DeepInTime's games run on your own device. You can play without an account, and we collect as little
as we can. This page explains what we do collect, why, and who else receives data when you play. Erode Lab, our science
lab at erodelab.com, is a separate site with its own privacy policy and its own accounts.
Rob Williams is responsible for this data (the "controller" under EU and UK
law). Postal address: 7426 Cherry Ave, Ste 210 PMB 1076, Fontana, CA 92336-4263, United States. Email: hello@deepintime.com.
Without an account
The games run in your browser. Your settings and local builds stay on your device; we receive
only what's described here, such as a race time you finish.
Hosting. deepintime.com is served by Cloudflare, including the fonts and code libraries the games
use, so loading them doesn't contact anyone else. Like any web host, Cloudflare processes your IP address and request
details to deliver pages and protect the site from abuse.
Cloudflare Web Analytics. Cloudflare adds a small script to our pages that reports each page load
and how long it took (the page, the website you came from, your browser and country). It sets no cookies, stores
nothing on your device and doesn't follow you across sites.
Visitor statistics. Our own pages send our own server a note of each page view: the page, the
website you came from (its name only), your country and device type. Visits are counted with a code made from
your IP address and browser that changes every day and can't be traced back to you once the day is over; nothing
is stored on your device for this. Google Analytics is separate and is described below.
How the games are used, anonymously: the place loaded (rounded to the nearest degree, about
100 km), which game or mode you picked, how far you got, and which data services failed to answer (their names, not
the request). We use it to fix problems and decide what to build. You can turn these statistics and the page-view
counts above off for this browser; the choice is remembered in a cookie, dt_stats_choice (13 months).
Anonymous statistics: checking…
A visitor ID cookie (dt_vid, a random number, 13 months), only where allowed: it
lets us count returning visitors and how many visits come before someone buys. It's first-party, read only by
our own statistics, and never shared with advertising partners.
In the US it's on unless you turn it off below or your browser sends a Global Privacy Control signal.
Everywhere else it's set only if you consent, in the consent message (shown while ads are on) or with the
switch below, and removed if you withdraw consent.
The switch remembers your choice in a second cookie, dt_vid_choice (13 months).
Browser storage. The games remember a few conveniences in your browser's local storage, such
as your racer name and local builds, and what you've earned without an account: raid clears and trophies,
treasure you've picked up, and a secret for each race time you set, so an account can claim the time later. This
stays on your device unless you sign in, when it's added to your account (see below). The sign-in page also
remembers, on this device only, that the age question has been answered, so it isn't asked again.
Data services your browser contacts
To build the terrain, your browser fetches elevation data directly from Terrain Tiles on Amazon Web Services
(s3.amazonaws.com). Each request includes the coordinates of the place being loaded (not your own
location) and, as with any web request, your IP address. Amazon Web Services is independent of us and has its own
privacy terms.
With an account
Email address, to sign you in (we email you a one-time link and a 6-digit code) and to contact you
about your account, purchase or subscription. We don't send marketing email unless you opt in.
Callsign (display name) you choose, and the jeep paint and raid hunter you pick. Others see
them in squads, race rooms and on leaderboards.
Your age range: when you sign up we ask the year you were born. We keep only the range
(13 to 15, 16 to 17, or 18 and over), never the year. If the answer is under 13 we don't create an account and keep
nothing. Accounts made before we asked are asked once, at their next sign-in. Under 18, we never show personalised
ads.
Progress: raid clears (when, solo or squad, the fight time, grade, how many went down, how
many people were in the squad), the trophies on your trophy wall, treasure pickups (the place, rounded, the item
and when), and builds from your devices (the build file and its place), so they follow you between devices.
Progress you earned without an account joins it when you sign in; nothing is added twice.
Recent squadmates: when you finish a raid or a race with other signed-in players, each of you
keeps the others' callsigns, what you played, the room or raid code and when, for 30 days. You can invite them
again; an invite (who, what and the code) shows on their Home for a day and is deleted after a week.
Friends: when you add a squadmate and they add you back. Friends see each other's best race times
compared with their own. Nobody sees your email or account ID.
Where a sign-up came from: whether you signed up from saved progress, after a raid win or a new
race record, kept with the account's activity so we can see what makes accounts worth having.
