Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your display name, email address, and (if you set one) a password stored as a salted bcrypt hash. If you sign in via a third-party provider (Discord, Google, Facebook, iRacing), we receive your profile name, email, avatar, and a provider-specific account ID. We store the OAuth access and refresh tokens these providers issue so we can keep you signed in. OAuth access and refresh tokens are encrypted at rest using AES-256-GCM.

Profile Information

You may add a bio, helmet image, banner, preferred car number, timezone, locale, and notification preferences. If you link a sim-racing platform, we store your external platform ID. When a platform makes profile details available, we may also store ratings, safety rating, license categories, and content ownership flags so we can display your profile and gate appropriately-licensed races.

League & Racing Data

League configurations, season schedules, registrations, race results, lap times, standings, point breakdowns, penalties, protests, appeals, steward votes, announcements, polls, race-control session logs, incidents, flags, messages, and audit-trail entries you create or have created on your behalf.

Technical & Operational Data

We log IP addresses (for rate limiting and abuse prevention), authentication audit-trail rows (action, entity, timestamp, IP), web push notification subscription endpoints (if you opt in), device timezone, and Stripe customer ID (if you upgrade to a paid plan).

2. How We Use Your Information

• To provide, maintain, and improve the Platform
• To authenticate your identity and secure your account
• To send transactional emails (account verification, password resets, league announcements you opt into, billing notices)
• To display public league information (standings, results, driver profiles)
• To detect and prevent abuse, fraud, and security incidents
• To diagnose errors and monitor service health (via our error-reporting sub-processor; see Section 4)
• To understand how the Platform is used and identify areas for improvement, via product analytics (PostHog; see Section 4 and Section 8)

3. Lawful Basis for Processing (GDPR)

For users in the European Union, the United Kingdom, and other jurisdictions with comparable laws, we rely on the following lawful bases:

• Performance of a contract: account creation, league participation, payment processing
• Legitimate interests: fraud prevention, service security, error monitoring, transactional emails
• Consent: non-essential email opt-ins, web push notifications, optional sub-processor data sharing
• Legal obligation: retention of payment records, response to lawful authority requests

4. Sub-processors

The third-party processors we use include the following. Each is scoped and limited to the data category required to perform its function. We do not sell your personal information.

We do not use advertising networks or marketing tracking cookies. Sentry (listed above) may set functional cookies for error monitoring and session replay when a crash occurs.

5. International Transfers

Several of our sub-processors are located in the United States. When we transfer personal data of EU/UK users to a processor outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (SCCs) or an equivalent transfer mechanism executed with each provider.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we anonymize personal identifiers within 30 days while retaining league-internal records (race results, standings, audit-trail rows, payment history) attributed to a "Deleted user" placeholder. This anonymization preserves the integrity of league championships and protest history without continuing to identify you. Stripe payment records are retained per our payment processor's legal requirements (typically 7 years for tax and audit purposes).

Activity Trail (administrative audit log)

Changes to leagues, organizations, teams, scoring rules, broadcast presets, memberships, and roles are recorded in an administrative Activity Trail. Free and Pro leagues retain Activity Trail rows on a rolling 365-day window; Enterprise retention is unlimited. Sensitive values (passwords, API keys, session tokens, authorization headers) are redacted before the row is written. When a user deletes their account, we anonymize the User row that the actor id points at and scrub the per-row IP address and free-text details from each Activity Trail entry they authored. The actor id itself is preserved so admins of the league or organization can verify the action's origin in their Activity Trail; the row remains accountable for the action.

Full details, including the redaction blocklist and upgrade/downgrade behavior, live in the Data Retention Policy.

7. Messaging

Racey has league, organiser and team conversations, and direct messages between two people. League, organiser and team conversations are available in every league.

What we store

The messages you send (text, formatting, mentions, replies and reactions), the earlier versions of messages you edit, pins, when you last read each conversation (for unread counts and read receipts), the people you block, and your messaging settings. Typing indicators are not stored. League announcements are also posted in the league conversation.

Who can see your messages

• League conversation: the league's members, staff and approved drivers.
• Organisers conversation: you and that league's organisers.
• Team conversation: that team's current members. After a season ends, the members of the team's most recent lineup can still read it.
• Direct message: only the two people in it.

League moderators can remove messages in the league conversation, organisers in organiser conversations, and team captains in their team conversation. The author is told the reason. Racey staff cannot read league, organiser or team conversations, or direct messages. The one exception is a report: when someone reports a message, a Racey administrator can see that message and the conversation around it (up to 50 messages on either side) to review it, and every such view is logged.

Direct messages, requests and blocks

You can message someone you share a league or team with, if you both joined it yourselves (or accepted an invite), or opened it on Racey after an organiser or a results import added you. The first message to someone is a message request. Until they accept it, you can send up to 3 messages, they get one alert that you want to message them (never what you wrote), links in your messages cannot be clicked, and there are no read receipts, typing indicators, reactions or pins. They can accept, decline (you are not told) or block.

Under Settings → Privacy → Messages you can turn off Allow direct messages. Nobody can then start a new direct message with you. Direct messages you already have stay readable, but the other person can no longer send you messages in them.

