Privacy Policy

1. Who we are

RaceCopilot ("we", "us") operates the website at racecopilot.app and related desktop and mobile applications. This policy explains how we handle personal data when you use our services.

2. Data we collect

• Account data: email address, display name (if provided), and authentication identifiers when you sign up via email, Google, or Discord.
• Subscription data: plan tier, billing status, and Stripe customer identifiers if you subscribe to a paid plan.
• Usage data: AI call counts, session metadata, and product analytics needed to operate your account and enforce plan limits.
• Race telemetry: when you use the desktop or mobile app, raw gameplay telemetry (UDP packets) is processed on your device and never leaves it. When you are signed in, derived data — session summaries, radio transcripts, AI prompts, and usage metrics — is synced to our cloud automatically as a core function of your account (to power history, analytics, and cross-device access). This sync is part of the service and is not separately toggleable while signed in.
• Technical data: IP address, browser type, and device information collected automatically for security and service operation.

3. How we use your data

We use personal data to:

• create and manage your account;
• provide AI race engineer and analytics features;
• process payments and manage subscriptions;
• send transactional emails (account confirmation, password reset, billing);
• improve reliability, security, and product performance;
• comply with legal obligations.

4. Third-party processors

We use trusted providers to run the service, including:

• Supabase — authentication and database hosting (accounts, subscriptions, session index, radio transcripts); hosted in the EU (Frankfurt / eu-central-1);
• Cloudflare R2 — object storage for session JSON and media, and infrastructure;
• Stripe — payment processing and tax (card data is handled by Stripe, never stored on our servers);
• OpenRouter — AI and text-to-speech API calls for paid tiers.

Your full UDP telemetry stays on your own PC and never leaves it. When you are signed in, derived data (session summaries, radio transcripts, and usage metrics) is synced to our cloud automatically to provide your account, history, and analytics; this sync is a core function of a signed-in account and is not separately toggleable. These processors only receive data necessary for their function and are bound by their own privacy policies and data processing terms. Where data is transferred outside the EEA, it is protected by appropriate safeguards such as EU Standard Contractual Clauses.

5. Legal basis (EEA / UK)

Where GDPR applies, we process data based on: contract performance (providing the service you signed up for), legitimate interests (security, fraud prevention, product improvement), legal obligation, and — where required — your consent (e.g. optional marketing, if offered).

6. Retention & account deletion

Most of what we store is pseudonymous — race sessions, radio transcripts, and usage metrics are tied to your account ID rather than being personally descriptive, and your full UDP telemetry never leaves your PC. We keep your data while your account is active.

You can delete your account at any time from Settings → Delete account (or by contacting us). When you do:

• Erased: your account, profile, race sessions, radio transcripts, usage records, shared setups and ratings, stored API sub-key, and synced files.
• Cancelled: any active subscription (no further billing).
• Anonymised, not deleted: security and activity logs are kept with your user reference removed, so no personal data remains.
• Retained where legally required: payment and tax records held by our payment processor (Stripe) are kept for the statutory retention period (in Austria, generally ~7 years under the BAO) to meet accounting and VAT obligations. This is a legal exception to erasure under GDPR Art. 17(3)(b).

7. Cookies

We use only strictly necessary cookies: a Supabase authentication cookie to keep you signed in, and cookies set by Stripe during checkout. These are essential to operate the service and do not require consent. We do not use advertising or third-party tracking/analytics cookies. If we introduce any in future, we will ask for your consent first.

8. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. EEA/UK users may also lodge a complaint with their local data protection authority. Contact us at the email below to exercise these rights.

9. Children

RaceCopilot is not directed at children under 16. We do not knowingly collect personal data from children.

10. Changes

We may update this policy from time to time. The "Last updated" date at the top reflects the latest revision. Continued use after changes constitutes acceptance of the updated policy.