Privacy policy

Effective 22 October 2026

One More Lap is a time attack racing game for Android, made by box.create ("we"). This page explains what the game collects, why, who can see it and how to delete it. If you have a question, email onemorelap@boxlore.in.

The short version

You never give us your name, email or phone number. The game signs you in with a random player ID, or with Google Play Games if you use it, so your progress follows you to a new phone.
Your fastest laps go to our server, which replays them to check them and shows them on public leaderboards under a generated name, such as "Swift Gull 4821".
The game uses Google Analytics for Firebase to learn how it's played, such as which tracks are raced and finished. It doesn't use your advertising ID.
You can delete everything online from the app at any time.

What stays on your phone

Your best laps, sector times, unlocked tracks and settings (ghost, sound, haptics and the last track you picked) are saved on your phone. Laps waiting to upload are kept there until our server answers. Uninstalling the app or clearing its data removes them from your phone; the backup on our server stays until you delete it. If you turn on the daily reminder in Settings, the reminder is scheduled on your phone and nothing about it is sent anywhere.

What we collect

A player ID. The first time you open the game, it signs you in with Google Firebase Authentication. If your phone uses Google Play Games, it signs you in with Play Games, so the same player comes back on a new phone or after a reinstall; Firebase may keep your Play Games gamer name and picture with that ID. Otherwise the ID is random and anonymous. We never receive your email address.
Your progress. So it can come back on a new phone, the game backs up the tracks you unlocked, the days you raced the daily track, your recent lap times, attempts and best sector times on each track, and your settings, linked to your player ID. Only you see it, in the game.
Laps you upload. When a lap is faster than the best you already have online (or is your fastest today on the daily race track), the game sends its steering inputs, its lap and sector times, the track and the app version.
How you play. Google Analytics for Firebase records events such as the screens you open, laps you start, finish or end early (with the track, lap time and medal), tracks you unlock, settings you change and the driving lesson, with general details about your phone and the app: its model, Android version, app version, language and approximate country. These events are linked to a random analytics ID on your phone, not to your player ID, name, email or advertising ID.
Your generated name. We create a random name for your player the first time a lap is accepted. You can change it in the app (Settings → New name). You can't type a name.
App integrity. When the game talks to our servers it asks Google Play Integrity, through Firebase App Check, to confirm the request comes from a genuine copy of the game. Google processes details about your phone and the app for that check under its own terms; we receive only a short-lived token that says the check passed.
Errors. If the game hits an unexpected error, Google Analytics for Firebase records the kind of error and the part of the game it happened in, with the same general phone and app details as other events. No lap data or personal details are included.
Challenge links. When you install the game from a challenge link, Google Play passes the challenge's track and lap ID to the game once, so it can open that challenge; nothing else is in it.
Technical data. When the game talks to our servers, our service providers process your IP address and basic request details to deliver the request and protect the service from abuse.

We don't collect your precise location, contacts, photos, files, device identifiers for advertising, or payment details.

Why we use it

To run the leaderboards, the daily race board and online ghosts.
To keep times fair: our server replays every lap with the game's own physics and publishes only its own time.
To find and fix problems: a lap the server refuses is kept for 30 days so we can check whether the game or the server made a mistake.
To learn how the game is played and make it better, for example which tracks are too hard.

Who can see it

Everyone who plays. Leaderboards show your generated name, your lap and sector times and your rank. Other players can download a lap's inputs to race it as a ghost.
Our service providers, only to run the game for us: Google Firebase (sign-in and Google Analytics), Cloudflare (network and request handling), netcup GmbH (the server that checks laps and stores records) and Google Drive (encrypted backups). They may keep short-lived technical logs under their own terms.
Google Play Games, if you use it, keeps your achievements under Google's own privacy policy.

We don't sell your data or share it for advertising.

How long we keep it

Online records (player, name, accepted laps): until you delete them.
Refused laps: 30 days.
Our own server logs record requests without your player ID or IP address and are kept for 14 days.
Encrypted backups of the records database are kept for about 8 weeks, so deleted records leave the backups within that time.
Google Analytics events: 14 months.

Deleting your data

In the app, open Settings and tap Delete my online records, then Delete records. This deletes your player, name, laps, ghosts, ranks and progress backup from our server and deletes your player account. Everything on your phone stays; if you keep playing, it's backed up again as a new player. Achievements stay in Google Play Games. Google Analytics events aren't linked to your player, so this doesn't delete them; they're deleted after 14 months. Full steps are on the delete your data page.

Children

One More Lap is not directed at children under 13, and it never asks anyone for personal information.

Changes

If this policy changes, we'll update this page and the date at the top.

Contact

Email onemorelap@boxlore.in.