Privacy policy
Last updated: 18 October 2026
In short. We ask you for nothing to play: the game creates a guest account by itself, with a default nickname. We keep your progress on our server so you do not lose it. If you create an account, we also keep your email and your hashed password. Your nickname, level and records appear on the public leaderboard.
There is no advertising, no analytics and no cookies, and we do not sell or share your data. We do not store your IP address: only a pseudonym of it, to stop abuse (unless someone attacks the server: section 2.7).
1. Controller
- Controller
- Juan Jesús Martín Costa, sole trader, trading as Badkraft
- Tax ID (NIF)
- 77236364H
- Address
- Calle Alejandro Dumas, 17, Oficinas, 29004 Málaga, Spain
- Privacy contact
- admin@badkraft.com
More details about the owner in the Legal notice.
2. What data we process and why
2.1. Your guest account (when you open the game)
The first time you open Heatfield, the server creates a guest account without asking you for anything. In it we keep:
- a random identifier, the date it was created and the date of your last game;
- your nickname (by default “Piloto” and four digits, until you change it);
- your progress: level and experience on each side, cars, parts, paints and upgrades, achievements and game statistics, your number plate and your driver’s look;
- your in-game currencies (points and nuts) and the record of every time you earn or spend them;
- your games: when, which side, how long they lasted, what you scored and whether they counted;
- your best records on the leaderboard;
- your sessions: when each one started and whether it is closed. Of the session codes we only keep a hash, which cannot be used to log in.
Why: to give you the game you ask for, keep what you earn and let you carry on another day. Legal basis: performance of the service you request by playing (art. 6(1)(b) GDPR).
2.2. If you create an account with your email
Your guest becomes a registered account, without losing anything. We add your email address, your password (stored only as a scrypt hash: we never see it or store it as is) and whether you have confirmed your email.
Why: so you can log in from any device and recover your account. Legal basis: performance of the service (art. 6(1)(b)).
Today the game does not send emails yet: neither the one to confirm your address nor the one to reset your password. When it does, it will use an email delivery provider that we will add to this page before using it.
2.3. Your games, checked
At the end of each game, the game sends the server a recording of your controls (when you steered, drifted or used each ability) so it can replay the game and check what you earned. It contains no image, no voice and nothing from your device. The recording is not stored: it is used on the spot and only the result is kept.
If the replay does not match what the game says, that game does not count: it gives no points and does not enter the leaderboard. This is the only automated decision we make and it has no other effects. If you think one of your games did not count by mistake, write to us. Legal basis: performance of the service (art. 6(1)(b)) and our legitimate interest in fair play (art. 6(1)(f)).
2.4. The public leaderboard
When a game counts, your best record enters the leaderboard, which anyone can see, even without an account. Only your nickname, your level on that side, your record and your position are shown. Never your email. If you do not want to be recognised, keep the default nickname or choose one that does not identify you. Offensive nicknames are not allowed.
2.5. Online games with other people (in testing)
If you join an online room, the other drivers in the room see your nickname and level while it lasts. The room keeps nothing when it ends.
2.6. Your IP address and your device, to stop abuse
So that nobody creates thousands of accounts, guesses passwords or overloads the server, the server uses the IP address you connect from to count how many requests, sign-ups and login attempts come from it. We do not store your IP: we turn it straight away into a pseudonym (a keyed hash that cannot be reversed without the key) and only store that, in the anti-abuse counters and in the security log. The only exception is someone attacking the server (section 2.7).
The game also stores a random device number in your browser and sends it with each request. The server also turns it into a pseudonym and only uses it for the limits on in-game rewards. It says nothing about you or your device.
The security log records, with the date and the IP pseudonym, the sensitive events: sign-ups, blocked logins, password changes, data downloads, account deletions and rejected games. Never emails or plain IPs.
Legal basis: our legitimate interest in protecting the game and your account (art. 6(1)(f)). You can object by writing to us.
2.7. Server logs
For each request, the account server logs the time, what was requested (the route, without your data), the response and how long it took. It does not log your IP or your account. Errors are logged with their type, so we can fix them. The server that delivers the website does not log each visit, only its errors. We do not keep these logs separately: they stay with our hosting provider for the limited time it keeps them.
Against attacks. The website and the account server count, in memory and without storing it, how many requests come from each network (your IP, or its block in IPv6). If a network keeps sending requests after being slowed down, it is cut off for 15 minutes and its IP address is written to the server log, so that it can be blocked for good; the ones we block are kept in the server configuration for as long as the block lasts. With normal use of the game this never happens. Legal basis: legitimate interest in protecting the service (art. 6(1)(f)).
2.8. Reports of names
Anyone with a session can report another driver’s nickname or what is written on their number plate. For each report we keep who reports and whom (their accounts), which name and what it said at that moment, the date, how much it weighs (according to the type and age of the reporting account) and the pseudonym of their IP, for the daily limit. A person, the owner, reviews it and may dismiss it, withdraw that name (the account will not be able to use it again) or block the account (it no longer appears on the leaderboard). The reported player is not told who reported them. Legal basis: legitimate interest in a game without insults and enforcement of the Terms (art. 6(1)(f) and 6(1)(b)).
