Legal
Privacy policy
This policy explains what personal data the jak-x.online website and the Jak X Online game servers use, why, and the rights you have over it under the General Data Protection Regulation (GDPR).
Last updated:
Who is responsible
The data controller is the Jak X Online team. For anything about your data, write to us through our Discord server (Support channel) (opens in a new tab).
What data we use
- Website account: nickname, email address, password (stored only as a one-way hash), language, time zone, your choices (favourite racer, car and medals, which emails you want, the events you asked to be reminded of) and your two-step sign-in settings (temporary codes and the authenticator secret).
- Game account: name and number, password (stored as a hash), stats, records and ghosts, friends, clan and clan messages, match history and race replays.
- Twitch channel, if you link it from My account: its Twitch id, name and picture. Twitch's sign-in only tells us who you are there; we keep no Twitch password or token. While you stream Jak X, the home page shows your stream with your racer name. You can unlink it at any time.
- Jak X Online Launcher, if you connect it to your account (you approve its code on the /activate page): the computer's name, its system and the launcher's version, when it was connected and last used, and your play sessions (start, length, game version and whether the game closed unexpectedly). The launcher gets its own key, kept on your computer; we only store a fingerprint of it, never your password. You can disconnect it from My account at any time.
- Cloud save, while the launcher is connected and you keep it on: the memory card of each game version (which also holds your in-game online accounts) and, if you choose, your controls. It is stored encrypted, only you can download it, the last 5 copies of each version are kept, and it is deleted with your account or when you delete it from My account.
- Security data: the IP address and the console or emulator identifier you connect from, the history of addresses your game account signed in from, sanctions and anti-cheat logs. On the website, your IP address is used to limit failed sign-in attempts (kept in memory for a few minutes).
- Emails we send you, and the early access codes you redeem.
Why we use it and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Run your accounts, the game servers, stats, records, friends and clans | Providing the service you asked for (art. 6.1.b) |
| Account emails: activation, security codes, password resets | Providing the service (art. 6.1.b) |
| Keeping the servers safe: anti-cheat, sanctions, stopping abuse and multi-accounts | Our legitimate interest in a fair and secure service (art. 6.1.f) |
| News emails and event reminders | Your consent, which you can withdraw at any time in My account › Notifications (art. 6.1.a) |
| Answering the authorities when the law requires it | Legal obligation (art. 6.1.c) |
We do not sell your data, we do not show advertising and we do not use your data to build profiles.
What other players see
Your racer name, stats, records, clan, friends list status and whether you are online are visible to other players, in the game and on this website. Your email address and IP address are never shown.
Who else handles it
- Hosting and email providers, who process data only on our behalf and under contract.
- Discord, if you join our server or follow a Discord event, under its own privacy policy.
- YouTube (Google), only when you press play on a video, and its image server for video thumbnails on the How to play page.
- Twitch (Amazon), when the home page shows a Jak X Online stream: its player and chat load in the Twitch section, and its image server sends the thumbnails and profile pictures of the list.
Discord, Google and Twitch are based in the United States: transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Accounts: while they exist. When an account is deleted, its data is erased, except the minimum needed to keep a sanction in force.
- Temporary codes and links (activation, sign-in, password reset): from minutes to a few days.
- Race replays: 7 days, unless the staff keeps one (for example, to review cheating).
- Security logs: only as long as they are useful to protect the service.
- Backups are renewed regularly, so deleted data disappears from them over time.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Write to us through our Discord server (Support channel) (opens in a new tab); we answer within one month. You can change your email preferences yourself at any time in My account › Notifications.
If you think we have not respected your rights, you can complain to the data protection authority of your country (AEPD (opens in a new tab) in Spain).
Minors
Accounts are for people aged 14 or over (or the age your country sets). If we learn that a younger child signed up without permission, we will delete the account.
Security
Passwords are stored as hashes, the website only works over an encrypted connection (HTTPS), two-step sign-in is available to everyone and required for the staff. The connection between the game and the servers uses the console's original protocol, which is older and less protected: do not reuse an important password for your game account.
Changes
If this policy changes in an important way we will let you know on the website or by email. The date at the top shows the current version.