Clash Karts privacy policy

Last updated: 16 October 2026. This page covers the game at clashkarts.com, made and run by pawann-2000 ("we"). Contact: support@clashkarts.com.

The short version

You can play without an account. Then no account or profile of yours is kept on our servers: your name, racer, progress and settings stay in your browser. The one exception: if another player reports the name you play under, that name, as the game showed it, is kept with their report for moderators (see "Reports you file" below).
An account (Google, or email and password) keeps your progress across devices. Accounts are for players aged 13 and over. We keep only what an account needs, listed below, and you can delete it at any time.
If you sign in with Google, we keep only Google's id for your account, to recognise you. We do not keep your Google email address, name or picture, and nothing from Google is shared, sold or used for advertising (see "Google sign-in" below).
Your password never leaves your device: the browser turns it into a key first, and we store a keyed hash of that key, never the password.
The game is free and paid for by ads from Google, which may appear on the site's pages and between matches. Google and its partners use cookies to show them (see "Advertising" below). We run no analytics, and our own cookies are the one that keeps you signed in and, only while you sign in with Google, a short-lived one for that sign-in.
We email you only to confirm your address, to reset a password you asked to reset, or to tell you someone tried to make an account with your address.

What is stored, and why

What	Why	Kept
Your account: an id, your display name, and your email for an email account. A Google account gets a made-up address built from a hash of Google's id for you; we never keep your Google email, name or picture.	To sign you in and show your name to other players.	While the account exists.
How you sign in: a keyed hash of your stretched password, or Google's id for your account (no Google tokens).	To check it is you.	While the account exists.
Sessions: a random token in a cookie, its expiry, and your browser's description (user agent, cut to 200 characters). No IP address. While you sign in with Google, an encrypted cookie holds that sign-in's state for at most 10 minutes.	To keep you signed in, and so you can tell your sessions apart.	Until the session expires (30 days after you last played) or you sign out.
Your game profile: level and XP, coins, prizes, today's challenges, looks and sound and camera settings (at most 4 KB), with daily counters.	So your progress follows you to other devices.	While the account exists.
Name moderation: whether your name was hidden after reports, and names moderators took off your account.	To keep offensive names out of the game.	While the account exists.
Counters for an email address, kept under a hash of the address (not the address), whether or not it has an account: wrong passwords tried with it, and emails we sent to it.	To slow down password guessing, and so nobody can flood a mailbox through our emails.	Two days after the last count.
Reports you file: your account, the name you reported as shown (also when its player has no account), the reason, a keyed hash of your network address (not the address), and, when the game can prove you shared a room, the reported player's account, the name it had then, and that room.	So moderators can act on offensive names and spot abuse of reports.	Open reports are closed after 90 days; closed reports are deleted 180 days after closing.
The moderation log: every moderation action, with the account it concerned and, for actions on a name, that name.	So that what moderators did stays accountable.	400 days, also after the account is deleted.
A password-reset token and the account it is for, or a short grant while you link Google to your account.	So the link in a reset email, or Google's answer, works once, for you.	An hour (reset), five minutes (Google link); deleted once used.
Request counts per network address (your IP address, or for IPv6 its /64 network).	Rate limits against spam and password guessing.	2 days.

An email account whose address was not confirmed within three days is deleted (so nobody can keep someone else's address). Accounts that never kept any progress and have no session are deleted after 30 days; accounts nobody has used for two years are deleted too.

Google sign-in

Signing in with Google is optional. When you choose it, we ask Google for the basic sign-in scopes only (openid and email), and Google tells us your Google account's id and your email address. This is what we do with that data:

Access: only at the moment you sign in with Google or link Google to your account. We do not ask for, and cannot reach, anything else in your Google account (no contacts, files, calendar or mail), and we keep no Google access or refresh tokens, so we cannot come back for more later.
Use: Google's id for your account is how we recognise you when you sign in again. Your email address from Google is not used for anything: not to contact you, and not to match you to another account.
Storage: we store Google's id for your account with your account, for as long as the account exists. We do not store your Google email address, name or picture: your account's email field holds a made-up address built from a hash of that id.
Sharing: we do not share, transfer or sell data from Google to anyone, and do not use it for advertising. Other players never see it.
Deletion: deleting your Clash Karts account deletes Google's id for you with it. You can also remove Clash Karts' access in your Google Account (Security, then "Your connections to third-party apps and services").

Clash Karts' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If we ever change how we use data from Google, we will update this page before the change takes effect.

In your browser

The game keeps your profile (name, racer, progress, settings), its sync state when you are signed in, and which names you reported today (forgotten when you sign out) in your browser's local storage, and its own files in a cache so it starts quickly and works offline. Clearing the site's data in your browser removes all of it.

Advertising

Clash Karts is free to play and paid for by advertising: ads served by Google (Google AdSense) may appear on the site's pages and between matches. The ads come from Google's servers straight to your browser; our servers neither receive nor store anything from them.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
You can opt out of personalised advertising in Google's Ads Settings. You can also opt out of some other vendors' use of cookies for personalised advertising at www.aboutads.info.
In the European Economic Area, the United Kingdom and Switzerland, ads use cookies or personal data only with your consent, which Google's consent message asks for. You can change your choice at any time.
Google explains what its ads do with data in How Google uses cookies in advertising.

Playing online

Matches are hosted by a player's browser and joined peer to peer (WebRTC), so the players in your match, and the host above all, can see your IP address, as in most peer-to-peer games. Add ?relay to the address to play through our relay instead. The lobby server sees your address while you are connected, to enforce per-address limits. It never writes it down, and keeps it in memory only that long, with three exceptions: for 10 minutes after a host removes you from a room (so you are not put back in it), for 30 minutes after the other players' games catch yours cheating as a host (so you cannot host meanwhile), and for a few minutes after you try wrong room codes. When you are signed in, the lobby also knows your account and public name, to show your name and to let players in your room report it; it does not store them either, except your account's id for those same 30 minutes after you are caught cheating as a host. Other players see your public name, never your account's id or email: the proof that you shared a room, which a report needs, is sealed so that only our server can read whose accounts it names.

Who else is involved

Cloudflare runs the game, the lobby and the account service, and its Turnstile check (on sign-up, sign-in, name changes and reports) tells people from bots. Cloudflare's privacy policy applies to that check.
Turso stores the account database.
Resend sends our emails (address confirmation, password reset, and the note when someone tries to make an account with your address): it receives your email address and the message.
Google, which serves the ads (see "Advertising"), and, only if you choose it, Google sign-in.
A STUN server (by default Google's) helps browsers find each other for peer-to-peer matches; it sees your IP address.

Deleting your account

Open the account window (the person in the menu's top bar), press Delete account, and confirm with your password (a Google account confirms within a day of signing in). That deletes your account, sessions, sign-in methods, profile, name blocks and the reports you filed at once. Reports about you lose the link to your account and are closed. The moderation log keeps its entries about your account (its id, and names moderators acted on) for their 400 days.

Children

Accounts are for players aged 13 and over. Younger players can play as guests, which keeps no account or profile of theirs on our servers; as for any guest, the one thing that can be kept is the name they play under, if another player reports it (see "Reports you file"). If you believe a child under 13 has made an account, or want a reported name removed, write to us and we will delete it.

Your rights and contact

To ask what we hold about you, to get a copy of it, to correct it, to have it deleted, or about anything else in this policy, email support@clashkarts.com. We answer within a month. Depending on where you live, you may have further rights over your data and may complain to your data protection authority.

Changes

When this policy changes, we update this page and its date.