that pay for the Game, and finding and fixing crashes. We do not use your data for anything else, and we do not sell it.
• Access and correction. You may ask what we hold against your display name and ask us to correct it. Write to us and we will answer within thirty days, free of charge. Section 9 has the practical detail.
• Accuracy and protection. See section 13.
• Retention limitation. We keep nothing longer than the purpose needs it. See the retention note at the end of section 9.
• Transfers out of Singapore. Our providers are largely in the United States, so data is processed overseas. Each is bound by contractual terms that hold it to a standard comparable to the PDPA.

Our data protection contact is kopitiam.games@gmail.com. If we cannot resolve a complaint, you may raise it with Singapore's Personal Data Protection Commission.

12. US state privacy rights

Around twenty US states now have a comprehensive consumer privacy law, starting with California's. If you live in one of them, this section applies to you in addition to section 9.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We take no money for data, and outside the consent flow described in section 5 the Game requests non-personalized ads for everyone, so ads are not selected from a profile of you. That is why there is no "Do Not Sell or Share My Personal Information" link on this site: there is nothing to opt out of. If that ever changes, we will add the link and say so here first.

Opt-out preference signals. If your browser sends a Global Privacy Control signal, we treat it as a valid request not to sell or share your personal information. In practice it changes nothing, because we already do neither, but the signal is honoured rather than ignored.

The categories of information involved are limited to internet and device activity (the gameplay events, page views, taps, and device and browser details listed in section 2), an approximate location derived from your IP address by our providers, and the display name and scores you choose to put on a public leaderboard. We do not collect sensitive personal information, we do not knowingly collect or sell the personal information of anyone under 16, and we do not use or disclose any of it for purposes beyond those described in this policy. You have the rights to know, to delete, to correct and to be free from retaliation for exercising them; section 9 explains how to use each one. An authorised agent may make a request on your behalf with your written permission.

13. Security, and what happens if something goes wrong

Everything travels over HTTPS. Your cloud save is protected at the database level by a rule that lets only your own account read it, which is why a leaderboard shows everyone's scores but nobody's progress. The recovery code on a Recovery Licence is never stored by us in a form we could read, which is the same reason we cannot recover it for you.

No system is perfect. If a breach happens that is likely to cause you significant harm, or that affects a significant number of people, we will notify Singapore's Personal Data Protection Commission and the people affected as soon as we reasonably can, and in any case within the deadlines the PDPA sets. Where the GDPR or UK GDPR applies we will do the same for the relevant supervisory authority under Articles 33 and 34. Because we hold no names, email addresses or payment details, the worst case here is far smaller than it would be for most services.

14. Changes to this policy

We may update this policy as the Game evolves. Material changes will be reflected by the "Last updated" date above and, where required, surfaced in-app.

15. Contact

Kopitiam Games, Singapore. Questions about privacy, or any request under sections 9 to 12: kopitiam.games@gmail.com with Privacy as the subject. The Contact page lists the other ways to reach us.