Template: this page is a plain-language starting point written for the site owner to review and adapt. It is not legal advice.

Privacy Policy

Last updated October 11, 2026

Short version: we collect only what the game needs to work. We don't ask for your email or real name, we don't show ads, we don't use third-party analytics or tracking, and we don't sell your data.

What we collect

• Account: your username and your password, which is stored only as a one-way hash (we can't read it).
• Gameplay: your races and typing tests (speed, accuracy, timing of keystrokes used for replays and anti-cheat checks), levels, cash, items, achievements, goals, streaks, and leaderboard positions.
• Social features: friends, teams, team and race chat messages, emote use, and reports you send or receive.
• Race reminders (optional): if you turn them on, your browser's push address and keys, so we can send at most one reminder a day. Turn them off in ⚙️ Settings and that browser's entry is deleted.
• Technical: a login cookie, and your IP address, which is used briefly to rate-limit signups, logins and typing tests and to stop abuse. Our hosting providers may also keep standard server logs.

What's public

Your username, profile, stats, race history, garage, team, achievements and leaderboard results can be seen by anyone, including people who aren't logged in. Typing test result links you share can be opened by anyone with the link. Chat is visible to the people in that room or team.

Cookies and local storage

We use one essential cookie (kgp_session) to keep you logged in for up to 30 days. Your browser's local storage keeps small preferences on your device, like sound on/off, dismissed announcements, and guest typing-test results. There are no advertising or tracking cookies.

Why we use it

To run races and leaderboards, save your progress, show replays and stats, keep the game fair (anti-cheat and rate limits), moderate chat, and fix problems.

Who else handles it

The game runs on cloud hosting (currently Render for the app and Neon for the database), which store and process data on our behalf. We don't share personal data with anyone else unless the law requires it.

How long we keep it

We keep your account and game history while your account exists. Login sessions expire after 30 days, and rate-limit records expire within about an hour. Moderation records may be kept longer to prevent abuse.

Your choices

You can ask to see or delete your account and its data. Deleting an account removes its races, items, friends, chat messages and other records. Contact the site owner (a contact address will be listed here) from your account (or with details that prove it's yours).

Children

PitKeys isn't directed at children under 13, and you must be 13 or older to create an account. If you believe a child under 13 has created an account, contact us and we'll delete it.

Security

Passwords are hashed, login tokens are stored only as keyed hashes, and connections use HTTPS. No system is perfectly secure, so please use a password you don't use anywhere else.

Changes

If we change this policy we'll update the date above and, for significant changes, post a notice in the game.