2.9. The game’s accounts, in numbers
To know whether the game is engaging, we count per day how many accounts are created and how many of them play again the next day, after a week and after a month. Only those numbers are kept, with nothing about anyone.
As with any website, our hosting provider receives your IP when you connect, to deliver the page to you. Legal basis: legitimate interest in the service working and being secure (art. 6(1)(f)).
2.10. What we do not do
- No advertising, no analytics, no tracking pixels, no social network plug-ins.
- No cookies.
- We do not sell or share your data with anyone, or profile you.
- No real-money purchases.
- We do not ask for your name, age, location, phone number or contacts.
3. What is stored in your browser
The game does not use cookies. It uses your browser’s local storage (localStorage) for what it needs in order to work, which is why it does not require your consent (art. 22(2) LSSI, the Spanish implementation of the ePrivacy Directive):
| Key | What it stores |
|---|---|
persecucion, persecucion-servidor | Your preferences and a copy of your game (nickname, side, progress), so the game starts with it. |
persecucion-ajustes | Graphics, sound and display settings. |
persecucion-anuncios | Internal game counters for rewards and the workshop. |
persecucion-cuenta | The session code to return to your account without logging in again. If you delete it, you are logged out. |
persecucion-aparato | The random device number from section 2.6. |
While the tab is open, the game also keeps in sessionStorage the result of checking your device, to adjust the graphics. All of this stays in your browser until you clear the site’s data; we do not read it from outside.
4. Where your data is and who helps us
We use two providers, which process the data only on our behalf and following our instructions (processors):
| Provider | What for | Where |
|---|---|---|
| Fly.io, Inc. (USA) | Hosts the game website, the account server and the online rooms. | Machines in Frankfurt (Germany) |
| Neon (USA) | Database where accounts and everything in section 2 are stored. | Amazon Web Services in Frankfurt (Germany) |
International transfers. Although the servers are in the European Union, Fly.io and Neon are United States companies and may access the data from there (for example, to maintain their systems). These transfers are made with the safeguards of the GDPR: the standard contractual clauses approved by the European Commission included in their data processing terms (art. 46 GDPR). You can ask us for more information at the contact email.
Apart from that, the only thing other people see is what is public on the leaderboard and in the rooms (sections 2.4 and 2.5). We would only hand over data to an authority if the law requires it.
5. How long we keep it
| What | How long |
|---|---|
| Guest account and everything in it | Deleted automatically after 30 days without playing. |
| Registered account and everything in it | Until you delete it. |
| Recording of each game | Not stored: used when checking it. |
| Session codes (their hash) | Valid for 30 days; deleted one day after they expire. Closed sessions, 30 days after closing. |
| Anti-abuse counters (with the IP pseudonym) | One day. |
| Security log | Twelve months. If you delete your account, whatever remains is no longer linked to it. |
| Server logs (and the IP of an attacker, if any) | The limited time the hosting provider keeps them; we do not keep them separately. |
| IPs blocked for attacks | For as long as the block lasts. |
| Reports of names | Pending ones, until they are reviewed; reviewed ones, 90 days. If the reported account is deleted, they go with it; if the reporting account is deleted, the report is no longer linked to it. |
| Withdrawn names and blocks of an account | For as long as the account exists. |
Deleted data may remain for a few days in the database recovery backups, until they renew themselves.
6. Your rights and how to exercise them
You can ask us to access your data, correct it, delete it, restrict its use, object to it and take it with you (portability). You can do much of this yourself, from the game:
- Change your nickname: in the menu, with the pencil on your card.
- Download your data (everything in section 2, in a file): in the menu, “Tu partida” → “Descargar mis datos”.
- Delete your account and everything in it: in “Tu partida” → “Borrar mi cuenta” (or “Borrar mis datos”, as a guest). It cannot be undone.
For anything else, or if you cannot log in, write to admin@badkraft.com. We will reply within one month at the latest. If you ask by email, we may ask you for something to check that the account is yours. A guest account has no email: if you clear your browser’s data, we cannot tell which one was yours, and it will be deleted automatically after 30 days.
If you think we are not handling your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or the authority in your country.
7. Children
Heatfield is for people aged 13 or over, or the minimum age set by the law of your country if it is higher (in Spain, 14). To play, we do not ask for your age or contact details. If you are under that age, do not create an account with an email. If we learn that an account belongs to someone under that age, we will delete it.
8. Security
Everything travels encrypted (https). Passwords are stored with scrypt, session codes and links only as hashes, and the IP only as a pseudonym (except that of someone attacking the server, section 2.7). Only the owner has access to the database.
9. Changes
If we change what we do with your data (for example, if we add emails, advertising or purchases), we will update this page and its date first. If the change is significant, we will let you know in the game.
This is a translation. If there is any discrepancy, the Spanish version prevails, except where the law of your country requires otherwise.