Privacy policy
Version 2026-10-30
We collect what's needed to run your account and build race reports: your email, name, the files you upload, and basic logs.
No ads, no tracking cookies, no selling or sharing of personal data. You can download or delete everything from your account page.
Who is responsible
Balint Kiss, 6035 Balloszog. Email: support@racewatcher.app. We are the controller for your account data under the EU General Data Protection Regulation (GDPR).
What we collect and why
| Data | Why | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Email, name, league name, password (stored only as a hash) | Your account and login | Contract, art. 6(1)(b) | Until you delete the account |
| Result files, replays, generated reports and video clips | Building and showing your race reports | Contract, art. 6(1)(b) | Until you delete the race or the account |
| Names of other drivers inside those files | Showing who was involved in each incident to your league's stewards | Legitimate interest of the league in fair racing, art. 6(1)(f) | Until the race is deleted |
| When you accepted the terms and which version | Proof of agreement | Legal obligation and legitimate interest | Life of the account |
| Request logs: IP address, browser, time, page | Security, abuse prevention, fixing errors | Legitimate interest, art. 6(1)(f) | Up to 7 days |
| Billing details (Race Control only) | Taking payment, invoices, tax | Contract and legal obligation, art. 6(1)(b) and (c) | As tax law requires, usually 8 to 10 years for invoices |
| Product emails (only if you ticked the box) | Telling you about new features | Consent, art. 6(1)(a) | Until you untick it |
We don't use your data for advertising, and we don't make automated decisions about you. RaceWatcher never decides who caused an incident.
Drivers named in an uploaded race
Result files contain the names of everyone in the race. If you raced in a league that uses RaceWatcher and want your name removed from a report, send us a request. We'll pass it to the league and, where the league has no strong reason to keep it, remove or replace the name.
Who else handles the data
We use these providers to run RaceWatcher. Each has a data processing agreement with us and only processes data on our instructions.
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Runs the website (Workers), database (D1), file storage (R2, EU jurisdiction), account emails, and protection against attacks | Files stored in the EU; the network runs worldwide |
| Payment provider [Stripe or Paddle] | Race Control payments. We never see your card number. | EU and US |
Where data leaves the EU/EEA (for example to US providers), the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
Your rights
You can ask to see, correct, export or delete your data, object to processing based on legitimate interest, restrict processing, and withdraw consent at any time. Most of this you can do yourself on the account page: Download my data and Delete account. For anything else, email support@racewatcher.app. We answer within one month.
You can complain to your data protection authority, in the EU country where you live or work, or where we are established.
US residents
We don't sell or share personal information, as those words are defined in the California Consumer Privacy Act and similar state laws, and we don't use it for targeted advertising. We honour Global Privacy Control signals, though there is nothing to opt out of. Residents of California, Colorado, Connecticut, Virginia and other states with privacy laws have the rights above: to know, access, correct, delete and port their data, and not to be discriminated against for using them. Use the account page or email us; an authorised agent can act for you with written permission.
Children
RaceWatcher is for people aged 16 and over. We don't knowingly collect data from children under 13 (US) or under 16 (EU). If you think a child has an account, tell us and we'll delete it.
Security
Connections are encrypted (HTTPS). Passwords are stored only as salted PBKDF2 hashes. Files are private to your account. If a breach puts your data at risk, we'll tell you and the authority as the law requires.
Cookies
One cookie that keeps you logged in. Nothing else. See the cookie policy.
Changes
If we change this policy in a way that matters, we'll email you before it takes effect. The version date is at the top.