Privacy policy
Short version: the game is free and paid for by ads; we collect almost nothing, keep your lists in your own browser, and rooms clean up after themselves. The long version is below.
In short: Random Duck Race is free for everyone, and advertising is what keeps it that way. You never need an account to play, and racing asks for no personal information. Your lists, settings and race history are kept in your own browser. A room keeps only what it needs to run — names, ducks and chat — and deletes all of it when the room ends. Ads come from Google and sit in their own spaces beside the game; whether they may use cookies, and whether they may be based on your interests, is your choice, which you can change any time in Cookie settings. We don’t sell your data.
1. Who we are
Random Duck Race is made and run by an independent developer based in Vietnam (an individual, not a company) — “we” and “us” in this policy. We decide how the personal data described here is used, which makes us its controller under the GDPR. For any question about this policy or your data, write to support@randomduckrace.com.
We follow Vietnam’s law on personal data protection (Decree 13/2023/ND-CP), and we give everyone, wherever they live, the rights of the European GDPR (including the UK GDPR) and of California’s CCPA: see section 12.
2. What stays in your own browser
Most of what you do never leaves your device. The game keeps the following in your browser’s local storage, so it is there the next time you visit:
- your current race setup — the names, ducks and settings;
- the rosters you save and your race history (your last 100 races);
- your preferences — language, sound, graphics, keyboard shortcuts, lobby theme;
- for rooms: the name and duck you play with, and the rooms you have joined, so a reload takes you straight back in;
- your cookie choice (see section 8), so we don’t ask again on every visit.
We can’t see any of this. Clearing your browser’s data for randomduckrace.com removes all of it. The site also keeps a copy of its own files (a “service worker” cache) so it opens faster next time; it contains no personal data.
3. Share links
When you share a race, the setup — including the names — goes into the link. To keep that link short, the site stores the setup on its server (Cloudflare) under a short code such as /s/Ab3dE9xY, for up to a year after it was last shared; anyone with the link can open it. So only share names you are happy to share. To have a short link removed sooner, write to us with the link.
Result pages
When you choose Create a result page after a race, the result — the race’s name, the names and places of the first 100 ducks, the times, the ducks’ looks and your winner message — is published at its own address, such as /r/Ab3dE9xY, so you can share it. Anyone with the link can see it, so only publish names you are happy to share. The page can’t be edited and is kept for 12 months, then deleted. You can delete it sooner yourself: from the race in your history (in the browser you made it in), or, if you were signed in, from My result pages in your account. The link then only says the result was removed. We may also remove a page that is reported to us for what it says. Search engines are asked not to list these pages. To stop one person filling the site with pages, we keep a scrambled (salted hash) form of the address a page was sent from, which can’t be turned back into the address.
4. Rooms
When you create or join a room, our room server (run on Cloudflare) handles the room for as long as it is open. It keeps:
- each player’s chosen name, duck and card style, and a random player ID (no email, no account);
- the room’s chat — the most recent 40 messages — with the emoji answers and reactions sent;
- the race field and results, and the room’s settings;
- a lobby background picture, if the host uploads one.
Everyone in the room can see the names, ducks and chat. A room ends when the host closes it, about 30 seconds after the host leaves, or after 6 hours without activity — and everything in it is deleted. The host can also delete messages and remove players at any time.
5. Accounts (optional)
You can sign in with your Google account, but you never have to: every feature of the game works without one. When you do, Google tells us your account’s ID, your email address, your name and your profile picture, and we keep them in our database (Cloudflare D1) to know it’s you next time. We never see your Google password. Signing in sets a cookie that keeps you signed in for up to 30 days; the database keeps only a scrambled (hashed) form of it. Signing out ends it at once. While you are signed in, your saved lists and your race history are also kept on your account (in the same database), so they are there on every device you sign in on; on a device where you are not signed in they stay in that browser only. To delete your account and everything linked to it, including the synced lists and history, write to support@randomduckrace.com.
6. Messages you send us
When you use the contact or feedback form, what you write — and your name and email, if you give them — is stored in our database (Cloudflare D1) so we can read and answer it. To stop spam, we also store a scrambled (salted hash) form of the address your message came from, which can’t be turned back into the address, and count how many messages it sends. We keep messages and feedback for up to 24 months, then delete them (sooner if you ask). If the form can’t send, your email app opens instead and your message reaches us as an ordinary email.
“How was your race?” After a few races the game may ask for a one-tap rating. If you answer, we store the rating, anything you write under “What could be better?”, the page’s language, and what the rating was about: the race (how many ducks, the course, the time of day, alone or in a room, how many races this browser has run), how smoothly it ran (frames per second, slow frames, the graphics level and where the time went), and your device in general terms (phone, tablet or computer, its system, browser, screen size and country). No names, no email, nothing that identifies you — if you are signed in, the rating is linked to your account. We use it to find and fix what makes a race worse on some devices, and keep it for up to 24 months. Your browser remembers that you answered, so you aren’t asked again.