Phone sign-in codes: a QR code shown on a signed-in screen is a one-time sign-in link for your
account that lasts 3 minutes. We keep a one-way hash of it, like a sign-in email's link.
A session cookie (__Host-dt_session) that keeps you signed in: 90 days, renewed while you
use the site, or only until you close the browser if you untick "Keep me signed in". It's strictly necessary, so it doesn't need consent. We store only a one-way hash of it.
Purchase and subscription status: whether your account has Supporter, whether it has World
(its status, plan, renewal date and Stripe's references), the World invoices paid and refunded, and any badge or
free month on the account.
Preferences you set, such as a home place, units and graphics settings, so they follow you between
devices.
A sign-in cookie (__Host-dt_link, 15 minutes) set when you ask for a sign-in email,
so the 6-digit code only works in the browser that asked for it. It's strictly necessary.
Passkeys, if you add one: the public key, an ID for it, the device type, a name for it (we
suggest one from your browser, and you can change it), and when it was last used. The private key never leaves your
device. We also keep whether you said "Not now" to the offer to add one, so we don't ask again.
A passkey cookie (__Host-dt_wa, 5 minutes) set while you add a passkey or sign in
with one, so the one-time challenge only works in the browser that asked for it. It's strictly necessary.
Account activity: when you signed up, signed in, changed your name, bought or were refunded,
kept for security and support. It's included in your data export.
Notice emails, only if you turn them on in Settings: when a friend beats one of your race
records, and when a squadmate asks for a rematch (at most one of each a day). We note which we sent and when.
A log of the emails we send, with your address stored only as a one-way hash, so we can
spot delivery problems and abuse. The sign-in link and a one-way hash of its code are kept for a day after they expire.
Your visits while signed in are counted against your account (with the statistics above), so
we can see how often account holders come back, but only where the visitor ID is allowed (see above: in the US
unless you turn it off, elsewhere only with your consent). The visitor ID is then linked to your account.
Races
When you finish a clean race, your time goes on a public leaderboard for that course: the time, splits, medal,
vehicle and the course's place, under your display name (or, without an account, the racer name you typed, or "Racer").
We keep a replay of the run (a "ghost") so others can race against it. Leaderboards never show your email or account.
Runs we can't verify are logged without the replay, to stop cheating. While you're in a race lobby, the other racers see
your racer name, vehicle and position live; that isn't kept after the race.
The shared build world
In the shared build world, other players see your display name, the plots you claim and what you build on them.
The world keeps your coins, your plots and pieces, where you last stood, and a log of the edits made on each plot
(for undo and to settle disputes). If you release a plot or your World plan ends, a copy of your build is kept in
your builds.
Squad voice
Squad voice is for signed-in players aged 18 or over, and is off until you turn it on in Settings. When you join
voice in a raid squad, your browser asks for the microphone and sends your voice to Cloudflare's Realtime relay,
which passes it only to the other people in that squad who have joined voice. It never goes straight between
players, so they don't see your IP address. We don't record voice and don't keep any audio.
While you're in voice, the squad's room keeps which seat is in voice, whether your microphone
is on (for the squad's talking indicators), and a relay session ID. They go when you leave voice or the room
closes.
Talk time: we add up minutes of voice for all players together each month, to cap the cost.
It isn't kept per player.
Blocks: who you blocked and when. A block works both ways (neither of you hears the other, and
invites between you are dropped). Kept until you unblock or either account is deleted.
Reports: who reported whom, when, the squad code, the reason and any note. We use them to keep
voice safe and may take voice away from, or suspend, an account. Kept for 2 years, or until either account is
deleted.
Removed from a squad: when a host removes a player, the room keeps that account and a one-way
hash of their IP address, only so they can't rejoin with that code, until the room closes.
Mute and volume settings for other players stay in your browser. Voice relies on our legitimate interest in
running a safe game; turning it on is your choice, and you can turn it off at any time.
Payments
Supporter and World are sold through Stripe Managed Payments: Stripe is the merchant of record. It takes the
payment, collects World renewals, works out and pays any sales tax or VAT, and handles your payment and tax details as its own customer data.
You give your card details to Stripe, not to us. Stripe tells us that a payment succeeded or failed, the amount, your email
and your country, and the state of a World subscription. Stripe's own use of your data is covered by the
Stripe Privacy Policy.
