Privacy policy

Data that stays on your device

Your pilot profile lives in your browser's local storage: XP, credits, medals, streaks, cosmetics, achievements, settings, personal-best times with their ghost recordings, your pilot call sign, two random device identifiers the game mints on first run (used to recognize this device — they contain nothing about you), and a random device key minted with them, which proves to our server that a leaderboard time, a wallet link, a referral or a reminder subscription really comes from this device. Shortly after the game first loads, it sends this device's identifier and key to our server, which keeps the identifier with a one-way fingerprint of the key — never the key itself — in a record no one else can read. If you link a wallet, a copy of much of the profile is also kept on our servers (see Wallet linking below). Clearing your browser's site data removes all of it from this device, and we cannot restore it for you. If you had linked a wallet and not deleted its wallet profile, linking it again on the pilot dossier lets you restore the wallet's copy — but only before you open the game again, which starts a fresh profile.

Data you choose to publish

Submitting a time to the global leaderboard sends your chosen call sign, the stage, your time, the run's input tape, and this device's random identifier — plus, while a wallet is connected in this browser, the wallet's public address — to our database (hosted on Supabase). The input tape is the sequence of controls you used — throttle, brake, steering, gear — and we store it because our server re-drives every submitted run to check the time before posting it, which is also how anyone can watch a board run as a replay. The ghost car stored with an entry is our server's own re-drive of that tape, not a recording made on your device. All of it is public by design, the device identifier and any wallet address included: anyone can see the call sign and time, watch the replay, and download the ghost to race against. Shared tuning presets and published community stages work the same way. If you want an entry taken down, reach us through any channel listed on this site and we will remove it.

Each submission also carries this device's key. Our database keeps only a one-way fingerprint of it — never the key — and accepts a time under this device's identifier only with the matching key, so nobody else can post a time in its name.

So that a run goes on the board only once, our database also keeps a one-way fingerprint of every run it re-drives, worked out from what the rover did in it, with the identifier of the device that first submitted the run, the board it ran on and its time. The same run submitted from any other device is refused. The fingerprint is not public, and it stays when an entry is taken down, so a removed run can't be posted again; ask us and we will remove the device identifier from it.

Online multiplayer

During an online race, your call sign and live car telemetry are relayed to the other pilots in your room through our race server for the duration of the race. When you finish an online race, the game submits your time to the leaderboard under that call sign, and it follows the rules above. The race server also hands your game a signed note saying you raced in that race. With it, the board tags your time ONLINE and files your call sign, time and input tape under the race, even when the time is not your best, so anyone with the race's link can watch every finisher together. Those race entries are public too, and we remove them on request like any other entry.

Referral links

Links you share from the game carry this device's random identifier, so that a new pilot who arrives through one can be credited to you. If you open the game from such a link, your device keeps the sharer's identifier, and when you finish your first stage the game sends it to our server together with this device's identifier and key. We check the key and store the two identifiers and the time, once per device. You get a supply crate for that finish, and the sharer's game counts the pairs that name it to pay one for each new pilot.

Those pairs are public: anyone can read them through the public database interface the game itself uses. They hold no call sign and no wallet address, but the identifiers are the same ones that appear beside leaderboard times. If you arrived through a shared link and would rather not be counted, clear this site's data before you finish a stage — the game's progress on this device goes with it — or reach us through any channel listed on this site and we will delete the pair.

Wallet linking

Linking a Solana wallet — on the pilot dossier, or with the Connect chip in the site header — is optional, and nothing in the game needs it. Your wallet asks you to sign a short message, “Link this wallet to your Mars Rally Championship pilot profile”, with a single-use code in it. Signing is not a transaction: nothing is paid and no funds move. The link sends us the wallet's address, the signed message and its signature, your profile, and this device's identifier and key, so the wallet can claim the times this device set. We check the signature and keep the address, but neither the message nor the signature, and of the key only its fingerprint.

Under that address we keep a wallet profile with:

• the random identifier of this device and of every other device you link the wallet from, each proven with its key;
• a copy of your game profile as it was when you linked, including XP, credits, medals, cosmetics and crates; streaks and the days you last played; achievements and when you unlocked them; career totals such as runs, finishes, distance and top speed; the furthest gate you reached on each stage and the last stage you drove; the day's quests and challenge time; season best times; whether you allowed reminders; and when you last turned down the install prompt. Linking again from a device that has a profile replaces the copy. Your settings and your per-stage personal bests with their ghost recordings are not in it;
• the call sign you claim there, if you claim one;
• when the profile was created and last changed.

Linking also puts the address on this device's runs that are already on the leaderboard and on their ghosts — that is the verified badge — and keeps only the wallet's fastest run on each board, so the board shows you once. From then on, while the wallet profile exists, every run that goes on the board from a browser where the wallet is connected carries the address on its board entry and on its ghost, an online race's automatic post included.

The address on your board entries and their ghosts is public, next to the device identifier each run was posted from. Other players see at most a ✓ beside your time, and you see a shortened address in the site header and on the dossier, but anyone can read the full address through the public database interface the game itself uses, and so tell which runs carry it. A call sign you claim is public too, on the runs you post under it. A wallet address is public on its blockchain as well, so linking ties your Mars Rally runs to everything else that address has done: link one you are happy to make public. The wallet profile itself is not public: only our server reads it, to show it back to you on the dossier and to restore it to another device.

To stop, press Disconnect on the pilot dossier. It deletes the session cookie described below, and runs you submit from this browser afterwards carry no address. Your wallet may still list this site as connected; remove it there. Disconnecting deletes nothing already stored.

