SLIPLAP

Privacy policy

Last updated 11 September 2026. This describes what Sliplap actually does with data — not what a template says a website might do.

Who we are

Sliplap is operated by Awais Mutahir, an individual, from Pakistan. For anything in this document — a question, a request for your data, or a complaint — write to awaisfazli947@gmail.com. A real person reads it.

Playing without an account

Most of Sliplap needs nothing from you. You open the page and you are driving. In that state we hold no account, no profile and no history of you. Your driver name is a temporary Guest_ label made in your browser for the session, and it is gone when you close the tab.

Two things still happen, as they do on any website. Our server keeps short-lived technical logs — IP address, browser, the pages requested — which exist to keep the service running and to stop abuse, and are not used to build a profile of you. And while you are in a race, your car's position and your driver name are in the server's memory and are sent to the other players in that room, because that is what a multiplayer race is. Nothing about that race is written to a database unless you set a lap time while signed in.

If you sign in

Google is the only way to sign in. When you do, Google gives us four things and we store them: your name, your email address, your profile picture URL, and the opaque Google account identifier that lets us recognise you next time. We never receive your Google password, and we have no access to anything else in your Google account.

From then on, we store what a racing game needs to have a memory:

• Lap times — the time, the circuit, when it was set, whether it was set in a race or in solo practice, and whether our server verified it.
• Lap recordings — the sequence of positions that lets a lap be replayed as a ghost car. It is a record of a car on a circuit, and nothing else.
• Race results — finishing positions in rooms you raced in.
• Settings — graphics, audio, controls and your driver name, so they follow you between devices.
• Friends — who you are friends with, who asked whom, the challenges between you, and your notification feed.
• Subscription status, if you buy premium — see below.

What we deliberately do not store

This is worth stating precisely, because it is unusual:

• Nothing is kept in your browser by the game. No localStorage, no sessionStorage. Your settings and personal bests are rows in our database reached through your session cookie, which is why a signed-out guest gets the defaults every visit.
• Chat messages are not stored. They are relayed to the other players in your room and then they are gone. There is no chat log, on the server or anywhere else.
• Who is online is only true right now. Presence lives in memory. If our server restarts, nobody is online — which is the correct answer rather than a stale one.
• We never see payment details. No card number, no billing address, ever reaches our server.

Cookies

Three kinds, and no others.

• A session cookie, set only when you sign in. It is signed, it identifies your account to our server, and without it there is no way to be signed in. It is strictly necessary and cannot be turned off separately from signing in.
• Google Analytics cookies (_ga and similar), which count visits and tell us which pages people arrive on. They are set by Google, and only if you accept them: analytics storage is switched off before the page loads, and stays off unless you say yes to the banner. If you decline, or block them with an ad blocker, a privacy extension or your browser's own settings, the game is completely unaffected. Nothing about Sliplap depends on being measured.
• Your answer to that banner, remembered for six months so we do not ask again on every page. It records nothing but the word granted or denied.

You can change your mind at any time, and it is no harder than saying yes was: reopen the cookie banner and choose again. You can also opt out of Google Analytics everywhere with Google's own browser add-on.

Analytics, in detail

We use Google Analytics 4, and it does not run until you accept it. It tells us how many people visited, which pages they landed on, roughly which country they were in, and what kind of device they used. It does not tell us who you are, and we do not send it your name, your email or your account identifier. Google processes that data as described in its own privacy policy, and may transfer it outside your country.

Payments

Sliplap Premium is sold through Lemon Squeezy, which acts as the merchant of record. When you buy, you are sent to their checkout, and everything you type there — card details, billing address, tax information — is theirs and never touches our server.

What we store is only what we need to know that you have paid: an identifier for the subscription, its status, and its renewal or end date. That record is written by a signed message from Lemon Squeezy to our server. Your browser is never able to tell us that you have paid, which is deliberate.

Lemon Squeezy's handling of your data is covered by their privacy policy.

Who else sees any of this

We do not sell data, and we do not share it for advertising. It reaches exactly four kinds of third party, each for one job:

• Google — sign-in, and analytics.
• Lemon Squeezy — taking payments.
• Our hosting and database provider — running the servers the game and its data sit on.
• Anyone we are legally required to tell, if it ever comes to that.

One thing that is public by design: if you set a lap time while signed in, your driver name and that lap time can appear on a leaderboard other players can see, and your lap can be replayed by them as a ghost. Your email address is never shown to another player.

How long we keep it

• Lap times are kept indefinitely. A driver's history is theirs, and nothing prunes it — that is a deliberate design decision, not an oversight.
• Your account, settings and friends are kept while your account exists.
• Subscription records are kept while required for tax and accounting.
• Server logs are short-lived.
• Chat, presence and race state are not kept at all.

Your rights

Wherever you live, and regardless of which of these formally applies to you, we will honour all of them:

• See it — ask for a copy of everything we hold about you.
• Correct it — your name and picture come from Google and update on your next sign-in.
• Delete it — ask and we delete your account and the data attached to it.
• Take it with you — ask for it in a machine-readable file.
• Object — to analytics, by blocking it, which needs no permission from us.

Email awaisfazli947@gmail.com. We aim to answer within 30 days, and there is no charge. If you are in the EEA or the UK, you also have the right to complain to your national data protection authority.

One honest caveat about deletion: if a lap of yours is removed, it disappears from the leaderboard, and any record it held passes to the next driver. We cannot delete an account and keep its lap times standing.

Legal bases, for EEA and UK users

• Performance of a contract — your account, your lap times, your friends list, your subscription. Without these there is no game to provide.
• Legitimate interests — keeping the service up, preventing cheating and abuse, and understanding roughly how many people use it.
• Consent — analytics cookies, where consent is required in your country.
• Legal obligation — keeping payment records.

Children

Sliplap is not directed at children under 13, and you must be at least 13 to create an account — 16 in countries where that is the local threshold for consenting to data processing. We do not knowingly collect data from anyone younger. If you believe a child has an account, write to awaisfazli947@gmail.com and we will delete it.

International transfers

Our servers, and the services above, may process your data outside your own country, including in the United States and the European Union. Where the law requires a safeguard for that transfer, our providers rely on the European Commission's standard contractual clauses.

Security, stated honestly

Sessions are signed cookies, traffic is encrypted in transit, payment details never reach us, and the game's protocol cannot express a position or a lap time from a browser at all. No system is perfectly secure, and we will not claim otherwise. If you find a vulnerability, please tell us at awaisfazli947@gmail.com before telling anyone else.

Changes

If this policy changes in a way that matters, the date at the top changes and the new version is published here before it takes effect. We will not quietly start doing something this document says we do not do.

Next: the terms of service, or back to the game.