Privacy Policy
Last updated: October 26, 2026
Hoone (“Hoone”, “we”, “us”) is a daily browser racing game at hoone.net. This policy explains what information we collect when you play, why we collect it, who we share it with and what you can do about it. We try to collect as little as possible: you can play without an account, there are no ads, and the only statistics we keep are anonymous counts that cannot tell players apart.
The short version
- You can play without signing up. Your progress and settings then stay in your browser.
- If you post a time to the leaderboard, your racing name, time, car and a recording of your drive are public.
- If you create an account, we store your email address and your saved progress.
- Payments are handled by Stripe. We never see or store your card number.
- We count visits and rounds played anonymously, without cookies and without any player ID.
- We do not sell your personal information and we do not use it for advertising.
- You can delete your account in the game at any time (Profile, then Delete account), or email [email protected].
What we collect
Stored only in your browser
The game saves a few things in your browser’s local storage and IndexedDB so it works the next time you visit: your settings (graphics, sound, language, controls), your racing name, your best times and recorded runs, play counts, time played, unlocked cars and paints, bookmarked maps and a cached copy of the day’s island. This data does not leave your device unless you sign in (see “Cloud save” below) or post a time to the leaderboard. You can delete it at any time by clearing the site data for hoone.net in your browser.
Leaderboard
When you finish a run, the game posts it to the daily leaderboard. A posted run contains:
- the racing name you chose (you pick it; it does not need to be your real name),
- your time, the day and map, and the car and paint you drove,
- a “ghost”: the path your car took and your controls, so other players can race against or watch it.
These are public: anyone who opens the leaderboard can see your name, time and car and replay your ghost. If you share a run link, anyone with the link can see that run.
To keep one row per player without an account, your browser creates a random player key. Our server only stores a one-way hash of it, and it is never shown to other players. If you are signed in, your runs are linked to your account instead. To stop spam and floods, we also store a hash of your IP address with each post and delete it after one day.
Account
Accounts are optional. If you create one, we collect:
- Email and password: your email address and your password. The password is stored only as a secure hash; we cannot read it.
- Sign in with Google: Google tells us your email address and your Google account ID, and may include your name and profile picture. We use the email address and ID to sign you in and nothing else.
- Sign-in codes: when you confirm your email, reset your password or sign in with a code, we email you a one-time code.
Cloud save
While you are signed in, your progress (racing name, best times, play counts, time played, stats, earned cars and paints, saved maps) is copied to our server so you can continue on another device. Only you can read or change your save. Settings stay on each device.
Purchases
Paid cars are sold through Stripe Checkout. You enter your payment details on Stripe’s page, not ours, and Stripe processes them under its own privacy policy. Stripe sends us the email address on the order, what you bought, the amount and currency, the payment status, your billing country (for sales tax) and Stripe’s order and payment IDs. We use this to unlock your car, handle refunds and keep records for tax and accounting. We never receive your full card number. Your purchases are listed in the game under Profile, with what you bought, when, the price and a link to Stripe’s receipt; only you can see that list.
Anonymous statistics
To see how many people play, which islands are played most and how the game runs on different devices, the game sends anonymous events: the page loaded, a round started, finished or was given up. Each event contains only the island, the round’s time and frame rate, respawns and pickups, your graphics setting, car and language, and coarse facts about the device: phone, tablet or computer, operating system, browser, GPU maker (such as “Apple” or “NVIDIA”), screen size rounded to 100 pixels, pixel density, number of CPU threads and memory class. It also says whether this was your first round on that island in this browser, which lets us count players without identifying them. Our host Cloudflare adds the country it guesses from your connection.
No name, account, player key, ID or IP address is stored with these events, no cookie is set, and they cannot be linked to you, to each other or to your leaderboard runs. They are stored by Cloudflare (Workers Analytics Engine) and deleted after about three months. If your browser sends a Global Privacy Control or Do Not Track signal, the game sends no events at all.
The pages also use Cloudflare Web Analytics, which counts page views, where visitors came from and how fast pages load. It does not use cookies or local storage and does not identify or follow you across sites (Cloudflare Web Analytics).
Server logs
Like any website, the servers that deliver the game and run our backend keep short-lived technical logs, such as IP address, browser type and the time of a request. They are used to keep the service running and secure.
