Privacy Policy
This policy explains what personal data Steer It collects, why, how long we keep it, and the rights you have. It is written to comply with the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller for Steer It (steerit.app) is:
We are not registered for VAT. For any privacy question or to exercise your rights, email the address above.
2. Who this applies to — hosts vs. phone players
Steer It is a party game. One person (the host) runs the game on a computer or tablet; other people join with their phones by scanning a QR code and use the phone as a tilt controller.
- Hosts with an account — only the host can create an account. This policy mainly concerns that account data.
- Phone players — do not register and provide no personal data. Their phone only sends steering/pedal inputs to the host's screen for the duration of a game. We do not collect names, contacts or profiles from phone players. (A player may type a temporary in-game nickname on their own device; it is used only to label their car during that session.)
You can play Steer It for free without any account at all.
3. What data we collect
Account data (host accounts only)
- Email address (for sign-up, login, verification and password reset).
- Nickname (your chosen display name).
- Language / settings preferences.
- Premium status (whether the account has purchased Premium).
- Device records — a rolling record of up to 5 devices, used to enforce a fair-use device limit.
- Last login time.
Payment data
Payments are processed by Stripe. Your name, billing address, payment method and transaction history are provided directly to Stripe and handled under Stripe's own privacy policy. We store only a Stripe customer ID and your Premium status. We never receive or store full card details.
Technical data
- IP address, kept in server logs for up to 30 days, used for security, abuse prevention and diagnostics.
- Browser user-agent string, for the same purposes.
What we do not collect
- No trading or financial-market data of any kind.
- No precise location — at most a country-level inference from your IP.
- No social-media profiles.
- No card details (these stay with Stripe).
4. Why we use your data (legal bases)
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account | Email, nickname, settings, premium status | Performance of a contract (Art. 6(1)(b)) |
| Process your Premium purchase | Stripe customer ID, premium status | Performance of a contract (Art. 6(1)(b)) |
| Device limit (fair use) | Device records | Legitimate interest — preventing account sharing/abuse (Art. 6(1)(f)) |
| Security, abuse prevention, diagnostics | IP, user-agent, logs | Legitimate interest — protecting the service (Art. 6(1)(f)) |
| Sending account emails (verification, password reset) | Performance of a contract (Art. 6(1)(b)) |
5. Cookies and tracking
We use only an essential cookie / local session token so that a logged-in host stays logged in (provided by our authentication provider, Supabase). This is strictly necessary to run the service, so no cookie-consent banner is required.
We use Vercel Web Analytics, a privacy-friendly and cookieless analytics tool, to understand how the game is used. It records aggregate usage only: page views, the site you arrived from, your approximate country, and your browser/device type.
Alongside this we record a small number of anonymous product events that tell us how far people get, so we can find and fix what is broken — for example that a game session was opened, that a phone connected or failed to connect, and that a race started or finished. These events carry no personal data: no names, no email addresses, no player or device identifiers, no game room codes, and no IP addresses are stored with them. The only detail attached is a plain count, such as how many players were in a session.
We use this solely to improve the game. It sets no cookies, does not follow you across other websites, and is never used for advertising, profiling, or automated decision-making. There is no Google Analytics, no Meta Pixel, and no advertising trackers. Our legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in understanding and improving our own service; because the data is aggregate and cookieless, it cannot be used to identify you.
6. Who we share data with (sub-processors)
We use a small number of trusted service providers ("sub-processors") to run Steer It. They process data only on our instructions and for the purposes below.
| Provider | Purpose | Location / transfer safeguard |
|---|---|---|
| Supabase | Database & authentication (account data) | EU — Frankfurt, Germany |
| Stripe | Payment processing | USA — EU Standard Contractual Clauses (SCCs) |
| Vercel | Website hosting / CDN, and cookieless aggregate analytics (Vercel Web Analytics) | Global CDN — SCCs where applicable |
| Resend | Transactional email (verification & password reset only) | USA — SCCs |
| Cloudflare | Real-time connection relay (TURN) — network traffic only | Global — no personal data stored |
Where a provider is outside the EU/EEA, the transfer is protected by the European Commission's Standard Contractual Clauses (SCCs) or an equivalent safeguard.
7. How long we keep data
- Account data — kept while your account is active.
- Deleted accounts — purged within 30 days of deletion.
- Server logs (IP, user-agent) — kept for 30 days, then deleted.
- Payment records — held by Stripe under their retention rules and may be retained by us as required for accounting/tax law.
8. Your rights
Under the GDPR you have the right to: access your data, rectify inaccurate data, request erasure, request portability of data you provided, restrict or object to certain processing, and withdraw consent where processing is based on consent.
To exercise any right, email steeritapp@gmail.com. We aim to respond within 30 days.
You also have the right to lodge a complaint with the Czech supervisory authority: Úřad pro ochranu osobních údajů (ÚOOÚ), www.uoou.cz.
9. Security
We protect your data with row-level security (RLS) on the database, HTTPS/TLS in transit, password hashing handled by our authentication provider, and encryption at rest. No online service can be guaranteed 100% secure, but we take reasonable technical and organisational measures to protect your data.
10. Data breaches
If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours where required, and affected users without undue delay, in line with GDPR Articles 33 and 34.
11. Children
Steer It is a general-audience game. However, creating an account requires the host to be 15 years of age or older — the age of consent for data processing in the Czech Republic. We do not knowingly collect personal data from anyone under 15. Phone players provide no personal data. If we learn that an account belongs to someone under 15, we will delete it.
12. Changes to this policy
We may update this policy as the service evolves or the law changes. We will update the "Last updated" date above and, for significant changes, take reasonable steps to notify account holders.
13. Contact
Questions about this policy or your data: steeritapp@gmail.com.