Privacy Policy

This policy covers the Racenda website and mobile app (the "Service"): a calendar of motorsport events in the Baltics with results and cancellation / postponement alerts.

Event, venue and series information is not personal data. This policy is about data that relates to you as a person.

The controller responsible for your personal data is the entity named under "Who is responsible" on this page. You can contact us using the details under "How to reach us".

You can browse Racenda without an account. If you create one, we store:

• your email address;
• a password stored only as an Argon2 hash — we never keep your plaintext password;
• an optional display name;
• your language preference and how you signed in (email, or Google / Apple if enabled).

We also keep short-lived sign-in session records (hashed refresh-token references) so we can keep you signed in and end sessions on logout.

To deliver the cancellation and postponement alerts that are the core of Racenda, we store the events, disciplines and countries you choose to follow and the channels you pick (push and / or email).

If you enable push notifications, we store a device push token so we can send them. We keep a record of alerts we have sent to avoid sending duplicates.

If you mark yourself as going to an event, we store that choice; only the anonymous total count is shown publicly.

Racenda republishes results from public federation calendars and timing providers (for example MYLAPS Speedhive). These classifications can include a competitor name next to a finishing position. A name is the only personal datum we take from results — we do not ingest contact details, licence numbers or dates of birth.

Our legal basis is legitimate interest (Article 6(1)(f) GDPR): operating a public sporting-results reference for the Baltic community, from data already published by the organisers. If you are named and want your name removed or corrected, contact us (see "How to reach us") and we will act on your request.

When you use our contact form we store your name, email address, the topic you chose and your message, so we can reply and keep a record of the request. We use this to handle your enquiry (and, for a partnership or press enquiry, to follow up). We do not use it for marketing.

Racenda Premium is billed through Stripe. Stripe processes your card details directly as an independent controller under its own privacy policy — we never see or store your full card number. We keep your subscription status, tier, renewal date and the Stripe customer / subscription identifiers needed to manage your plan.

The free tier is ad-supported. When advertising goes live it will be served by Google (AdSense on web, AdMob in the app). Personalised advertising and any advertising cookies run only after you consent through our consent banner (a TCF v2.3 consent-management platform). You can change or withdraw that consent at any time — see our Cookie Policy.

With your consent, we also use privacy-focused product analytics (PostHog, hosted in the EU) to understand how Racenda is used — which pages are visited and which features are used. It runs only after you consent through the same banner, respects your browser’s Do-Not-Track setting, and is never sent personal details — no email, no name, and never the text you type. We do not profile you or sell your personal data.

We rely on:

• performance of a contract — to run your account and deliver the alerts and subscription you ask for;
• legitimate interests — to operate and secure the Service, republish public results, and respond to your messages;
• consent — for personalised advertising, product analytics and non-essential cookies, which you can withdraw at any time.

We share data only with processors that help us run the Service, under data-processing terms:

• Hetzner — EU (Germany / Finland) hosting of our application and database;
• Google Firebase Cloud Messaging — delivery of push notifications;
• our email provider — sending alert and transactional emails over SMTP;
• Stripe — subscription billing;
• Google — advertising, only after you consent;
• PostHog — EU-hosted product analytics, only after you consent.

We do not sell your personal data. We may disclose data if the law requires it.

Your core account and Service data are hosted in the EU. Some processors (for example Google and Stripe) may process data outside the EEA; where they do, transfers are covered by the European Commission’s Standard Contractual Clauses or an adequacy decision.

We keep account and alert data for as long as your account is active, and delete it after you close your account (bar anything we must retain by law).

• Sign-in sessions expire automatically and cannot be used after expiry.
• Contact messages are kept as long as needed to handle your enquiry and for a reasonable record afterwards.
• Republished results remain available as a public sporting record; if you are named, you can ask us to remove your name at any time (see "Results and competitor names").

Under the GDPR you can ask us to give you access to your data; correct it; erase it; restrict or object to processing; and receive it in a portable form. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

To exercise any right, contact us using the details under "How to reach us". We respond within one month. You also have the right to complain to a supervisory authority — in Latvia, the Data State Inspectorate (Datu valsts inspekcija).

Passwords are hashed with Argon2 and refresh tokens are stored only as hashes. Traffic is encrypted in transit (HTTPS), data is hosted in the EU, and access is limited to what is needed to run the Service. No system is perfectly secure, but we work to protect your data appropriately.

Racenda is not directed at children. If you are below the age of digital consent in your country, please use the Service only with the involvement of a parent or guardian. We do not knowingly collect data from children without an appropriate basis.

We may update this policy as the Service evolves. We will change the "last updated" date above and, for material changes, tell you in the app or by email where appropriate.