Privacy Policy
How Drift Bang collects, uses and protects personal data, under the General Data Protection Regulation (EU) 2016/679 and French Law No. 78-17 of 6 January 1978 on data processing, data files and individual liberties.
Last updated 19 August 2026. This policy applies to https://driftbang.com and to the Drift Bang game.
1. Who we are
Drift Bang is the data controller for the personal data described in this policy. Our address is 18 rue des Petites Écuries, 75010 Paris, France. Full publisher details are on our Legal notice page.
For any privacy question or to exercise your rights, contact privacy@driftbang.com, write to us at the address above, or call +33 1 84 80 12 40. Given our size and the very limited data we process, we are not required to appoint a data protection officer; privacy requests are handled directly by the publisher.
2. What personal data we collect
2.1 Data you give us
When you use the contact form or email us, we receive your name, email address, the topic you selected, the content of your message, and anything else you choose to include. Please don't send us special category data (health, religion, political opinions, biometrics and similar) — we have no need for it.
2.2 Data collected automatically
Our web server produces standard access logs when a page is requested. These contain your IP address, the date and time, the page requested, the HTTP status code, your browser's user-agent string and the referring page. This is technically necessary to serve the site and to identify abuse and faults.
2.3 Data we do not collect
We do not collect names, addresses, dates of birth or payment details for gameplay, because there is no server-side registration and nothing is for sale. The optional racer profile is created and stored entirely in your own browser and is never transmitted to us. We do not build behavioural profiles, we do not fingerprint devices, and we do not track you across other websites.
3. Why we use it, and our lawful basis
| Purpose | Data used | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Answering your enquiry, bug report or complaint | Name, email, message | Legitimate interests (Art. 6(1)(f)) — responding to someone who contacted us. Where your enquiry concerns a potential contract, Art. 6(1)(b). |
| Handling a data protection request | Name, email, message, logs | Legal obligation (Art. 6(1)(c)) |
| Serving pages and keeping the site available | IP address, user-agent, request logs | Legitimate interests (Art. 6(1)(f)) — operating and securing our service |
| Detecting and blocking abuse, spam and attacks | IP address, request logs, form submissions | Legitimate interests (Art. 6(1)(f)) — network and information security |
| Measuring whether our advertising works | Aggregated, non-identifying campaign reports from Google Ads | Legitimate interests (Art. 6(1)(f)) — see section 12 |
Where we rely on legitimate interests, we have assessed that our interest in operating, securing and supporting a free game does not override your rights and freedoms, principally because the data involved is minimal, is not used to profile you, and is not shared for anyone else's marketing.
4. Data and the game itself
Drift Bang runs entirely inside your browser. Once the page has loaded, gameplay involves no further communication with our servers. Specifically:
- Your score, distance, near misses and best result are calculated on your device.
- Your personal best is written to your browser's
localStorageunder the keytd_best. It stays on your device, we cannot read it, and clearing your browser data removes it permanently. - Your campaign progress — completed missions, per-mission best scores and medals, unlocked cars, your selected car, your top ten runs and your running totals — is written to the same
localStorageunder the keytd_progress_v1, on the same terms. It contains no personal data, only mission and car identifiers, numbers and run timestamps. - If you choose to create a racer profile, the username, the email address you type and a salted hash of your password are written to
localStorageundertd_users_v1, and the current session undertd_session_v1. These never leave your browser and are never transmitted to us — which also means we cannot see, verify, recover or reset them. - The leaderboard on your dashboard ranks your own runs on this device. There is no online or global leaderboard, no multiplayer, no chat and no telemetry. We do not know how far you got or how often you play, and your scores are never compared against other players.
5. Cookies and local storage
This site sets no cookies at all — no analytics, no advertising, no consent-management cookies. The only client-side storage is the localStorage keys described above, which are strictly necessary to deliver features you asked for by playing or by creating a profile. Because we set no non-essential storage, no consent banner is required under Article 82 of the French Data Protection Act, which implements Article 5(3) of the ePrivacy Directive. Full detail is in our Cookie Policy.