To delete what a link stored, press Delete wallet profile on the pilot dossier while the wallet is connected, then confirm. In one step we delete the wallet profile — the list of devices you linked, the copy of your game profile that restoring uses, and the claimed call sign, which is then no longer held for the wallet — and take the address off every board entry and ghost that carries it; the session cookie goes too. Your times stay on the board under their call sign and device identifier, without the ✓, and the slower runs that linking removed from the board do not come back. The profile in your browser is not touched.

From then on no run carries the address, from any browser: another browser still connected to the wallet posts its runs without it, and is signed out the next time it opens a page of this site. Linking the wallet again later starts a new wallet profile and puts the address back on the runs of the device you link from. Copies that our hosting providers keep in their logs and backups expire on their own schedules. If you no longer have the wallet, reach us through any channel listed on this site and we will delete its wallet profile for you.

Cookies

This site sets one cookie of its own, and only when you link a wallet: mrc_session. It holds a token, signed by us, that names your wallet's public address — that is how the leaderboard knows a run is yours. It is httpOnly, so scripts on the page cannot read it; it travels only over HTTPS and only to this site; and it lasts 30 days. While you keep using the site — opening its pages or posting times from the game — we set it again, at most once a week, so it lapses only after a few weeks away, and at the latest six months after you link: then you link again. We set no advertising or analytics cookies. Disconnect and Delete wallet profile on the pilot dossier both delete it, and so does clearing this site's cookies in your browser; either way the wallet is no longer connected in this browser. Once its wallet profile is gone, we delete it ourselves the next time this browser opens a page here. Only Delete wallet profile also deletes what the link stored. YouTube's player may set cookies of its own once you press play on a stage video (see Third-party services below).

Daily reminders

Once you have a two-day streak, the results screen offers a reminder. NO THANKS sends nothing, and the game won't ask again on this device, though you can still switch reminders on later in Settings. REMIND ME asks your browser for permission to show notifications. If you allow it, two things happen. While the game is open, it reminds you after 9 pm your local time if you haven't driven that day — that reminder is made on your device and sends nothing. And your browser gives us a push subscription, so we can send one notification a day, early in the morning UTC, saying the new daily challenge is live, even when the game is closed.

We store that subscription — an address at your browser's push service, run by Google, Mozilla, Apple or Microsoft, plus the keys that encrypt our messages to it — with this device's random identifier, when it was made, and a count of failed deliveries. It holds no call sign and no wallet address, and it is never public: only our server can read it. The request also carries this device's key, so no one else can sign up reminders in this device's name; as everywhere, we keep only the key's fingerprint.

To stop, open Settings in the game and switch Daily reminders to OFF. The evening reminder stops, the game cancels the subscription in your browser and asks our server to delete it straight away, and switching back ON asks your browser again. You can also turn off notifications for this site in your browser's settings, or clear this site's data: your browser then drops the subscription, and we delete it once its push service refuses our next send (one that fails five sends in a row for any other reason is deleted too).

Drive diagnostics

This one is automatic rather than something you choose, so here it is in full. When a drive ends — whether you finish, restart, quit, or just close the tab — the game sends us the path your rover took: a few hundred points of position, height and speed, plus a coarse summary of what the pedals and steering were doing, sampled about five times a second. Alongside it go the stage, the mode, how the drive ended, how far you got, and this device's random identifier, so we can tell one player's four attempts at the same corner apart from four different players. There is no call sign, no account, no IP address and no message in it.

We record it for one reason: most people who start a stage never finish it, and counting that tells us nothing about why. A drawn path shows the corner that spins everyone, the rock people get stuck on, the place where they turn around. These traces are a developer tool — they are never published, never shown to other players, and never shared with anyone else. They are deleted automatically after 30 days.

You can turn this off: open Settings in the game and switch Sharing drive paths to OFF. Nothing is sent from that point on, and the rest of the game works exactly as before.

Analytics

We use Vercel Web Analytics — a cookieless, privacy-first service — to count page views and a small set of gameplay events (including game loaded, stage started, first movement, stage finished or ended early, rover written off, tutorial lesson reached, tutorial finished or skipped, daily reminders switched on, race room created or joined, online race started, finished or left early, share button used, error reports with a truncated technical message). These events carry no names, no identifiers from your profile, and no way for us to follow you across sites. Standard server logs at our hosting providers (Vercel, Supabase) may briefly record IP addresses for security and abuse prevention, as with virtually every website. To stop the leaderboard, device-registration, wallet-linking, wallet-profile deletion, referral and reminder requests being abused, our own database counts them per network for up to a day — under a keyed, one-way fingerprint of the network address, never the address itself.

Third-party services

The game's 3D engine, database client and multiplayer client are served from this site, which is hosted on Vercel, and online features are stored in Supabase. Each receives the network requests necessary to serve those functions and nothing more. Daily reminders reach you through your browser's push service, run by Google, Mozilla, Apple or Microsoft. Wallet linking runs in your own wallet extension or app — Phantom, Solflare or Backpack, for example — and that wallet's privacy policy covers what it collects. We embed no social widgets and no ad networks. A stage guide with an onboard video shows our own still image until you press play; only then does the video load, from YouTube's privacy-enhanced player (youtube-nocookie.com), and Google's privacy policy covers what that player collects.

Children

The game is suitable for all ages and never asks anyone — children included — for an email, an age or a location. The only name it asks for is a call sign, which can be anything: please don't put personal details in one.

Changes

When a feature touches new data, this page is updated in the same release, with the effective date above. Wallet linking, daily reminders and referral links went live in August 2026 before this page described them: the revision of 4 October 2026 added the first two and the session cookie, and this one adds referral links and the Settings switch for daily reminders. It also makes the wallet profile private — until then anyone could read it through the public database interface the game uses — adds Delete wallet profile, and lets the session cookie renew itself while you use the site.