Privacy Notice

Last updated: May 23, 2026

1. Who we are

R&D STREAMS ("we", "us", "our") operates "42 — The Distance Game" (the "Service"). For personal data we collect to provide the Service, we act as the data controller.

2. Personal data we collect

• Account data — email address, display name, and authentication identifiers (including Google OAuth identifiers when used).
• Game data — rooms you create or join, guesses you submit, and results.
• Purchase data — credits you have purchased, when they were used, and the associated transaction reference. Card details are collected directly by Paddle, not by us.
• Technical data — IP address, device and browser information, timestamps, and basic usage logs needed for security and reliability.
• Support communications — messages you send us.

3. Why we use your data and legal basis

• To provide the Service (contract performance): authentication, running rooms, recording results, displaying your purchase history.
• To process purchases (contract performance): granting and consuming custom-room credits after Paddle confirms payment.
• Security and fraud prevention (legitimate interests): protecting accounts and the Service.
• Service improvement (legitimate interests): aggregate, non-identifying analysis of usage.
• Legal obligations: complying with applicable law, including tax and accounting where required.

4. How we share your data

• Paddle — our reseller and Merchant of Record for all sales. Paddle handles payments, billing, tax compliance, invoicing, refunds, and subscription management. See Paddle's privacy notice for how they process your data.
• Service providers / subprocessors — hosting, database, authentication, and email infrastructure providers that process data on our behalf under appropriate contracts.
• Authorities — where required by law, court order, or to protect rights and safety.
• Professional advisers — legal, accounting, and similar advisers when needed.

We do not sell your personal data.

5. International transfers

Some of our service providers (including Paddle) may process data outside your country. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Retention

We keep account and game data for as long as your account is active. Purchase records are retained as long as required for tax, accounting, and dispute-handling purposes. When data is no longer needed it is deleted or anonymized.

7. Your rights

Depending on your jurisdiction, you may have the right to access, rectify, erase, restrict, port, or object to processing of your personal data, and to withdraw consent at any time where processing is based on consent. You may also have the right to lodge a complaint with a supervisory authority.

To exercise these rights, contact us through the support channel in your account. We will respond within the timeframe required by applicable law (typically within one month under GDPR).

8. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, and row-level security on our database. No system is completely secure; we cannot guarantee absolute security.

9. Cookies

We use essential cookies and local storage strictly necessary to keep you signed in and operate the Service. We do not currently use advertising or third-party tracking cookies.

10. Children

The Service is not directed to children under the age required by your local law to consent to online services. We do not knowingly collect personal data from such children.

11. Changes

We may update this notice from time to time. Material changes will be communicated through the Service.

12. Contact

For privacy questions, contact R&D STREAMS through the support channel in your account.