Privacy Policy
Ghost Racer · last updated 31 August 2026
Ghost Racer is a mini game that runs inside TikTok. This page says exactly what it collects, what never leaves your phone, and what you can ask us to do about it.
Who is responsible
- Controller
- EcomTask UG (haftungsbeschränkt)
- Register
- HRB 35264, Amtsgericht Wiesbaden
- Address
- Rauenthaler Str. 12, 65197 Wiesbaden, Germany
- support@ecomtask.de
What stays on your device
Your game profile — progress, coins, diamonds, which cosmetics you own and wear, your best runs — is written to your browser's local storage inside the TikTok app. It is not sent to us and we cannot read it. Clearing the mini game's data on your device deletes it, and it is gone for good; we hold no copy to restore.
What we receive
A pseudonymous account identifier
When you open the game, TikTok gives us an open_id: an identifier that is unique to you within this game only. We do not receive your TikTok name, your profile picture, your email address or your phone number, and the identifier cannot be used to find you on TikTok. We use it to attach your progress to an account and to place you on leaderboards.
Gameplay data
When you finish a run we may receive the time, score, distance and the recorded inputs of that run. The inputs matter: the server replays them to confirm the run was actually played rather than typed in. Without that, a leaderboard is meaningless.
Purchases
If you buy diamonds, TikTok handles the payment. We never see your card, bank or address details — only a receipt reference and what was bought, so we can credit it to your profile.
Advertising
Rewarded video ads are served by TikTok, not by us. We do not choose the ads, do not receive advertising identifiers, and do not build a profile of you for advertising. The only thing we learn is whether an ad was watched to the end, because that decides whether you get the reward. Everything about how those ads are selected is governed by TikTok's own privacy policy.
Why we are allowed to do this
- Art. 6(1)(b) GDPR — performance of a contract: running the game, saving your progress, ranking your runs, delivering what you bought.
- Art. 6(1)(f) GDPR — legitimate interests: verifying runs and detecting cheating, so that the leaderboard means something to the people on it.
Where your data is processed
Accounts, runs and leaderboards are stored with Supabase, on infrastructure located in the United States. That is a transfer outside the EU, and it is covered by the European Commission's Standard Contractual Clauses. If you would rather not have gameplay data leave the EU, the honest answer is that you should not submit runs to the leaderboard.
How long we keep it
Your account, its progress and its leaderboard entries are kept while the game is live and your account exists. Ask us to delete them and we will, within 30 days. Runs that hold a leaderboard position may be kept in anonymised form (a time, with no identifier attached) so that historical records stay intact.
Your rights
Under the GDPR you can ask us for access to your data, its correction or deletion, restriction of its processing, a portable copy, and you can object to processing based on legitimate interests. One email to support@ecomtask.de is enough — no form, no account required beyond telling us which account you mean.
You may also complain to a supervisory authority. Ours is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden.
Children
Ghost Racer is not directed at children under 13, and we do not knowingly process their data. Age ratings are applied per region through TikTok. If you believe a child's data reached us, write to us and we will delete it.
Changes
If we change what we collect, we change this page and move the date at the top. Material changes will be announced in the game before they take effect.