1. Who is responsible
Sam Nijsten, resident in the Netherlands, operates Racelytic and is the controller of personal data processed through racelytic.com. Privacy questions and requests can be sent to racelytic@gmail.com.
2. Data we process
- Account information: username, display name, password hash, account timestamps, and the versions and acceptance time of the Terms and Privacy Notice. Racelytic does not require your email address and never stores your plain-text password.
- Saved creations: the names, descriptions, visibility settings and configurations of points systems, record definitions and custom championships you save.
- Authentication and security: a random session token in a necessary cookie, the token’s cryptographic hash and expiry time, and IP addresses used temporarily in server memory to limit abusive requests. Hosting infrastructure may also create security and access logs.
- Optional analytics: if you consent, a random visitor identifier, a random visit identifier, the page path without query parameters, the referring website’s host, visit and last-active times, and active duration. Racelytic does not use this system for advertising or cross-site tracking.
- Correspondence: the sender details, message and related information you provide when contacting Racelytic, making a request or reporting content.
3. Information you make public
Your display name and any points system, record definition or championship you mark public can be viewed by other visitors. Public creations may include their name, description, rules and configuration. Other people and search services may link to, quote or cache public information.
Changing an item to private or deleting it removes it from Racelytic’s public interface, but copies made by third parties or search-engine caches may remain outside Racelytic’s control. Do not publish personal information about yourself or another person unless you are comfortable making it public and have a lawful reason to do so.
4. Why we process data
- Accounts and saved features: to create your account, authenticate you and provide the features you request. This is necessary to perform our agreement with you under Article 6(1)(b) GDPR.
- Security and service integrity: to prevent abuse, protect accounts, investigate faults and maintain the service. This is necessary for performance of the service and our legitimate interests under Article 6(1)(b) and 6(1)(f) GDPR.
- Public creations and moderation: to publish items you choose to share, respond to reports and enforce the Terms. This supports performance of the service and our legitimate interests in operating a safe, lawful community feature under Article 6(1)(b) and 6(1)(f) GDPR.
- Optional audience analytics: to understand visits, popular pages and active use, based solely on your consent under Article 6(1)(a) GDPR. Refusing or withdrawing consent does not restrict Racelytic.
- Requests and legal compliance: to answer enquiries, handle data-protection requests and meet applicable obligations under Articles 6(1)(c) and 6(1)(f) GDPR, depending on the request.
Racelytic does not sell personal data, use it for behavioural advertising, or make decisions producing legal or similarly significant effects through automated processing. Automated rate limits may temporarily reject excessive account or analytics requests.
5. Where the data comes from
Account details, saved creations and correspondence come directly from you. Session, security and analytics information comes from your browser and requests to the server. If someone reports a public creation, information about that report comes from the reporting person.
6. Recipients, hosting and transfers
Racelytic is hosted on a STRATO virtual private server in Germany, where the application database is also hosted. STRATO processes hosting and infrastructure information on the operator’s behalf. Access is limited to what is needed to operate, secure and maintain the service.
Messages sent to the contact address are processed through Google as the email provider. Email processing may involve processing outside the European Economic Area under safeguards made available by Google. Application and analytics data is not intentionally transferred outside the EEA. Data may also be disclosed where required by law or reasonably necessary to establish, exercise or defend legal claims.
Links to external websites do not send Racelytic account data to those operators, but visiting an external link gives that website the ordinary technical information associated with your visit and makes its own privacy terms applicable.
7. How long we keep data
- Account information and saved creations remain until you delete the relevant item or request account deletion, unless limited retention is required by law or for an unresolved claim.
- Login sessions expire after 30 days and can end earlier when you sign out. Changing your password ends other active sessions.
- Optional analytics visits are automatically deleted after 13 months.
- Account-attempt rate-limit records remain in server memory for up to 15 minutes; analytics rate-limit records remain for up to 60 seconds.
- Hosting security and access logs are kept only for the period configured for operation, troubleshooting and security.
- Correspondence and reports are retained for as long as needed to answer, document and, where relevant, defend the request or decision.
8. Cookies and browser storage
The racelytics_session cookie is strictly necessary to keep you signed in. It is HTTP-only, uses SameSite=Lax, lasts up to 30 days and is marked Secure in production.
Racelytic uses local or session storage on your device for functional preferences and convenience features. These can include your selected championship, analytics choice, recent tool selections, game progress and statistics, page caches, and unfinished points-system, scenario or championship drafts. Session-storage information normally lasts for the browser tab’s session; local-storage information remains until the site or you remove it. You can clear either using your browser controls, although doing so resets the relevant preference, progress or draft.
Optional analytics starts only after you select “Allow analytics”. The consent choice and, if allowed, a random visitor ID are stored in your browser for up to 13 months. Use “Privacy settings” in the footer to withdraw or change your choice at any time. Selecting “Decline” stops further analytics collection on that device and removes its analytics visitor ID. Withdrawal does not affect processing that occurred while consent was valid. Racelytic also honours an enabled Do Not Track browser signal.
9. How we protect data
Passwords are stored using salted cryptographic hashes. Session tokens are random, the database stores only their hashes, and production session cookies use HTTP-only, SameSite and Secure protections. Access controls separate private creations from public ones, and request limits help reduce automated abuse.
No online service can guarantee absolute security. Please use a unique password and contact racelytic@gmail.com if you believe your account or personal data has been compromised.
10. Your rights
Subject to the conditions in the GDPR, you may request access to, correction of, deletion of, restriction of, or portability of your personal data. You may object to processing based on legitimate interests and withdraw analytics consent at any time without affecting earlier lawful processing. Where processing is restricted by a legal obligation or overriding lawful reason, we will explain that in our response.
Send requests to racelytic@gmail.com. You do not need to use legal language, but we may ask for enough information to verify that the request concerns you or your account. You may also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or another competent EEA supervisory authority.
11. Children
Racelytic accounts are intended for people aged 16 or older. Do not create an account if you are under 16. Visitors who do not create an account can use the public archive, subject to the ordinary browser and server information described above.
12. Changes to this notice
We may update this notice when Racelytic, its providers or applicable requirements change. The current effective date and version are displayed at the top. Where a change materially affects account holders, we will provide appropriate additional notice or request a new acknowledgement when required.