Privacy Policy
Danfo Run is a free browser game at danforun.com. This page explains what data the game uses, why, who else sees it, and what you can ask us to do with it. We keep it short because we collect very little. The only ads are road boards drawn into the game by local businesses: they don't track you, and nothing about you is sold. Accounts are optional: you can play without one. Some optional extras can be bought (section 11).
Who is responsible
Danfo Run is operated by Eureka Gaming Studios Limited, a company registered in Nigeria (RC 9910358), 1A Hughes Avenue, Yaba, Lagos 101212, Nigeria. It is the controller of your data under the Nigeria Data Protection Act 2023 and, for players in the EU and UK, the General Data Protection Regulation (GDPR). Contact: hello@danforun.com, or a direct message to @eureka_seamless on X.
What we store, and why
1. The leaderboard
When you finish a run, the game sends your score to our server, together with:
- the driver name you chose (or "Driver" if you didn't pick one),
- a random player ID the game created on your device. It isn't linked to your name, email or phone, and we can't tell who you are from it,
- run details (score, distance and time driven) so we can reject impossible scores.
Why: to show the daily, weekly and all-time leaderboards you asked to take part in, and to keep them fair. Legal basis: Art. 6(1)(b) GDPR (providing the game you're using) and Art. 6(1)(f) GDPR (our interest in a cheat-free board).
How long: daily board entries are deleted automatically after 3 days, weekly ones after 15 days. All-time best scores and driver names stay until you ask us to delete them, or until we remove them for breaking the Terms of Use.
2. Your IP address, briefly
Like every website, our server sees your IP address when your browser connects. We use it only to count requests per minute so one person can't flood the leaderboard. That counter expires after 90 seconds. We do not store IP addresses with scores or names. Our hosting provider keeps standard technical logs for a short time for security and operations. Legal basis: Art. 6(1)(f) GDPR (a secure, working service).
3. Storage on your device
Your progress (coins, paints, missions, streak, best score, settings, chosen radio station, player ID and driver name, and, if you sign in, a sign-in token from our server) is saved in your browser's local storage. If your browser blocks that, as some in-app browsers do, the game uses small first-party cookies (names starting with lr_) for the same data instead. The game also uses a service worker cache so it loads fast and works offline. None of this is sent to us except the leaderboard data above and, if you choose to sign in, your saved progress (section 4). It is needed for the game features you use, so it doesn't require consent (§ 25(2) no. 2 TDDDG). Clearing your browser's site data deletes it, and your progress with it.
4. Signing in with Google (optional)
You can play without signing in, and nothing is taken away if you don't. If you choose Continue with Google, your scores, coins and progress follow you to any phone or browser where you sign in.
What we keep: the account number Google gives our game for you (a long number that is the same each time you sign in, and only means something to our game), your email address as verified by Google, the driver name you choose in the game, the player IDs of the devices you signed in on, and your saved progress (best scores, coins, paints, boosts, missions, route stamps, streak, settings and play counters).
Your email address is kept on our server only. It is never shown on the leaderboard or to other players, and it isn't sent back to the game. We use it to recognise your account when you contact us (for example to recover progress or delete your account), to run and protect the game (for example to look into cheating), and to tell you about important changes to your account or this policy. We don't sell it, and we won't send you marketing emails unless you say yes first.
What we don't keep: your name on Google, your profile photo or your contacts. Google sends us a signed message when you sign in; we check that it really comes from Google, keep the account number and your email address, and throw the rest away. After that we use our own sign-in token, so Google isn't asked again until you sign in on a new device.
The sign-in button comes from Google. When the game shows it (in Settings, on the leaderboard, or sometimes after a new best), your browser loads it from accounts.google.com, so Google receives your IP address and browser details and may use its own cookies to show which Google account you're signed in to. We get nothing from this unless you choose to sign in. The start screen never loads anything from Google. See Google's privacy policy.
Signed-in names are unique and shown with a small check mark on the leaderboard. You can change your name once every 7 days.
Why: to keep your progress across devices, which you asked for by signing in, and to keep the leaderboard fair (a ban applies to the account, not just one phone). Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for fairness. How long: until you ask us to delete your account. Sign out in Settings removes the progress from that device; your account keeps it.
5. Google Analytics, only if you say yes
If you tap Accept on the analytics banner, we load Google Analytics 4 to see things like how far people get and where runs end, so we can improve the game. Until you accept, no Google Analytics code is loaded and no analytics cookies are set. Google signals and ad personalisation are switched off.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU–US Data Privacy Framework. Cookies set: _ga and _ga_*, stored for up to 2 years. See how Google uses data from sites that use its services.
Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can change your mind at any time via Cookie settings at the bottom of the game's start screen. Declining removes the analytics cookies.
6. Live radio
The game starts on its own music. If you tune to a real Lagos station, your browser connects directly to that station's official public stream, so the station and its streaming provider receive your IP address and browser details, as with any radio app or website. To find those streams, the game asks the community-run Radio Browser directory for the station list and keeps it on your device for a day. We have no control over the stations' own data practices. Please see their websites (linked with ↗ in the game).
