Privacy Policy

Baja Blitz · Bit Forge Ventures, LLC · Effective September 21, 2026

1. Who we are

Baja Blitz is operated by Bit Forge Ventures, LLC, a limited liability company organized in Georgia, United States, at 8735 Dunwoody Place, STE R, Atlanta, GA 30350, United States. For data-protection purposes we are the controller of the data described here.

This policy covers the Baja Blitz website at bajablitzgame.com, the browser mini-games hosted on it, the Baja Blitz mobile applications, and the Baja Blitz app on Reddit. It does not cover any third-party site we link to.

When you play on Reddit, Reddit, Inc. is a separate controller for the data it holds about you as a Reddit user, under its own privacy policy. Section 2.9 sets out what we collect there and what Reddit can see.

2. What we collect

2.1 Gameplay records — every race

When you finish a race, a jump run or a switchback run, we store a record of it — on our servers, or for the Reddit app in Reddit’s data store for it (2.9). This happens automatically for every completed attempt. Section 9 sets out your choices about this, including the right to object.

A replay is a continuous record of how you drove, sampled throughout the run. Section 8 describes how replays are stored. The Reddit app stores a shorter record; section 2.9 lists it.

2.2 Identifiers

Your records are linked to each other under a single identifier, and build up over time into a continuous history of that player’s races. Which identifier depends on where you play:

• Player ID — on our website and mobile apps. A random identifier generated the first time you play and kept in your device’s local storage. It is first-party, stable across sessions on that browser or device, and it is what ties your races into one career and one save. There are no accounts here, so your name is not attached to these records; under the GDPR they are pseudonymous personal data. Clearing your site data deletes the identifier.
• Reddit username — in our Reddit app. Reddit tells our server which account you are signed in as, and your username is what ties your races together, what ranks on the leaderboard, and what appears on a challenge post. Under the GDPR these records are personal data identifying that Reddit account. Section 2.9 covers this surface.

Our website analytics (2.7) does not issue an identifier that we can store, and we do not attach anything from it to your race records.

We do not use device fingerprinting.

2.3 Country

Each race record carries a two-letter country code, shown as the flag on the leaderboard. It is derived from the IP address of your request at our hosting provider’s edge and stored as the bare country code. We do not store the IP address alongside your races. Races played in the Reddit app carry no country code.

2.4 Email, if you give it to us

If you enter your email address to join the beta waitlist, we use it to tell you when the beta opens and for occasional news about Baja Blitz. Every message carries an unsubscribe link.

2.5 Server and security logs

Our hosting and database providers process standard technical information in transit and in their own operational logs, including your IP address, user agent, and the URL requested. These logs are held on our behalf under the providers’ own retention windows (section 7) and are used for delivering the service, diagnosing faults and blocking abuse.

2.6 Mail you send us

If you write to us — a privacy request under section 9, a support question, or a notice under our Terms of Service — we keep the message, your email address and our reply for as long as it takes to deal with it, and then for the period in section 7. Section 9.5 asks you for your player ID and for detail about your recent races so that we can act on a request safely; we use that only to answer the request. Where the law requires us to keep a record of how we handled a rights request, we keep that record even after deleting the underlying data.

2.7 Website analytics

We count visits to the pages of this website using Vercel Web Analytics, run for us by our hosting provider. It is cookieless: it stores nothing on your device and reads nothing from it. A visit is recognised instead by a value Vercel derives from the request itself, which is discarded after 24 hours. It does not run inside the mini-games, in our mobile apps, or in the Reddit app.

Each page view records:

• the page address and the route it matched, any tracking parameters on the link you followed, the referring address, and the time;
• an approximate location — country, region and city — derived at the edge from your IP address;
• your device type, operating system and browser, with their versions.

Your IP address is not stored in these records, and neither is your player ID. We do not connect this data to your races (2.2).

2.8 Purchases in the mobile app

Coin packs in our iOS app are sold by Apple. Apple takes the payment, confirms the purchase to us, and we store a record of what it confirmed:

Apple does not give us your payment details — no card number, name, billing address or Apple Account email. Your Coin balance is held in your save file on your device (4).