When you block someone, they cannot send you direct messages and you do not see their messages unless you choose to show one. They are not told, though an organiser you block will see that they can no longer post in your organisers thread. A member you block can still write to their league's organisers thread: their messages stay collapsed for you and never alert you. Read receipts do not pass between you. In league and team conversations you both stay, their messages are collapsed for you and never alert you, and they can still see yours. A block is stored with your account (who you blocked and when) until you unblock them under Settings → Privacy → Messages or either account is deleted.

Edits, deletions and reports

When you edit a message, its earlier versions are kept with it until the message is deleted; moderators reviewing a report on it can see them, and they are included in your own export. When a message is deleted, its text and earlier versions are removed from the conversation, and we keep a copy of its last text for 30 days so abuse can be reviewed, then delete that copy. A report stores a copy of the reported message and the 10 messages on either side. That copy is kept while the report is open and for 365 days after it is closed. A message reported by three different people, or reported once for child safety, is hidden automatically while it is reviewed.

Child safety and self-harm

If a message is reported for child sexual exploitation, it is hidden and we preserve the evidence under a legal hold until we release it manually. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), as US law requires. Only the Racey operator is told about these reports and can access the evidence; league administrators and other Racey staff cannot see the reported content.

If a message is reported for self-harm, the person who reported it is shown crisis-support resources, the report goes to the top of our review queue, and the Racey operator is notified. We do not contact emergency services or other authorities automatically.

Alerts and platform announcements

We may alert you by email, Discord or push notification about messages you have not seen, never between 11pm and 7am in the time zone on your profile (UTC if you have not set one). Alerts for league and team conversations include a short excerpt of the message; alerts for organiser conversations do not. Alerts for direct messages do not include the message either. A message request sends one alert, which says who wants to message you and nothing they wrote. A copy of each alert is kept in our notification records for up to 6 months. You can turn alerts off under Settings → Privacy → Messages → Message alerts.

Racey also posts occasional platform announcements: as a banner for every signed-in user, and in the Racey conversation for users who have messaging. Email copies of these announcements are marketing emails. We send them only if you have not opted out of marketing emails, and you can unsubscribe at any time from the link in the email or under Settings → Notifications.

How long messages are kept

Messages are kept for as long as their conversation exists. A team conversation is deleted with its team. When a league is archived, its conversations stay readable by the same people, and nobody can post. If you delete your account, the text messages you sent stay in their conversations with the text replaced by "[message from a deleted account]" (announcements you published keep their text), and your reactions, mentions, read status, blocks (yours and those made of you), edit history and deletion copies are removed. Alert copies already sent to other people stay in their notification records until those expire. A copy held for an open report is kept until that report is closed. Child-safety evidence stays on legal hold.

Deleted messages and expired copies are removed from our live database on the schedule above. They may remain in backups until those backups rotate out. Our daily database backups are encrypted and kept for up to 6 months; a small number of on-server copies taken before software updates, and a weekly copy of stored files, are kept until newer ones replace them. We do not edit or restore individual records inside backups.

Exporting your messages

Settings → Danger → Export Your Data includes the messages you sent (with your own edit history), the conversations you have read, posted in or belong to, and your read-receipt and alert settings, and your setting for allowing direct messages. It does not include other people's messages or the people you have blocked.

8. Cookies & Local Storage

We use the following cookies and browser storage:

• Authentication: Session cookies (httpOnly, Secure, SameSite=Lax) to keep you signed in
• CSRF protection: Auth.js CSRF tokens
• Preferences: Theme selection, dismissed banners, onboarding progress
• Error monitoring: Sentry (see Section 4) may set functional cookies for error monitoring
• Analytics (PostHog): PostHog sets cookies and uses local storage to track pageviews, user navigation, and product events. This helps us understand how the Platform is used. PostHog is initialized once you dismiss the cookie notice, and stays initialized on all pages thereafter. See Section 4 for details of what data PostHog receives.

We do not use advertising or marketing tracking cookies.

9. Your Rights

You have the right to:

• Access the personal data we hold about you (Settings → Danger → Export Your Data)
• Correct inaccurate information (Settings → Profile)
• Delete your account, which anonymizes your personal data within 30 days (Settings → Danger → Delete Account)
• Export your data in a JSON portable format (Settings → Danger → Export Your Data). For messaging, see Section 7.
• Opt out of non-essential communications (Settings → Notifications)
• Lodge a complaint with your supervisory authority (e.g., your national Data Protection Authority in the EU/UK)

For GDPR/CCPA requests beyond the self-service options, contact us at the address in Section 14.

10. Data Security

Your data is stored in encrypted databases. Passwords are hashed using bcrypt. OAuth access and refresh tokens are encrypted at rest with AES-256-GCM. Sessions use signed, httpOnly, Secure, SameSite=Lax cookies. All connections to the Platform use TLS 1.2 or higher. We log all administrative actions and review the audit log periodically. Despite these measures, no online service is 100% secure.

11. Breach Notification

If we become aware of a personal data breach that is likely to result in a risk to your rights or freedoms, we will notify affected users within 72 hours of becoming aware of it, in accordance with GDPR Article 33 and equivalent obligations.

12. Children

Racey is not intended for users under 13 years of age. We do not knowingly collect information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete the information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or a notice on the Platform.

14. Contact

Questions about this Privacy Policy? Contact us at privacy@racey.gg.