Privacy Policy

1. Controller

Data-rights and privacy contact: [email protected].

2. Data we process

• Account data: email (where supplied), username, public identifier, verification status, account dates, preferences and selected avatar settings. Password-based accounts store a password hash, not a readable password.
• Sign-in data: linked provider name and provider account ID, and profile/email information supplied by that provider. Providers have their own privacy notices. We do not require your social-provider password.
• Service data: telemetry, laps, sessions, device associations, sharing identifiers and community content associated with your use. Public/shared views can expose usernames, identifiers and driving data.
• Technical and security data: IP/device and session information, authentication cookies, request/error logs and anti-abuse checks where enabled.
• Billing data: Stripe customer/subscription references, plan, payment status and billing dates. Stripe handles payment details and may collect billing-country/address or tax information. Our application does not store your full card number or CVC.
• Communications: information you send in support requests, contributions, partnership enquiries or applications.

3. Purposes and legal bases

• Contract (GDPR Article 6(1)(b)): creating and authenticating accounts, processing telemetry, providing requested sharing and paid features, and service communications necessary for those functions.
• Legitimate interests (Article 6(1)(f)): proportionate security, fraud prevention, service reliability, responding to enquiries and protecting legal claims. These interests must be balanced against your rights; you may object where this basis applies.
• Legal obligation (Article 6(1)(c)): applicable accounting, tax, regulatory and legally required disclosures.
• Consent (Article 6(1)(a)), where required for genuinely optional uses such as non-essential tracking or marketing. Such consent must be requested separately and can be withdrawn. Agreeing to the Terms is not consent to all processing.

4. Hosting, recipients and transfers

The service's VPS is hosted with netcup in Europe. This does not mean every third-party service processes data only in the EEA. Hosting/infrastructure, email delivery, authentication, anti-abuse and payment providers may process the data needed for their functions. Stripe and sign-in providers may act as independent controllers for their own activities.

Providers we use: netcup (VPS hosting, Germany), Cloudflare (DNS, CDN, Turnstile anti-abuse and R2 file storage), Brevo (transactional email), Stripe (payments) and Google (optional sign-in). Each processes only the data its function needs.

Where personal data is transferred outside the EEA, the operator must identify and apply the relevant GDPR transfer mechanism, such as an adequacy decision or Standard Contractual Clauses with any necessary supplementary safeguards. Contact the privacy address for details or copies of applicable safeguards. Data may also be disclosed where legally required or necessary to establish or defend legal claims.

5. Cookies and local storage

The application uses authentication/session cookies and short-lived provider sign-in state to operate secure accounts. Browser storage may hold interface preferences and connection/session state. Strictly necessary storage does not require the same consent as optional advertising or analytics. Non-essential tracking must not be enabled without any consent required by applicable law.

We set a sign-in session cookie and, during provider sign-in, a short-lived state cookie; both are strictly necessary. Your browser also stores interface preferences (theme, sidebar, notices you closed). We use no advertising or analytics cookies. If that changes we will ask for your consent first. Embedded anti-abuse (Cloudflare Turnstile) and payment (Stripe) services may have their own storage notices.

Data export: email [email protected] from your registered address. We confirm the request with a one-time code sent to that address and by asking for a detail only the account holder knows, then deliver the data to the registered address only.

6. Retention

We retain data only for its stated purpose, legal obligations and proportionate security/claims needs. Current periods:

• account: until you delete your account
• telemetry: until you delete it or your account
• security: about 30 days
• backups: daily for 14 days, weekly for 8 weeks, monthly for 12 months
• billing: 7 years, as required by Swedish bookkeeping law
• support: up to 12 months

When you retire your account we remove your username, email address, password, sign-in methods, sessions and paired devices. We keep the remaining laps, sessions, rankings, posts and replies in a form that no longer identifies you, so shared leaderboards and totals stay accurate; they are shown as [Retired Driver]. Billing records we must keep by law are retained for the period above. Backups rotate (daily copies for 14 days, weekly for 8 weeks, monthly for 12 months) and are then deleted, so a retired account can remain in older backups for up to about 13 months; backups are never restored into the live service without re-applying retirements. Cancelling a paid plan alone does not retire an account.

7. Your rights

Subject to the GDPR's conditions, you can request access, correction, erasure, restriction, portability and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Contact [email protected]. We normally respond within one month; lawful extensions will be explained. You may complain to your local supervisory authority, including Sweden's IMY where competent.

Required account or payment information is needed to provide the corresponding service; without it, those features may not be available. Do not send sensitive personal information in telemetry, usernames or public posts.

8. Security and updates

We use measures such as password hashing and session access controls, but no internet service can guarantee absolute security. Report suspected account compromise through Contact Us without sending passwords. Material changes to this notice will be communicated as appropriate, with a new version date. New purposes requiring consent will not be authorised merely by updating this text.