GETAWAY – Privacy Policy Last updated: 12 October 2026 Privacy Policy for the app "GETAWAY". It applies worldwide, in every country where the app is offered. Controller: STONCOM Group, Dresdnerstr. 11, 75417 Mühlacker, Germany, e-mail: info@stoncom.com. In short: GETAWAY needs no login. On first launch the app creates a game account that is linked to your iPhone only by a random device token (not an advertising identifier). We do not sell data, we do not track you across other companies' apps and websites, and ads are not personalized. What our server holds – and what it does not: the server only stores what the online game needs: your driver name, random identifiers (account, device, player ID), your progress and results, friends, and the records of purchases and online games, plus technical usage and error data (section 1). We never ask for your real name, e-mail address, phone number, contacts, photos or precise location, and we use no advertising ID. Your settings and the rest of your save stay on your iPhone. One standard for everyone: we handle every player's data the same way – to the standard of the EU General Data Protection Regulation (GDPR), whatever country you play in. Section 7 says what applies in addition in some regions. 1. WHAT WE PROCESS AND WHY - Game account: a random device token (kept in the iPhone's Keychain), your public player ID, the driver name you choose, avatar, title, level and XP – so the online parts work (leaderboards, friends, online modes). Legal basis: Art. 6(1)(b) GDPR (contract). - Progress and results: scores, best times, leaderboard entries, missions, rewards, coin ledger, friends, gifts and invites between friends. Your progress (coins, garage, settings) is also stored on your iPhone. Art. 6(1)(b) GDPR. - Online duels and tournaments: the course of your run (inputs, positions, events, result), your rating and, for contests with an entry fee, entries and payouts – to verify results and fairness (anti-cheat) and to pay pots correctly. Recorded runs may be shown to other players as an opponent ("recording") with your driver name. Art. 6(1)(b) and (f) GDPR (fair contests). - Purchases: payment is handled by Apple only; we never receive payment details. Our server verifies the transaction Apple signs (product, transaction id, purchase and expiry date, environment) and credits coins, "Remove Ads" or GETAWAY CREW; Apple notifies our server of renewals, cancellations and refunds. Art. 6(1)(b) GDPR. - Usage and diagnostics: screens and modes used, frame rate, load times, error and crash reports, device model and app version – to improve the game and fix bugs. Art. 6(1)(f) GDPR. Deleted after 180 days. - Problem reports: when you report a problem in Settings, your message, its category, device model, app version and a technical log. Art. 6(1)(b) and (f) GDPR. - Notifications (only if you allow them): your device's push token, e.g. for friends' invites. Art. 6(1)(a) GDPR (consent through iOS, revocable at any time). - Camera (only when you use it): to scan a friend's QR code. The picture stays on your iPhone. 2. ADVERTISING (GOOGLE ADMOB) The app shows videos you choose to watch (for example "Watch a video: +1 key"), occasionally an ad when you return to the main menu, and labelled ad tiles between the modes on the home screen and on the Online screen (the last two not with "Remove Ads" or GETAWAY CREW). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We request non-personalized ads only (no advertising ID, no app tracking, no App Tracking Transparency prompt), content rating "G". Google processes technical data (for example IP address and the coarse location derived from it, device type, ad interactions, diagnostics) to serve ads, prevent fraud and measure. In the EEA, the UK and Switzerland the app first asks through Google's consent form; you can change your choice in Settings. Google's privacy policy: https://policies.google.com/privacy 3. RECIPIENTS AND LOCATION Our server runs on Supabase (Supabase Inc., USA) in the EU West (Ireland) region; Supabase processes data on our behalf (Art. 28 GDPR), EU Standard Contractual Clauses cover access from the USA. Purchases and notifications go through Apple, ads through Google (see 2). Other players only see what a game shows: driver name, player ID, avatar, title, level, results and ratings. 4. RETENTION Account data, progress, friends, results and purchases while your account exists; usage events 180 days, weekly leaderboards 70 days, Apple purchase notifications 400 days; purchase records and the coin ledger as long as commercial and tax law require. 5. DELETE YOUR ACCOUNT Settings → Account → Delete account deletes your game account and everything linked to it (device token, sessions, events, bug reports, friends, leaderboards, rewards, online runs); open online games are settled fairly first. A running subscription is cancelled with Apple (iPhone Settings → your name → Subscriptions); deleting the account does not end it. 6. YOUR RIGHTS Access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and withdrawal of consent for the future (Art. 15–21 GDPR). Write to info@stoncom.com with your player ID (Settings → Account). You may complain to a data protection authority. 7. INTERNATIONAL The app is offered worldwide; this policy applies everywhere. - Where the data is: on servers in the EU (Ireland). If you play outside the EU, your data is transferred to and processed there. Apple and Google process data for purchases, notifications and ads under their own responsibility in other countries too, including the USA. - EEA, United Kingdom, Switzerland: the GDPR, the UK GDPR and the Swiss FADP apply, with the rights of section 6. - USA (including California – CCPA/CPRA – and other states with privacy laws): we do not sell personal information and do not share it for cross-context behavioral advertising. You may ask to know, correct and delete your information, and you are not treated differently for exercising a right. We collect no sensitive personal information. - Every other country (for example Canada, Brazil – LGPD –, Australia, Japan, South Korea): you have the same rights with us to access, correct and delete your data as in section 6, plus those your country's law gives you. Write to info@stoncom.com; we answer within one month. - Deleting works everywhere without us: Settings → Account → Delete account (section 5). 8. CHILDREN GETAWAY is rated 13+ and is not directed at children under 13 (or under the higher minimum age of your country). We do not knowingly collect data from children under 13; if we learn of it, we delete the account. Purchases by minors need their parents' consent (Apple's "Ask to Buy" is supported). 9. SECURITY The connection to the server is encrypted (TLS), access to the database is limited to what is needed, and your account can only be reached through the token in your iPhone's Keychain. 10. CHANGES When the app changes we update this policy; the date above shows the version.