Privacy policy

The “Freak Race” app and the website freakrace.com are operated by TORA events, legal entity code 307394611, located at Savanorių pr. 224-44a, Vilnius, email info@freakrace.com.

We are the controller of your personal data. This means that we determine what data is collected and how it is used, and we are responsible for its security.

If you have any questions about this policy or would like to exercise your rights, please contact us at info@freakrace.com.

Account Information

When you create an account, we store your first name, last name, email address, and selected language. We do not see or store your password—it is managed by the “Google Firebase Authentication” service.

Contact and Payment Information

If you provide them, we store your phone number and bank account number. Your bank account is needed for one purpose only—to pay out your prize if you win.

In your account, these two fields are stored separately from the rest of your account and are accessible only to you and the administrator. It is important to note that when you register for an event, a copy of this information is included in the registration record, which is also visible to the event organizer—see Section 6.

Participation Data

When you register for and participate in an event, we store the following information: which event and in which city you are participating, your chosen mode of transportation, the start and end times of the game, your answers to the tasks, and your score evaluations.

The start and end times of the game are determined by the server, not your phone. We do this because the prizes are real money, and the timing must be equally reliable for all participants.

Photos

The app requests access to the camera for two purposes: to take a photo when registering for the event (a selfie) and to take photos of you completing tasks during the game.

Photos are taken only directly with the camera—you cannot select existing photos from your gallery. This is a deliberate decision to ensure the fairness of the competition results.

Payment Information

When you pay the participation fee, we store the amount, currency, payment status, invoice number, and the buyer’s name and email address.

If you request an invoice in the company’s name, we also store the company name, registration number, VAT ID, and address.

We do not receive or store payment card information. This information is processed by Stripe—the payment service provider to which you enter your card details directly.

Sponsorship Inquiries

There is a sponsorship proposal form on the website. When you fill it out, we store the company name, company code, email address, phone number, and the text of your message. No account is required. We use this data solely to contact you regarding a partnership.

Technical Data

If the app crashes, a crash report is automatically generated, including the device model, operating system and app version, and the location of the error in the code. This helps us identify and fix the error.

Data on Your Device

The app stores the state of your unfinished game on your phone (answers you’ve entered but haven’t yet submitted) and copies of downloaded images so that screens load faster. This data remains on your phone and is deleted when you uninstall the app.

In the interest of transparency, it’s worth mentioning what we don’t do:

• We don’t track your location. The app doesn’t ask for GPS permission. You choose the city yourself from a list.

• We don’t collect advertising identifiers and don’t have any ad networks.

• We do not track your browsing activity outside the app.

• We do not use usage analytics—we do not record which screens you open or when.

• We do not sell your data to anyone under any circumstances.

For each purpose, we specify the legal basis in accordance with Article 6 of the GDPR:

• To create an account and allow you to log in — performance of a contract.
• To register for and participate in an event — performance of a contract.
• To calculate results and award prizes — performance of a contract.
• To issue invoices and for accounting purposes — legal obligation.
• To send emails related to the event and payments — performance of a contract.
• To respond to a sponsor’s inquiry — legitimate interest.
• To correct errors and ensure system security — legitimate interest.
• To prevent fraud and unfair participation — legitimate interest.

We only send emails related to your actions: payment confirmation, invoice, refund confirmation, and a password reset link when you request one.

Promotional emails may be sent.

This is important, and we want to be clear about it.

In the event results table, other participants who are logged in can see your first name, last name, city, mode of transportation, participation times, result ratings, and which tasks you completed.

The table does not include your email address, phone number, bank account, photos, or the content of your answers—it only shows that you answered a task, not what you answered. The table is visible only to logged-in app users; it is not available on the public website.

If you do not want your name to be visible to others, you will not be able to participate in the event—the results table is part of the competition.

The event organizer can only see the information of participants in their own event: first name, last name, email address, phone number, bank account, registration and payment status, results, profile picture, and photos uploaded for the challenges.

The bank account is visible to the organizer because the event organizer pays out the prizes. The organizer cannot see participants from other events—neither the list nor individual entries.

