Privacy Policy

Who we are

CSR2 MODS (csr2-mods.com) is an independent service for CSR Racing 2 players and is responsible for the data described here. We are not connected to NaturalMotion or Zynga, and we never share your details or your orders with them or any other game publisher.

What we collect

• Account details: your email address, and your name if you give one. Your password is never stored; we keep only a one-way bcrypt hash that lets us check a sign-in.
• Sign-up record: the IP address, device type and browser recorded when your account was created, used to spot fraud and duplicate accounts.
• Orders: what you bought, what you paid, and the order status and history.
• Payment records: your PayPal transaction ID and the email you paid from, plus any payment screenshot you upload. Card numbers and PayPal passwords never reach us.
• Chat: the messages and photos you send us in the site chat, including any game sign-in details you share there (see below).
• Visit log:when you are signed in, which pages of our site you visit, when, and your IP address (at most one entry every 30 seconds). For visitors who aren’t signed in, one entry per visit with a random browser ID, the IP address, the pages opened and roughly how long the visit lasted. We use it to spot fraud and to understand how the shop is used. Entries are deleted automatically after 60 days.
• Analytics: page-visit statistics, only if analytics is switched on for the site (see Cookies).

Your game account sign-in

Most orders need us to sign in to your game account once. This is how we handle that:

• You send the sign-in in your private chat with us after paying. Our checkout never asks for it.
• It is used only to deliver the order you paid for. We don’t change your password, buy anything, or use the account for anything else.
• It stays in your chat history, which only you and our team can see, until it is deleted. Ask us at any time and we will delete those messages.
• We never ask for your card details, access to your recovery email, or security answers, and you should refuse anyone who does.
• Please change your game password after delivery. Nothing on our side depends on the old one.

Why we use it

• To run your account, take payment and deliver orders (needed to fulfil our agreement with you).
• To answer support requests and keep a record of what was agreed.
• To prevent fraud, abuse and false chargebacks (our legitimate interest in a secure store).
• To meet legal and accounting duties.
• For analytics, only where it is switched on and, where the law requires it, with your consent.

Who processes it for us

We use these providers to run the store. Each one handles data on our behalf under its own terms:

• Vercel: hosts the website.
• MongoDB Atlas: stores the database (accounts, orders, chat).
• Cloudinary: stores images, including photos sent in chat and payment screenshots.
• PayPal: processes payments.
• Resend: sends account and order emails.
• Google Analytics: visit statistics, only when switched on.

Some of these providers process data outside your country, including in the United States. Where data leaves the EU or UK, they rely on standard contractual clauses or another lawful transfer mechanism. We never sell or rent your personal data, and we don’t share it for advertising.

How long we keep it

• Account details: until you ask us to delete your account.
• Orders and payment records: as long as needed for accounting, tax and payment disputes.
• Chat messages and photos: as part of your support history, until deleted. You can ask us to delete them.
• Verification and password-reset codes: expire automatically and are cleared once used.
• Visit log: deleted automatically after 60 days.

Cookies and browser storage

• csr2mods_session: keeps you signed in. Essential, secure and not readable by scripts on the page.
• csr2mods_signed_in: a simple marker that tells the site you’re signed in, so it can skip a check for visitors who aren’t.
• Cart and wishlist: saved in your browser’s local storage so they survive between visits. They never leave your device unless you check out.
• Visit counter: a random browser ID saved in local storage, and the current visit’s pages and start time saved in session storage (cleared when you close the tab), so an anonymous visit is recorded as one entry. It contains nothing about who you are.
• Analytics cookies: set by Google Analytics only if analytics is switched on for the site.

We don’t use advertising or cross-site tracking cookies. You can clear or block cookies in your browser; blocking the essential ones will stop sign-in from working.

Security

All traffic to the site is encrypted (HTTPS). Passwords are hashed and can only be reset, never recovered. Sessions use signed, secure cookies, and the admin area is restricted to our team. No system is perfectly secure, so we keep as little as we can.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete your account and data, or object to how we use it. Email support@csr2-mods.com or message us in the site chat; we reply within 30 days. This covers your rights under the GDPR if you are in the EU or UK, and under the CCPA if you live in California. We don’t sell personal data, so there is nothing to opt out of on that front. We may keep basic transaction records where accounting law requires it.

Children

This service is for people aged 18 and over, in line with our terms. We don’t knowingly hold data about children. If you believe a child has created an account, tell us and we will delete it.

Changes

We may update this policy. The date at the top shows when it last changed, and we will put a notice on the site for significant changes.

Contact

Privacy questions or data requests: email support@csr2-mods.com or use the site chat.