7. Your camera
The “Scan the QR code” button uses your camera only after you press it and allow it. The picture is read on your own device to find the room code; it is never recorded, stored or sent to us. You can also pick a photo of the code instead, which is read on your device in the same way.
8. Cookies and your consent
On your first visit, a small banner asks how we may use cookies and similar storage. You can accept all, reject everything optional, or choose category by category. Rejecting changes nothing about the game: every feature keeps working.
| Category | What it is for | Can you turn it off? |
|---|---|---|
| Necessary | What the game needs to work and to remember you asked it to: your setup, saved lists, settings, rooms and this cookie choice (in your browser’s local storage and the rdr_ck cookie), and, if you sign in, the sign-in cookie. Never shared. | No — always on |
| Analytics | Google Analytics 4: counting visits and which features are used, so we know what to improve (see below). | Yes — off unless you allow it |
| Advertising | Showing ads that keep Random Duck Race free, and measuring how they perform. | Yes — off unless you allow it |
We pass your choice on to Google through Google’s Consent Mode, so Google’s services only use cookies in the categories you allowed. Advertising is described in full in section 9.
Google Analytics. Only if you allow Analytics, the site loads Google Analytics 4 (by Google Ireland / Google LLC). Until then it isn’t loaded at all. It sets first-party cookies named _ga and _ga_… (kept up to 2 years) holding a random identifier, so visits from the same browser can be counted together. It records the pages you open, roughly where you are (country and city, worked out from your IP address, which Google Analytics 4 doesn’t log or store), your device, browser and language, how you arrived, and these moments in the game: a race starting and finishing (with the number of ducks, the course and the theme), a room created or joined, a share link or result page made, a result downloaded, a replay watched and a sign-in started. It never receives the names you race, your messages, your email or anything else you type. Data is kept for 14 months, then deleted, and Google’s data sharing settings for this property are switched off. You can turn Analytics off again in Cookie settings, or everywhere with Google’s opt-out browser add-on. How Google uses this data: policies.google.com/technologies/partner-sites.
Counting visits. We use Cloudflare Web Analytics, which counts page views without cookies and without following you from site to site: which page, the referring site, the country and the kind of device, in aggregate. Our own server also counts, anonymously, how the game is used — races started, rooms opened, short links made and opened, and the address of a site the game is embedded on. None of this uses cookies or stores anything in your browser, and none of it can be tied to you.
Your choice is kept in your browser (under the name rdr_consent, with the date you made it), and in a small first-party cookie, rdr_ck, kept for a year and holding only the choice itself — so the banner doesn’t come back when a phone’s browser clears the site’s storage. You can change it whenever you like: open Cookie settings at the bottom of any page or in the game’s menu, or use the button below. Clearing your browser’s data for randomduckrace.com removes it, and the banner will ask again.
9. Advertising that keeps the game free
Random Duck Race costs nothing to use and has no paid plan. To pay for running it, the site shows ads from Google AdSense. (Ads are being introduced: until the first ones go live, no advertising script loads at all.) This is how we do it:
- Ads stay out of the way. They sit in fixed spaces at the side or the bottom of the game page, never over the race, the setup or a button, and never as pop-ups between screens. There are no ads inside the race a phone follows in a room, on the join screen, or in the game embedded on another website.
- Google and its partners may use cookies. Third-party vendors, including Google, use cookies to serve ads based on your earlier visits to this site or other websites. Google’s advertising cookies let it and its partners serve ads based on your visits here and elsewhere on the internet.
- Your choice decides. If you allow Advertising in Cookie settings, ads may be personalised. If you don’t, Google shows ads that are not based on your interests and uses only the limited data it needs to show an ad at all, count it and fight fraud. In the European Economic Area, the UK and Switzerland, Google’s own consent message asks you before any ad uses cookies.
- Turn off personalised ads everywhere in Google’s Ads Settings, or opt out of many other vendors’ personalised ads at aboutads.info (in Europe: youronlinechoices.eu). How Google uses data from sites that show its ads: policies.google.com/technologies/partner-sites.
- Suitable for a classroom. Because the game is used in schools, we block categories of ads that are not suitable for a general audience (for example gambling, dating and alcohol). If you see an ad that shouldn’t be here, please tell us at support@randomduckrace.com with what it showed.
We never give advertisers your names, lists, messages, account or anything you type into the game. The ads are chosen and delivered by Google.