2.9 The Reddit app

Our Reddit app runs inside Reddit and is served by Reddit’s infrastructure. Reddit tells our server the username of the account you are signed in as. We do not receive your Reddit email address, karma, post history or subscriptions. What we store there:

These records are held in Reddit’s data store for our app rather than on our own servers, so Reddit can access them. We do not share data from our website or mobile apps with Reddit.

If you are not signed in to Reddit, the run is stored without a username and does not reach a leaderboard.

What is public. Your Reddit username and your result appear on the subreddit leaderboard. If you promote a run to a challenge, our app account creates a public Reddit post naming you and your result, and anyone who opens it can race against your recorded run. Reddit posts are public and may be indexed by search engines.

Installing the app adds a moderator account to the subreddit.

2.10 What we do not collect

• Anything you type about yourself in the game — there is no name field, profile, chat or comments. The only free text we hold is mail you send us (2.6). Driver names on our website and mobile leaderboards are generated from your player ID by a fixed rule; the Reddit leaderboard shows your Reddit username.
• No IP address on your race records (see 2.3).
• No payment details for in-app purchases (see 2.8).
• No precise location, contacts, photos, microphone or camera.
• No advertising identifiers, ad networks, ad cookies, or third-party trackers.
• No special-category data — nothing about health, beliefs, biometrics, or anything similar.

3. Why we use it, and our legal basis

If you are in the EEA, the UK or Switzerland, the GDPR requires us to name a legal basis for each purpose. Ours are:

For the third row we have carried out and documented a balancing assessment; you may request a summary of it by writing to privacy@bajablitzgame.com. You have the right to object to this processing; section 9.2 explains how. You can also end the collection at any time by clearing your site data.

We do not use your data to make decisions about you with legal or similarly significant effects, and there is no automated profiling of that kind.

4. Cookies and local storage

Baja Blitz uses your browser’s local storage and sets no cookies.

That is the whole list. You can delete everything at any time by clearing site data in your browser, which also deletes your saved progress.

The Reddit app uses the same three items, with your Reddit username in place of the player ID, and sets no cookies. Reddit clears that storage each time we publish a new version of the app; your results and leaderboard position are held on the server (2.9) and are not affected.

Global Privacy Control. If your browser sends a GPC signal, we treat it as an opt-out request under applicable US state privacy laws.

5. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined under the California Consumer Privacy Act and comparable US state laws. We have not done so in the preceding twelve months, including for anyone under 16.

We disclose data only to service providers who process it on our instructions. These are the providers we use as of the effective date at the top of this page. Section 11 explains how this list is kept current.

We may also disclose data where we are legally required to, or where it is necessary to establish or defend legal claims, or to protect the rights and safety of our users. If Bit Forge Ventures, LLC is involved in a merger, acquisition or sale of assets, data may transfer as part of that transaction; this policy continues to apply until you are told otherwise.

Public information. On our website and mobile apps, leaderboard entries — the generated driver name, the result and the country flag — are visible to everyone. In the Reddit app, your Reddit username, your result and any challenge post created from your run are public on Reddit (2.9).

6. International transfers

We are based in the United States and our infrastructure runs in United States regions. If you use Baja Blitz from the EEA, the UK or Switzerland, your data is transferred to and processed in the United States. We rely on one of two safeguards for each provider in section 5:

• where the provider is certified under the EU–US Data Privacy Framework (with its UK Extension and the Swiss–US Framework), the European Commission’s adequacy decision of 10 July 2023 — this covers our hosting and analytics provider; and
• otherwise, the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, incorporated into our agreement with that provider.

You may ask which mechanism applies to a given provider, and request a copy of it, by writing to privacy@bajablitzgame.com.

7. How long we keep it

The aggregate statistics we keep indefinitely do not relate to any player or identifier and are not personal data.

8. How we protect it

Data is encrypted in transit and at rest by our providers. Replay recordings are stored in a private bucket that is not publicly listable or browsable and cannot be read without server-side credentials. Reading or writing race data requires credentials that are never exposed to your browser. Access is limited to the people who need it.

If a breach affects your personal data we will notify you and the relevant regulators where the law requires it.

9. Your rights

9.1 Everyone

Whatever jurisdiction you are in, you may ask us to give you a copy of the data associated with your player ID or your Reddit username, correct it, or delete it. You can also stop collection yourself at any time by clearing your site data, uninstalling the app, or not playing on Reddit. Where the law requires us to keep a record — a purchase, or how we handled a request — we keep that record and delete the rest (7).

