Privacy Policy

1. Who we are

InRace (inrace.net, "we", "the Service") is a motorsport data platform: GPS-based car performance measurement, car profiles, digital time-attack challenges and blogs. The operator of InRace acts as the data controller for personal data processed through the Service.

For any privacy question or request, contact us at support@inrace.net.

2. What data we collect

Account data. When you register we collect your email address, username and a password (stored only as a cryptographic hash). Optionally you can add profile details: display name, avatar, an "about" text and social links.

Content you upload. GPS telemetry files and the measurement results derived from them, car details and photos, blog posts, comments and other content you choose to publish. Content you mark as public is visible to anyone; measurements and cars are private by default until you share them.

Technical data. For account security we store the IP address and browser (user-agent) of your active login sessions. Server logs may temporarily record request metadata for operations and abuse prevention.

Location data in GPS files. Telemetry files inherently contain location traces of your runs. They are processed to compute performance results and are associated with your account. Do not upload logs recorded in places you do not want to disclose if you later share the measurement publicly.

3. Why we process it (legal bases)

We process your data to provide the Service you signed up for — accounts, measurements, challenges, blogs (performance of a contract, GDPR Art. 6(1)(b)); to keep the Service secure and prevent abuse — session tracking, rate limiting (legitimate interest, Art. 6(1)(f)); and to send transactional email such as address verification and password reset (performance of a contract).

We do not send marketing email, do not sell personal data and do not use automated decision-making with legal effects.

4. Cookies and analytics

InRace uses only strictly necessary cookies: an authentication token that keeps you signed in, a CSRF protection token and short-lived signed cookies used during sign-in flows. These are required for the Service to function and cannot be switched off; no consent banner is required for them.

For usage statistics we run a self-hosted, cookieless analytics instance (Swetrix). It sets no cookies, stores no persistent identifiers, does not track you across sites, and the data never leaves our own EU servers. This is why you do not see a cookie consent banner on InRace.

5. Where your data is stored

All Service data is hosted on servers located in the European Union (Hetzner Online GmbH, Finland). Transactional email is delivered through SMTP2GO, which acts as a data processor for message delivery (recipient address and message content only).

6. Third-party content

User posts may embed third-party video (e.g. YouTube). Such content loads from the third party only when you open the page containing it, and the third party may process your IP address and set its own cookies under its own privacy policy.

7. How long we keep data

Account data and your content are kept until you delete them or your account. Login session records expire automatically (rolling 30-day sessions with an absolute limit of 180 days) and expired records are purged daily.

Encrypted database backups are rotated on a 7-day + 4-week schedule, so deleted data may persist in backups for up to ~35 days before it is gone entirely.

8. Your rights

Under the GDPR you have the right to access, rectify, erase and export your personal data, to restrict or object to processing, and to lodge a complaint with your local supervisory authority.

Most of it you can do yourself: profile data is editable in settings, and account deletion is available in Settings → Security. Deletion is immediate and permanent (hard delete) — your account, measurements, cars and posts are removed from the live database.

For anything else — including data export — email support@inrace.net. We respond within 30 days as required by the GDPR.

9. Age requirement

The Service is not directed at children. You must be at least 16 years old to create an account.