Privacy Policy

Last updated 24 September 2026

1. Who is responsible

Doughnut runs doughnut.com and Doughnut Run, and is the data controller for the information described here. Contact us on X at @jagdotme about anything in this policy.

2. What we collect and why

• Playing without an account. Your level progress, best times and sound settings are saved in your own browser's local storage. They aren't sent to us.
• Account details. Your email address and a securely hashed password (we can't read it). If you sign in with Google, we receive your Google account ID and verified email address. We use these to run your account, verify your email, and send password resets. Legal basis: performing our contract with you.
• Player profile and scores. Your player name, optional social profile link, and each best run: level, doughnuts saved and lost, time, stars, and the list of tool placements in your run (so our server can replay and verify it). Your player name, social link and results are shown publicly on the leaderboard. Legal basis: contract.
• Adverts. Your advert's name, link, logo and other advert details, your bids, and payment records (order reference, amounts, status and Stripe session reference). Adverts are shown publicly in the game. Legal basis: contract, plus our legal duty to keep financial records.
• Security. We use a session cookie to keep you signed in. To stop abuse we count requests per action from each IP address. We store only a one-way hash of the IP, and those counts expire within an hour. Our host also keeps standard server logs. Legal basis: our legitimate interest in keeping the site secure.
• "Playing now" counter. While the game is open, it tells our server every 30 seconds that a game is running, using a random code that exists only in that browser tab. It isn't stored on your device and isn't linked to you, and we delete it after 10 minutes. Legal basis: legitimate interest in showing how many people are playing.
• Analytics. The game uses Google Analytics to measure visits and how the site is used. It sets cookies and collects details like your approximate location, device and pages viewed. It only runs if you accept analytics on our cookie banner. Legal basis: your consent.

3. Cookies and local storage

• doughnut_session: essential. It keeps you signed in and protects forms. It's deleted when you close your browser, or after two hours of inactivity.
• Google Analytics cookies (_ga, _ga_*): used for visit statistics. They only load if you choose Accept on our cookie banner. You can change your mind any time with Cookie settings.
• Local storage in your browser: game progress, settings, and a run you've asked to post after signing in. You can clear it at any time in your browser settings.

4. Who we share data with

We use these service providers, only for the purposes above:

• Hostinger: hosts the website and database.
• Stripe: processes advert payments under Stripe's privacy policy. Stripe receives your card details directly. We never do.
• Google: Google Analytics, and Google sign-in if you choose it.
• Our email delivery provider, which sends verification and password-reset emails.

We don't sell your personal data or use it for advertising profiles. We may disclose data if the law requires it. Some of these providers process data outside the UK. When they do, they use recognised safeguards such as the UK International Data Transfer Addendum or standard contractual clauses.

5. How long we keep it

• Account, profile and score data: until you delete your account. You can do that yourself at any time.
• Adverts: until you delete them or your account.
• Payment records: six years, to meet UK accounting and tax rules. This applies even if you delete the advert or your account. When an account is deleted, its payment records are kept without your email address or any other contact details.
• Rate-limit counters: up to one hour. Sign-in and verification links: until they're used or expire.

6. Your rights

Under UK data protection law you can ask us to access, correct, delete or export your personal data. You can also object to or ask us to restrict how we use it, and withdraw consent at any time.

Do it yourself, instantly: sign in and go to My account. Under Your data, Download my data gives you a copy of everything we hold about you. Delete my account erases your account, player name, scores, social link and adverts. You can change your player name, link and advert details on the same page, or delete a single advert.

For anything else, message us on X at @jagdotme and we'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

7. Children

Anyone can play the game without an account. Accounts are for people aged 13 and over. If you believe a child under 13 has created an account, contact us and we'll delete it.

8. Security

The site uses HTTPS. Passwords are stored as one-way hashes. Scores and payments are verified on our server. No system is perfectly secure, but we work to protect your data and will act quickly if something goes wrong.

9. Changes

We'll update this page if how we use data changes. The date at the top shows the latest version.