9.2 EEA, UK and Switzerland

You have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict how we process it;
• receive it in a portable, machine-readable format;
• object to processing based on our legitimate interests, including our use of race records for tuning;
• withdraw consent at any time, without affecting processing already carried out on that basis; and
• lodge a complaint with your national data protection authority — for example the UK ICO, or your EEA member state’s supervisory authority.

9.3 California

Under the CCPA as amended by the CPRA, California residents have the right to know what personal information we collect and how it is used and disclosed, to access and to delete it, to correct it, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. We do not offer financial incentives for data, we do not collect sensitive personal information as that term is defined, and — as stated in section 5 — we do not sell or share personal information. Sections 2 and 7 serve as our notice at collection: the categories collected are identifiers (a randomly generated ID, your Reddit username if you play on Reddit, and your email address if you give us one), internet and device activity, geolocation at country level, commercial information (the coin packs you have bought), and the contents of any message you send us; the sources are you, your device, and Apple for purchase confirmations; the purposes and retention periods are set out above. You may use an authorized agent, with proof of authorization.

9.4 Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have comparable rights to access, correct, delete and port their data, and to opt out of targeted advertising, sale, and profiling with legal effects — none of which we do. Where your state provides one, you may appeal a decision of ours by replying to our response or writing to privacy@bajablitzgame.com with “Appeal” in the subject line; we will respond in writing within the statutory period and tell you how to contact your Attorney General if you remain dissatisfied.

9.5 How to make a request

Email privacy@bajablitzgame.com. We answer within one month (GDPR) or 45 days (US state laws), and will tell you if we need an extension the law allows.

On our website and mobile apps your player ID is the handle we work from. You can find it in the game’s settings screen, below the links to this policy, and tap it to copy it; include it in your request. A quoted ID identifies which records a request concerns, but is not proof of who is asking:

• On an ID alone we will confirm whether records exist for it and give you a summary of the categories held, as set out in section 2.
• For a copy of the records themselves, including replay recordings, or for erasure, we will first ask you for details only the player would be able to give — for example the approximate dates or results of recent races on that ID. We will not ask you for identity documents.

If we cannot satisfy ourselves that a request comes from the right person, we will tell you so and decline it.

If you no longer have the game installed, the ID went with it and we hold nothing that recovers it. If you have bought Coins, send us instead the Order ID from Apple’s receipt email for that purchase: we can trace it to the purchase record in 2.8 and to the player ID stored on it. Without an ID or an Order ID we cannot identify your records, and we will write back to tell you so rather than act on a guess.

If your device cleared the game’s storage at some point, a new player ID was created and your earlier records still carry the old one. We act on the IDs you give us; records under an ID you cannot quote will remain until they reach the criteria in section 7.

For the Reddit app, your Reddit username is the handle. Include it in your request, and we may ask you to confirm it by replying to us from that account on Reddit.

Clearing your site data deletes the identifier from your browser; it does not affect Reddit app records, which are tied to your Reddit account. Records already sent to us remain until we delete them on the criteria in section 7; to have them removed sooner, send us the ID or username.

10. Children

Baja Blitz is a general-audience game. It is not directed to children under 13, and we do not knowingly collect personal information from them. If you are in the EEA or UK and under 16 (or the lower age of digital consent set by your country, which may be as low as 13), you should only use Baja Blitz with your parent or guardian’s permission.

If you are a parent or guardian and believe a child has provided us with personal information, write to privacy@bajablitzgame.com. We will investigate and delete the associated records where the report is substantiated. Because the records on our website and mobile apps are pseudonymous, we may need to ask you for the player ID from the child’s device; for the Reddit app, the username.

11. Changes to this policy

We will update this page when our practices change, and change the effective date at the top. If we begin collecting a new category of data, or use what we already hold for a new purpose, we will give notice in the game or on the site before the change takes effect, and seek fresh consent where the law requires it. Changes to the providers in section 5 — replacing one vendor with another for the same purpose — are reflected in that list when they happen rather than announced in advance.

12. Contact

See also our Terms of Service.