10. Services we rely on
Like most websites, the site loads a few files from trusted providers. When your browser fetches them, the provider receives the technical information any web request carries (such as your IP address and browser type). We send them nothing else.
| Provider | What for |
|---|---|
| Cloudflare | Hosting the website, the room server, the database (accounts and messages) and short links; delivering the 3D engine, QR code and Excel libraries (cdnjs); the anti-spam check on the forms (Turnstile) |
| Google Fonts | The fonts used on the site |
| Sign-in, only when you choose “Continue with Google”; Google Analytics 4, only if you allow Analytics (section 8); ads (Google AdSense), as described in section 9 | |
| jsDelivr | The confetti animation |
When you choose to share to WhatsApp, Telegram, Teams, Facebook, X or email, you leave our site and that service’s own privacy policy applies.
11. Children and classrooms
Random Duck Race is used in classrooms every day. We don’t knowingly collect personal information from children: nobody needs an account, an email address or a profile to play, and accounts are meant for teachers and hosts (13 or older, or older where the law requires; see the terms). If you think a child has made an account, write to us and we will delete it. Teachers can let players in one by one, switch the chat off, delete messages and remove players. We suggest students play with a first name or a nickname. Ads are limited to ones suitable for a general audience (see section 9); on a shared classroom computer, choosing Reject in the cookie banner keeps ads from being personalised.
12. Your choices and rights
- Delete your data: clear your browser’s site data for randomduckrace.com; delete a result page from your history or your account; or ask us to delete your account and everything linked to it.
- Change your cookie choice: open Cookie settings at any time. Withdrawing consent is as easy as giving it, and doesn’t affect what happened before.
- Turn off personalised ads: in Cookie settings here, and across sites in Google’s Ads Settings.
- Leave a room: press Leave, and your duck is taken out of the room.
- Your rights over what we hold: wherever you live, you can ask to see it, correct it, delete it, get a copy to take elsewhere, object to or restrict how we use it. Write to support@randomduckrace.com; we answer within 30 days, free of charge, and may first ask you to show the data is yours (for an account: by writing from its email address). Using a right never changes how the game treats you.
- Complain: you can complain to the data protection authority where you live (in the European Union, your national authority; in the UK, the ICO; in Vietnam, the Ministry of Public Security’s Department of Cybersecurity and High-Tech Crime Prevention, A05). We’d be glad to try to sort it out with you first.
What we hold, outside an open room: your account and the lists and race history it keeps, if you made one; the result pages and short links you made; the messages, feedback and ratings you sent us. Everything else stays in your own browser.
We do not sell or rent personal information, and we never have.
13. Why we may use it (legal bases)
| What we do | Why we may (GDPR) |
|---|---|
| Running a room, a share link, a result page, an account and its syncing; answering your messages | You asked for it: it is how the feature you chose works (performance of a contract, and steps you asked for) |
| The anti-spam checks and limits (the scrambled address), anonymous counting of how the game is used, Cloudflare Web Analytics, the race and device details of a rating, removing reported pages | Our legitimate interests: keeping the service working, fair, safe and improving, in ways that hardly touch your privacy |
| Google Analytics; cookies for ads and personalised ads | Your consent, given and withdrawn in Cookie settings |
| Keeping or giving data when the law requires it | A legal obligation |
14. Where your data is kept
We are in Vietnam, and the services we use (Cloudflare and Google) run data centres around the world, including in the United States. When data from the European Economic Area, the UK or Switzerland goes to a country without an adequacy decision, these providers protect it with the European Commission’s Standard Contractual Clauses (and the UK addendum); both also take part in the EU–US Data Privacy Framework. Ask us for details at support@randomduckrace.com.
15. California (CCPA / CPRA)
In the last 12 months we collected these categories of personal information: identifiers (for an account: Google account ID, email, name; for everyone: a random player ID in rooms and a scrambled address for anti-spam); internet activity (pages and game features used, through Analytics if you allow it); general location (country); device information (kind of device, system, browser, screen); and content you enter (names, messages, ratings, pictures). They come from you and your browser, and are used for the purposes in this policy.
We do not sell personal information. Personalised advertising can count as “sharing” under California law: it only happens if you allow Advertising in Cookie settings. To opt out (“Do Not Sell or Share My Personal Information”), open Cookie settings and turn Advertising off. We also honour Global Privacy Control: if your browser sends it, ads are never personalised, whatever is chosen in Cookie settings. You have the rights in section 12, may use an authorised agent, and won’t be treated differently for using them. We don’t use sensitive personal information, and we don’t knowingly sell or share the information of anyone under 16.
16. Changes to this policy
If we change how we handle data, we will update this page and the date at the top. Important changes will be announced in the changelog.