Privacy

What we keep

Last updated 29 October 2026

DRIFTIT is a game you play in your browser. This page says what it stores about you and why.

Playing

Your progress, personal bests, ghost laps, paint and sound settings are saved in your browser's storage, on your device. They stay there; what the game does report is under Game statistics.

Joining the leaderboard with your email

Joining is optional and only needed to put times on the leaderboard. You pick a driver name and give your email address. The name is shown on the leaderboard next to your times; the email is never shown, shared or sold. We use it for one thing: when you want to sign in on another device, we email you a 6-digit code (it works for 15 minutes). Only if you tick the box do we also send you news about the game, a few times a year; every news email says how to stop them.

We store your driver name, your email address, whether you asked for news (and when), when you first signed in with a code, and the runs you post (track, time, drift score, date). Your browser keeps a random session key so you stay signed in; we store only a one-way hash of it. Signing out deletes that session. The code emails go out through our email provider, Resend, which sends them for us and keeps a delivery log.

Sign in with X and the leaderboard

You can sign in with X instead. When you sign in with X we receive your X account id, @handle, display name and profile picture. The access is read-only: DRIFTIT never posts, and does not read your posts, followers or messages. The access token X hands over is used once, to read that profile, and is not kept.

We store your X id, @handle, display name and picture link together with the runs you post (track, time, drift score, date) to show the leaderboard. Your browser keeps a random session key so you stay signed in; we store only a one-way hash of it. Signing out deletes that session.

Game statistics

To see how the game is played, it sends our server anonymous events: that the game opened (on a phone or not, the window size, the browser's language, the site that linked to it, and whether this browser has played DRIFTIT before), races started and finished (track, time, stars, drift score), crashes, restarts, menus, how long you drive, what you unlock, shares, sign-in and joining attempts and script errors. They carry no name, no email, no X account and no cookie. A random number kept in the tab's session storage groups one visit's events and is gone when you close the tab. To count visitors per day, our server mixes your IP address and browser name with a secret key that only exists in its memory and is replaced every day, and keeps just the result: it cannot be turned back into your IP address or linked to another day. The same events also go to Google Analytics. To leave them out in a browser, open driftit.app/?analytics=0 once.

Analytics

We use Google Analytics to count visits and see which pages and devices are used. Google sets cookies for this and processes your IP address; see Google's privacy policy.

Hosting

The site is served through Cloudflare, which handles each request (including your IP address) to deliver and protect the site. Our server uses IP addresses only briefly, to limit how often one address can post and for the daily visitor count above; they are not stored.

Removing your data

Sign out in the game menu to end the session in that browser. To stop news emails, use the link at the bottom of any of them, or tell us. To have your leaderboard entry, runs, email address or X profile removed, contact the developer and we will delete them.