The administrator can view all data—this is necessary for them to maintain the system, resolve disputes, and manage accounting.

We use services that process data on our behalf:

• Google (Firebase) — services for authentication, databases, file storage, server functions, and error reporting.
• Stripe — payment processing. With regard to card data, Stripe is an independent data controller.
• UAB “Interneto vizija” — email delivery server.
• DeepL — translation of event descriptions. Only the event text written by the organizer is transmitted: title, description, and task requirements. No participant data is included.

We do not transfer data to anyone else, except when required by law or law enforcement.

The website freakrace.com does not use tracking cookies, does not use analytics, and does not place advertising trackers. There is no consent window because there is nothing to consent to.

The database and your records are stored in the European Union—at a Google data center in Poland (europe-central2).

Some processing takes place in the United States. Server functions that process payments, generate invoices, send emails, and calculate results operate on Google’s infrastructure in the U.S. Error reports are also sent there.

This transfer is governed by the Standard Contractual Clauses approved by the European Commission and the EU–US Data Privacy Framework, to which Google is a signatory.

• Account data — as long as you have an account.
• Registration and results — 3 years after the event.
• Selfies and photos from challenges — 1 year after the event.
• Invoices and accounting documents — 10 years (legal obligation).
• Sponsor inquiries — 2 years from receipt.
• Glitch reports — 90 days.

When an account is deleted, the data is removed within 30 days. Only data that we are legally required to retain—primarily accounting documents—is kept for a longer period.

Under the GDPR, you have the right to:

• know what data we hold about you and receive a copy of it;

• correct inaccurate data;

• delete your data (“the right to be forgotten”);

• to restrict the processing of your data;

• to transfer your data to another service provider;

• to object to processing based on our legitimate interests.

To exercise any of these rights, please contact us at info@freakrace.com. We will respond within 30 days.

If you believe we are processing your data unlawfully, you have the right to file a complaint with the State Data Protection Inspectorate (vdai.lrv.lt).

This app is intended for individuals 18 years of age and older. Participation involves payments and cash prizes, so we do not intentionally create accounts for younger users.

If we learn that a person under the age of 18 has created an account, we will delete it.

If we allow individuals under the age of 18 to participate in the future, we will apply separate rules regarding the protection of minors’ data and participation.

The program calculates the ranking of results in the table based on a set of criteria that are the same for everyone: the number of correctly completed tasks, the number of uploaded photos, and the time taken.

This is not an automated decision that gives rise to legal effects within the meaning of Article 22 of the GDPR: the assessment of the tasks is made by a person—the event organizer—after reviewing your answers and photos. If you disagree with the evaluation, you can contact us at info@freakrace.com

Data is transmitted over an encrypted connection and stored on Google's infrastructure. Access is restricted by server-side rules: each user sees only what they are authorized to see, and there is no way to bypass this restriction from within the app.

The most sensitive account fields—phone number and bank account—are stored separately from the rest of the account so that they cannot be viewed by those who only need to see the list of names.

If we change this policy, we will publish the new version here and update the effective date. In the event of significant changes, we will notify you by email.

Role of the Platform: “Freak Race” serves as a technical platform that connects players with event organizers. “Freak Race” is not the organizer of specific orienteering competitions, games, or challenges, unless this is explicitly stated in the description of a specific event.

Organizers’ Independence: Each specific event is organized by separate third-party organizers. All decisions regarding the event’s schedule, rules, safety measures, prize fund administration, and other event-related matters are the sole responsibility of the specific event organizer.

Limitation of Liability: “Freak Race” assumes no direct or indirect liability for the actions or omissions of the event organizer, the quality or safety of the event, or any failure to fulfill obligations (including the payment of prizes). All claims regarding a specific event must be addressed directly to the organizer of that event. The Freak Race team will act as an intermediary to forward your inquiries to the event organizer.

Participant’s Agreement: By participating in an event, the participant confirms that they understand that the organizer of the specific event, and not the platform operator, is responsible for the organization and conduct of the event.

info@freakrace.com