Google Analytics
To understand how people find and play the games, deepintime.com uses Google Analytics 4 (Google Ireland Limited
in the EEA, UK and Switzerland; Google LLC elsewhere), in addition to our own statistics above. It is not used on our
admin pages.
What it collects: the pages you visit (the address without anything after a "?", so no
sign-in or checkout details), the website you came from (its name only), and the same coarse game events described
above: the place loaded (rounded to a degree), the game or mode, how far you got, failed data services, the choices
you make on the front page, and when you sign up, sign in, start checkout, start a World trial or buy Supporter or
World (what was bought and the amount, never your name, email, account or card details). It also records your
device, browser and language, and Google works out an approximate location from your IP address; GA4 doesn't store
the IP address itself. We don't give Google your account, email or any user ID.
Cookies:_ga and _ga_<ID>, which tell visits apart. Google
sets them for up to two years by default; we keep Google Analytics data for 14 months.
No advertising use: Google signals and ad personalisation are turned off for our Google Analytics,
and we don't link it to Google Ads or share the data for advertising.
Consent: in the EEA, the UK and Switzerland, Google Analytics runs in Consent Mode: until you
consent (in the consent message shown while ads are on), it sets no cookies and receives only cookieless pings
with no identifier. Elsewhere it is on unless you turn it off.
Global Privacy Control: if your browser sends it, Google Analytics is not loaded at all.
Opting out: use the Google Analytics switch above (it remembers your choice in a cookie,
dt_ga_choice, 13 months, and deletes the _ga cookies), turn on Global Privacy Control, or
install Google's opt-out browser add-on.
If you don't have Supporter or World, the games show ads from Google AdSense. Google and its partners may use
cookies or similar identifiers to show and measure ads.
If your account says you're under 18, we only ever ask Google for non-personalised ads.
In the European Economic Area, the UK and Switzerland, we ask for your consent before any advertising
cookies are set, through a consent banner. You can change your choice at any time from the privacy and cookie
settings link shown at the bottom of the page in those regions.
To run your account, sign you in, provide Supporter and World, keep leaderboards and the shared build world, and
store your preferences: to perform our contract with you.
Hosting, security, abuse prevention, Cloudflare Web Analytics and anonymous statistics: our legitimate interest in
running a safe, working service.
The visitor ID cookie: your consent (in the US, our legitimate interest, with an opt-out).
Google Analytics: your consent in the EEA, UK and Switzerland; elsewhere our legitimate interest in understanding
how the site is used, with an opt-out.
Advertising cookies in the EEA, UK and Switzerland: your consent.
Keeping payment records: legal obligation (tax and accounting law).
How long we keep it
Account data: until you delete your account, then removed within 30 days (backups within 90).
During that 30-day window, a restricted restore record holds your old email and display name so support can
restore your account identity if you ask. Sign-in methods, cancelled subscriptions and removed shared content
are not restored. Stripe webhook payloads used to check payments are kept for 90 days after successful handling.
Google Analytics data: 14 months.
Visitor statistics and game usage: 90 days. The daily code's ingredient is deleted after two days.
Statistical totals (such as daily page and funnel counts, and page counts by UTC hour) can be kept longer. They contain no
visitor codes, account IDs, emails or IP addresses. Referrers are grouped by type and URLs lose queries,
fragments and share codes. Global Privacy Control also stops our first-party statistics.
The visitor ID's record (first and last visit): 13 months after your last visit.
Sign-in links and codes: a day after they expire. Email log: 90 days.
Race lobby positions: not stored after you disconnect.
Recent squadmates: 30 days after you last played together. Squad invites: a week. Friendships: until either
of you removes the other or deletes the account. Deleting your account removes your squad history, friendships
and invites at once, from your side and the other people's.
Progress, trophies and builds from your devices: until you delete your account. Your age range: as long as the
account.
Race times and their replays: until you delete your account, when they leave the leaderboards at once. Without
an account, write to us with the racer name, course and time and we'll remove them. Runs we couldn't verify: 90 days.
The shared build world: while you play. If your World plan ends your plots stay read-only for 12 months, then
they're released. Deleting your account removes your plots, pieces, coins, position and edit log at once.
Payment records: as long as tax law requires, typically 7 years.
Admin audit records: our restricted console records the operator's email, role, action, reason, IP address,
time and the record accessed or changed. These records are append-only and kept for security accountability.
