LEGAL

Privacy Notice

Effective 29 September 2026 · Version 2026-09-29

1. Who is responsible

Sam Nijsten, resident in the Netherlands, operates Racelytic and is the controller of personal data processed through racelytic.com. Privacy questions and requests can be sent to racelytic@gmail.com.

2. Data we process

  • Account information: username, display name, password hash, account timestamps, and the versions and acceptance time of the Terms and Privacy Notice. Racelytic does not require your email address and never stores your plain-text password.
  • Saved creations: the names, descriptions, visibility settings and configurations of points systems, record definitions and custom championships you save.
  • Ask Racelytic questions: the question text you submit. Racelytic interprets the text on its own server to select a supported archive calculation; it is not sent to an external AI service.
  • Authentication and security: a random session token in a necessary cookie, the token’s cryptographic hash and expiry time, and IP addresses used temporarily in server memory to limit abusive requests. Hosting infrastructure may also create security and access logs.
  • Optional analytics: if you consent, a random visitor identifier, a random visit identifier, the page path without query parameters, the referring website’s host, visit and last-active times, and active duration. Racelytic does not use this system for advertising or cross-site tracking.
  • Correspondence: the sender details, message and related information you provide when contacting Racelytic, making a request or reporting content.

3. Information you make public

Your display name and any points system, record definition or championship you mark public can be viewed by other visitors. Public creations may include their name, description, rules and configuration. Other people and search services may link to, quote or cache public information.

Changing an item to private or deleting it removes it from Racelytic’s public interface, but copies made by third parties or search-engine caches may remain outside Racelytic’s control. Do not publish personal information about yourself or another person unless you are comfortable making it public and have a lawful reason to do so.

4. Why we process data

  • Accounts and saved features: to create your account, authenticate you and provide the features you request. This is necessary to perform our agreement with you under Article 6(1)(b) GDPR.
  • Ask Racelytic: to interpret the question you submit and perform the requested archive calculation. This is necessary to provide the feature you request under Article 6(1)(b) GDPR.
  • Security and service integrity: to prevent abuse, protect accounts, investigate faults and maintain the service. This is necessary for performance of the service and our legitimate interests under Article 6(1)(b) and 6(1)(f) GDPR.
  • Public creations and moderation: to publish items you choose to share, respond to reports and enforce the Terms. This supports performance of the service and our legitimate interests in operating a safe, lawful community feature under Article 6(1)(b) and 6(1)(f) GDPR.
  • Optional audience analytics: to understand visits, popular pages and active use, based solely on your consent under Article 6(1)(a) GDPR. Refusing or withdrawing consent does not restrict Racelytic.
  • Requests and legal compliance: to answer enquiries, handle data-protection requests and meet applicable obligations under Articles 6(1)(c) and 6(1)(f) GDPR, depending on the request.

Racelytic does not sell personal data, use it for behavioural advertising, or make decisions producing legal or similarly significant effects through automated processing. Automated rate limits may temporarily reject excessive account, Ask Racelytic or analytics requests.

5. Where the data comes from

Account details, saved creations, Ask Racelytic questions and correspondence come directly from you. Session, security and analytics information comes from your browser and requests to the server. If someone reports a public creation, information about that report comes from the reporting person.

6. Recipients, hosting and transfers

Racelytic is hosted on a STRATO virtual private server in Germany, where the application database and Ask Racelytic interpreter are also hosted. STRATO processes hosting and infrastructure information on the operator’s behalf. Access is limited to what is needed to operate, secure and maintain the service.

Messages sent to the contact address are processed through Google as the email provider. Email processing may involve processing outside the European Economic Area under safeguards made available by Google. Other application and analytics data is not intentionally transferred outside the EEA. Data may also be disclosed where required by law or reasonably necessary to establish, exercise or defend legal claims.

Links to external websites do not send Racelytic account data to those operators, but visiting an external link gives that website the ordinary technical information associated with your visit and makes its own privacy terms applicable.

7. How long we keep data

  • Account information and saved creations remain until you delete the relevant item or request account deletion, unless limited retention is required by law or for an unresolved claim.
  • Ask Racelytic question text is not saved in the application database. To understand follow-up questions, the latest conversation is held in temporary server memory for up to 30 minutes. The current tab also keeps the conversation and latest calculated answer in session storage so it can be restored after a reload. Racelytic restores that browser copy for up to 25 minutes; New conversation clears the browser copy and requests deletion of the server copy. A question included in the page address can remain in your browser history until you remove it.
  • Login sessions expire after 30 days and can end earlier when you sign out. Changing your password ends other active sessions.
  • Optional analytics visits are automatically deleted after 13 months.
  • Account-attempt rate-limit records remain in server memory for up to 15 minutes; Ask Racelytic rate-limit records remain for up to five minutes; analytics rate-limit records remain for up to 60 seconds.
  • Hosting security and access logs are kept only for the period configured for operation, troubleshooting and security.
  • Correspondence and reports are retained for as long as needed to answer, document and, where relevant, defend the request or decision.

8. Cookies and browser storage

The racelytics_session cookie is strictly necessary to keep you signed in. It is HTTP-only, uses SameSite=Lax, lasts up to 30 days and is marked Secure in production.

Racelytic uses local or session storage on your device for functional preferences and convenience features. These can include your selected championship, analytics choice, recent tool selections, game progress and statistics, page caches, temporary Ask Racelytic conversations, and unfinished points-system, scenario or championship drafts. Session-storage information normally lasts for the browser tab’s session; local-storage information remains until the site or you remove it. You can clear either using your browser controls, although doing so resets the relevant preference, progress or draft.

Optional analytics starts only after you select “Allow analytics”. The consent choice and, if allowed, a random visitor ID are stored in your browser for up to 13 months. Use “Privacy settings” in the footer to withdraw or change your choice at any time. Selecting “Decline” stops further analytics collection on that device and removes its analytics visitor ID. Withdrawal does not affect processing that occurred while consent was valid. Racelytic also honours an enabled Do Not Track browser signal.

9. How we protect data

Passwords are stored using salted cryptographic hashes. Session tokens are random, the database stores only their hashes, and production session cookies use HTTP-only, SameSite and Secure protections. Access controls separate private creations from public ones, and request limits help reduce automated abuse.

No online service can guarantee absolute security. Please use a unique password and contact racelytic@gmail.com if you believe your account or personal data has been compromised.

10. Your rights

Subject to the conditions in the GDPR, you may request access to, correction of, deletion of, restriction of, or portability of your personal data. You may object to processing based on legitimate interests and withdraw analytics consent at any time without affecting earlier lawful processing. Where processing is restricted by a legal obligation or overriding lawful reason, we will explain that in our response.

Send requests to racelytic@gmail.com. You do not need to use legal language, but we may ask for enough information to verify that the request concerns you or your account. You may also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or another competent EEA supervisory authority.

11. Children

Racelytic accounts are intended for people aged 16 or older. Do not create an account if you are under 16. Visitors who do not create an account can use the public archive, subject to the ordinary browser and server information described above.

12. Changes to this notice

We may update this notice when Racelytic, its providers or applicable requirements change. The current effective date and version are displayed at the top. Where a change materially affects account holders, we will provide appropriate additional notice or request a new acknowledgement when required.