7. Danfo FM: artists' songs on the radio
Danfo FM and artist stations play songs that artists booked with us. The song files are loaded from our file host (a content delivery network), which receives your IP address and browser details like any website. When you've heard 30 seconds of a song, the game tells our server, with your random player ID, so the artist can see how many times it was played. We keep only counts: plays and different players per day, and the country your connection comes from (from our host's network data). We store a one-way code of your player ID for at most 2 days to count each player once, never the ID itself or your IP address, and artists only ever see totals. If you open a song link an artist shared (danforun.com/fm/…), the game starts on that song. Legal basis: Art. 6(1)(f) GDPR (honest play counts for the artists who pay us to play their music).
8. If you book Danfo FM as an artist
When you book at danforun.com/artists we keep what you give us: your name, email address, WhatsApp number, artist and song names, social handle and links, and your booking and payment status. We use them to run your booking, listen to and play your music, send you your receipt and plays link, and contact you about it. Payments are handled by Bachs Technologies Limited (bachs.io), Nigeria: you enter your card or bank details with Bachs, never with us, and Bachs tells us only whether the payment went through. Legal basis: Art. 6(1)(b) GDPR (your booking). How long: 6 years after your booking ends, for tax and accounting records; your music files are removed from the game when the booking ends.
9. Road boards (ads)
Some road boards in the game show local businesses that booked them on danforun.com/advertise. When the game opens it fetches today's boards from our server. At the end of a run it tells our server which boards were on your screen, as a plain count per board, with nothing that identifies you. If you tap a business's link in the Gist, our server counts the tap and sends you to that business's page. To count each person's tap once, it keeps a scrambled (hashed) form of your IP address with the board you tapped for one hour, then deletes it; that business's own privacy practices apply from there. Legal basis: Art. 6(1)(f) GDPR (honest numbers for advertisers, and a free game).
Advertisers: when you book a board we store your business name, ad image, link, email and (if you give it) WhatsApp number, to check and run your booking, contact you about it, and keep records for tax and accounting. Legal basis: Art. 6(1)(b) and (c) GDPR. We keep booking records for 6 years after the booking ends, as Nigerian tax law expects; ask us to delete the rest sooner. Online payments are processed by Bachs (Bachs Technologies Limited, Nigeria), which receives your email and the amount; we never see your card details. See the Advertiser Terms.
10. Fonts
All fonts are served from our own site. We do not use Google Fonts or other font services.
11. Buying Danfo Run Originals (optional)
If you buy something, you pay on Bachs' own checkout. Bachs collects your payment details (card, bank or phone number) and handles the payment; we never see or store card details. To fill in the checkout, we pass Bachs the email address of your account and your driver name. We keep: the payment reference, the item, the amount and currency, the date, Bachs' checkout and payment numbers and whether the payment succeeded. We also keep your yes to "18 or older, or a parent said OK" with the order, and a running total per day and month for the spending limits. If you set a name plate, we keep its text. We keep order records for as long as tax and accounting law requires (in Nigeria, at least 6 years). Legal basis: to perform our contract with you (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c)). A Founding Driver star or Coral Crown number shows next to your driver name on the boards; nothing else about your purchases is shown to anyone.
Payment provider: Bachs Technologies Limited, Nigeria (bachs.io). See Bachs' privacy policy.
Who processes data for us
- Vercel Inc., USA, hosts the game and runs the leaderboard server (region: Frankfurt, Germany).
- Upstash Inc., USA, runs the leaderboard and account database.
- Google, sign-in (only if you choose it) and analytics (only after consent), as described above.
- Bachs Technologies Limited, Nigeria, takes payments if you buy Danfo Run Originals (section 11), book Danfo FM (section 8) or book a road board (section 9). It acts as an independent provider of payment services for the payment itself.
- Cloudflare Inc., USA, hosts the Danfo FM song files.
Vercel and Upstash act on our behalf under data processing agreements. Where data may reach the USA, transfers rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.
Your rights
You can ask us for access to your data, to correct it, delete it, restrict it, or receive it in a portable form (Art. 15–20 GDPR). You can object to processing based on our legitimate interests (Art. 21 GDPR) and withdraw consent at any time. To have your leaderboard entries and driver name removed, send your driver name (and a screenshot of your best score if you can) to @eureka_seamless. If you signed in with Google, send your driver name or the email address you signed in with and we'll delete the account, the email address and everything saved with it.
You also have the right to complain to a data protection authority, for example the one in the EU country where you live. Players in Nigeria have the same rights under the Nigeria Data Protection Act 2023 and can also complain to the Nigeria Data Protection Commission (NDPC).
Children
Danfo Run is suitable for all ages. If you are under 16, please ask a parent or guardian before accepting analytics or signing in with Google. Signing in is never needed to play. For signed-in players we store only what the account needs: the account number, the email address, a driver name and game progress. Never a photo or contacts, and the email is never shown to anyone. Don't use your real full name as a driver name.
Changes
If the game starts using data in a new way, we'll update this page and the date at the top first.