Operators are told not to put customer personal details in reasons. They are never sent to Google.
Security-policy reports: counts grouped by day, policy rule and known service, kept 30 days. We discard
page URLs, query strings, report samples and unknown hostnames; no visitor identifier is stored.
Server and security logs: kept by Cloudflare for a short period under its own retention.
Who processes data for us
Cloudflare, Inc.: hosting, database, file storage, email sending, Cloudflare Web Analytics, storing our own
statistics, and the Realtime relay that carries squad voice (it doesn't record it).
Cloudflare Turnstile, if enabled on sign-in: a security check against automated abuse. It processes challenge
tokens and browser/network signals to verify the request. It is off by default, is separate from analytics and
advertising, and is never sent to Google.
Stripe, Inc. and its affiliates: payments, as merchant of record for Supporter and World.
Google LLC and Google Ireland Limited: advertising (when ads are shown) and Google Analytics (website statistics).
We don't sell your personal information. Some of these companies process data outside your country,
including in the United States; where required, transfers rely on the EU–US Data Privacy Framework or
standard contractual clauses.
Your rights
You can ask to see, correct, export or delete your personal data, object to or restrict its use, and withdraw
consent at any time. Email hello@deepintime.com; we'll reply within 30 days. You can also download your data
and delete your account yourself on the account page. If you're in the EEA or UK you may complain to your data protection
authority.
California residents: we don't sell personal information. Showing personalised ads can count as
"sharing" under California law; you can opt out through the privacy settings link
shown at the bottom of the page or with a Global Privacy Control signal, which we honour.
Children
DeepInTime's games aren't directed at children under 13, and accounts require you to be at least 13 (or older where
your country requires). Sign-up asks the year you were born; an answer under 13 gets no account, and we store
nothing from it. Because a year alone can't tell us whether your birthday has passed, we count the younger possible
age. If you believe a child has given us personal data, contact us and we'll delete it.
Changes
If we change this policy in a significant way, we'll post a notice on the site, and email account holders, before
the change takes effect.
October 30, 2026: squad voice (see Squad voice): for signed-in players 18 and over, off
until turned on, carried by Cloudflare's Realtime relay and never recorded. We keep blocks, reports and a monthly
total of talk time.
October 30, 2026: accounts keep progress earned without one (raid clears, trophies, treasure, race times and
builds), recent squadmates and friends, invites, an age range from a birth-year question at sign-up (no ads
personalisation under 18), the jeep paint and hunter you show others, phone sign-in by QR code, opt-in notice
emails, and where a sign-up came from.
October 26, 2026: the science lab moved to its own site, Erode Lab at erodelab.com, with
its own privacy policy and accounts. This policy now covers DeepInTime's games only, so the lab's run results, lent
GPUs, cloud saves, uploads, rooms, plan interest, quotes, invoices and class links are no longer described here.
Added Cloudflare Web Analytics, a cookieless page-load report.
October 21, 2026: invoices to schools, universities and companies are sold by us through a separate Stripe account
(Stripe as processor, with tax calculation): what we keep for an invoice, including the billing address and tax status.
October 21, 2026: added classroom links: no student accounts or personal data, no analytics or ads, third-party
data fetched through our server, daily open counts only, deleted 30 days after a link ends.
October 21, 2026: added quote requests from the pricing page: what we store, that the request is emailed to us,
and that it is kept 12 months.
October 20, 2026: described the restricted admin console's append-only access and change audit records.
October 20, 2026: explained account identity restoration within the existing 30-day deletion window and
90-day retention of successfully handled Stripe webhook payloads.
October 20, 2026: added daily and hourly aggregate statistics without identifiers, retained beyond the 90-day raw
event window; clarified URL reduction and Global Privacy Control for first-party statistics.
October 20, 2026: described optional Turnstile form protection and 30-day aggregate security-policy reports.
October 18, 2026: sharing run results and fitted starts, and lending your GPU, both opt-in;
race leaderboards, rooms and the shared build world described; non-personalised ads with Global Privacy Control.
October 18, 2026 (announced; takes effect November 1, 2026): in the US only, sharing run results and fits on by
default with an opt-out; Global Privacy Control still turns it off. No change outside the US.
October 18, 2026: US fault data is now served from our own storage alongside the global fault tiles rather than
fetched live from the U.S. Geological Survey (earthquake.usgs.gov).