Cookies and similar technology
The game does not use cookies of its own, and it loads no advertising or tracking scripts. The only third-party script is Cloudflare Web Analytics, which sets no cookies. The game uses your browser’s local storage for the things listed above, including keeping you signed in. Stripe’s checkout page and Google’s sign-in page are run by those companies and may set their own cookies while you use them. The anonymous statistics described above are switched off when your browser sends a Global Privacy Control or Do Not Track signal.
How we use information
- to run the game, the daily leaderboard and ghost replays,
- to create and secure your account, sign you in and sync your progress,
- to process purchases and refunds and unlock what you bought,
- to send emails you ask for (sign-in codes, password resets) and, rarely, important notices about your account or a purchase,
- to prevent cheating, spam and abuse, and to fix bugs,
- to understand, from anonymous counts, how many people play, which islands they play and how well the game runs on their devices,
- to meet legal, tax and accounting obligations.
We do not send marketing emails, and we do not use your information for advertising or profiling.
Who we share it with
We share information only with the service providers that run the game for us:
| Provider | What for |
|---|---|
| Supabase | Database, accounts, leaderboard and cloud save (servers in London, United Kingdom) |
| Spaceship (Spacemail) | Delivering sign-in and account emails (your email address and the code) and our support mailbox |
| Stripe | Payments, sales tax and refunds |
| Only if you choose “Continue with Google” | |
| Cloudflare | Hosting: delivering the game’s files to your browser, and the anonymous statistics and Web Analytics described above |
They may only use the information to provide their service to us. Apart from that, we disclose information only if the law requires it, to protect the rights or safety of players or the public, or as part of a sale or transfer of the game (in which case this policy keeps applying to your data). The public leaderboard data described above can be seen by anyone.
We do not sell your personal information, and we do not share it for targeted advertising.
How long we keep it
- Leaderboard: posted runs and their ghost recordings are kept, so any run can be raced or watched again from its link. Runs of an account are deleted with the account; for runs posted without an account, email us.
- Hashed IP addresses: deleted after one day.
- Account and cloud save: kept until you delete your account. Deleting it removes the account, the cloud save, the cars bought with it and its leaderboard runs right away.
- Purchase records: Stripe’s payment records and our accounting records are kept as long as tax and accounting law requires, usually up to seven years, even after the account is deleted. Our own list of purchases (what was bought, when, the price and Stripe’s IDs) keeps its rows too, but deleting the account removes the link to it and to the receipt.
- Anonymous statistics: deleted after about three months (Cloudflare Web Analytics keeps its page-view counts for up to six months).
- Server logs: kept for a short period by our providers.
Your choices and rights
- Play without an account and nothing about you is stored on our server except runs you post.
- Change your racing name in your profile at any time.
- Clear local data by clearing hoone.net’s site data in your browser.
- Delete your account yourself: Profile, then Delete account. This takes effect immediately and cannot be undone.
- Access, correct or delete: email [email protected] from the address on your account (or tell us your racing name and day for leaderboard runs) and we will send you a copy of your data, correct it, or delete your account, cloud save and leaderboard runs. We may need to confirm it is really you first.
Depending on where you live, including California and other U.S. states with privacy laws, you may have the right to know what personal information we collect and how we use it, to get a copy of it, to have it corrected or deleted, and to opt out of its sale or use for targeted advertising (we do neither). You can use these rights by emailing us, and you can have an authorized agent do so for you. We will not treat you differently for using them. We answer requests within 45 days.
Children
Hoone is a general-audience game and is not directed at children under 13. We do not knowingly collect personal information from children under 13; an account requires you to be at least 13. Racing names should not contain real names. If you believe a child under 13 has given us personal information, email us and we will delete it.
Security
Connections to the game and our backend are encrypted (HTTPS). Passwords are hashed, the database only lets each player read their own account data and save, and payment details stay with Stripe. No system is perfectly secure, so please use a password you do not use anywhere else.
Players outside the United States
Hoone is run from the United States. Our database is hosted by Supabase in London, United Kingdom, and our other providers may store and process data in the United States and other countries. If you play from elsewhere, your information will be transferred there. If the law where you live gives you additional rights over your data, email us and we will help.
Changes to this policy
If we change this policy, we will update the date at the top. If a change is significant, we will also tell signed-in players in the game or by email before it takes effect.
Contact
Questions or requests about your data: [email protected].