Who we are
Difflocked (difflocked.com) is a browser racing game and vehicle creator. It is one half of an independent, non-commercial enthusiast project run by an individual, not a company — the other half is 4x4s.org, the registry the game grew out of. Neither is affiliated with any vehicle manufacturer, operator or museum. To reach us, use the contact form on 4x4s.org.
This policy covers difflocked.com and its subdomains: the game at /play/, the Creator, the community builds gallery and profiles, and the APIs that serve them.
What we collect, and why
Visiting the site. Pages are served by Amazon CloudFront. We have not switched on CloudFront's access logging; the APIs behind accounts, builds and leaderboards write operational logs (which can include your IP address and the request made) that are kept for one month for debugging and abuse prevention.
Analytics. We use Google Analytics 4 to count visits and see which pages people use. It sets cookies and sends your IP address (truncated by Google) and browser details to Google. In the EU, EEA, UK and Switzerland it runs only after you allow it on the banner; everywhere else it runs by default and you can switch it off on the cookies page.
Playing. Starting a race opens a short-lived race session on our leaderboard service, identified by a random token. A lap time you choose to submit is stored with the name you enter (up to 24 characters, filtered for abuse; blank names become “Anonymous”), the course, the difficulty and the time. We also record anonymous play telemetry — which course and vehicle were raced, how the race went, the browser's rough capability — to tune the game; it carries no account details. Multiplayer races pass your car's position and name through our relay server to the other players in the room and are not stored.
Accounts. If you create an account for the Creator you give us a username and a password (stored as a salted hash, never in clear) and, optionally, an email address, a display name, a short bio and links. The email is used only to reset a password you have forgotten and to reply if you contact us. Your saved builds also live in your own browser's storage without an account.
Community builds. Vehicles you build and publish are stored with your account and shown under your username; unlisted builds are visible only by link. Every build is pictured by our own renderer. Where an administrator has switched community AI renders on, you can also ask for your build to be painted into a scene by an image model (Google Gemini); the model receives the build's specification and the site's own picture of it — never your account details.
Email. Password-reset links are sent through Amazon SES from registry@difflocked.com. We send no newsletters or marketing.
Legal basis
For visitors in the UK and EU: operational logs and abuse prevention rely on our legitimate interest in running the site securely; accounts, builds, leaderboards and multiplayer are processed because you asked us to (performance of a contract, or steps at your request); analytics runs on your consent where the law requires it and on legitimate interest elsewhere, with an opt-out.
Who else sees it
The site runs on Amazon Web Services (CloudFront, S3, Lambda, DynamoDB, SES) in AWS's US East (N. Virginia) region. Google receives analytics data when you have allowed it, and Google's Gemini service receives vehicle specifications and pictures when a render is requested. Nobody else receives your data; we do not sell it or use it for advertising.
How long we keep it
API logs: one month. Analytics: Google Analytics retains event data for 14 months. Accounts and builds: until you delete them or ask us to. Sessions: 90 days; race sessions: two hours. Leaderboard entries and play telemetry: indefinitely, as part of the game's history, with no account link.
Your rights and data requests
Wherever you live, you can ask us to tell you what we hold about you, correct it, export it, or delete it — including your whole account with its builds — and to stop analytics at any time. Send the request through the contact form on 4x4s.org from the email address on your account, or say which username you mean, and we will act within a month.
If you are in the UK or EU you also have the right to object to processing based on legitimate interest and to complain to your data-protection authority (in the UK, the Information Commissioner's Office).
Children
The site is not directed at children under 13, and accounts should not be created by anyone under 13 (16 in some EU countries). If you believe a child has given us personal data, contact us and we will delete it.
Changes
When this policy changes in substance the date at the top moves and the change is noted in the project's source history.
Privacy policy · Cookies · Terms of use · FAQ