6. Who we share data with
We do not sell personal data, and we do not share it for anyone else's marketing. We disclose it only to:
- Our hosting provider, OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, which processes server logs on our instruction in order to run the infrastructure this site sits on.
- Our email provider, which transmits and stores the messages you send us.
- Professional advisers (lawyers, accountants, insurers) where genuinely necessary, under a duty of confidence.
- Law enforcement, regulators or courts where we are legally required to, or to establish, exercise or defend legal claims.
Each processor acts under a written contract meeting the requirements of Article 28 GDPR. Ask us at privacy@driftbang.com and we'll tell you who currently holds these roles.
7. International transfers
We aim to keep personal data within the European Economic Area, and our hosting is located in France. Where a provider processes data outside the EEA, we rely on a European Commission adequacy decision or on the Standard Contractual Clauses adopted by the Commission, together with a transfer impact assessment. You can request a copy of the safeguards in place.
8. How long we keep it
| Data | Retention |
|---|---|
| Contact-form and email correspondence | 2 years from our last exchange with you, then deleted |
| Records of data protection requests | 3 years, to evidence compliance |
| Web server access logs | 6 months maximum, then deleted or aggregated beyond identification |
| Security records for a specific incident | Up to 12 months after the incident is closed |
| Your local high score, progress and racer profile | On your device, under your control — indefinitely until you clear it |
9. Your rights
Under the GDPR you have the right to: be informed; access a copy of your data; have inaccurate data corrected; have data erased; restrict processing; data portability; object to processing based on legitimate interests, including direct marketing; and not to be subject to solely automated decisions with legal or similarly significant effects. We carry out no automated decision-making or profiling. Under French law you may also give directions about what happens to your data after your death (Article 85 of Law No. 78-17).
To exercise any right, email privacy@driftbang.com with enough detail for us to find your data — normally the email address you contacted us from. We respond within one month, extendable by two further months for complex requests, and we'll tell you if we need the extension. There is no charge unless a request is manifestly unfounded or excessive. We may ask for proof of identity where we cannot otherwise be confident who is asking.
10. Security
The site is served over HTTPS. We apply a Content Security Policy and related HTTP security headers, load no third-party scripts, keep dependencies patched, restrict access to correspondence to those who need it, and enforce multi-factor authentication on our administrative accounts. No system is perfectly secure, but a breach here would expose very little: we hold no server-side accounts, no passwords and no payment data. Should a personal data breach occur that poses a risk to your rights, we will notify the CNIL within 72 hours and tell you directly where the risk is high.
11. Children
Drift Bang is suitable for all ages and children may play it without giving us any data whatsoever. We do not knowingly collect personal data from children under 15 — the age of digital consent in France — through the contact form. If you believe a child has sent us personal data, contact privacy@driftbang.com and we will delete it promptly.
12. Advertising and referral data
We advertise this game on search engines, and specifically through Google Ads. If you arrived by clicking one of our adverts, Google may have appended tracking parameters such as gclid to the link, and Google operates as its own controller for that click under its own privacy notice, available at policies.google.com/privacy. We receive only aggregated campaign reporting — impressions, clicks, cost — which does not identify individual people.
We do not currently install the Google Ads conversion tag, the Google tag (gtag.js), Google Analytics, any remarketing tag or any other third-party analytics tag on this site. If we ever add one, we will update this policy, list it in our Cookie Policy, and this site will ask for your consent through a banner before any non-essential tag is set — with refusing as easy as accepting.
13. Changes to this policy
We review this policy at least annually. When we make a material change we update the "last updated" date above and, where the change significantly affects you, we highlight it on the home page for at least 30 days. Earlier versions are available on request.
14. Complaints
Please raise any concern with us first at privacy@driftbang.com — we would rather fix it. You also have the right to complain to the French supervisory authority: the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, telephone +33 1 53 73 22 22, cnil.fr. If you live in another EU or EEA country, you may complain to your own national supervisory authority instead. Complaining to us first does not affect that right.