Legal

Privacy Policy

Last updated 2026-10-14

Placeholder. This document is a structural scaffold. Replace the content below with legally-reviewed copy before launch.

1. Who we are

RaceDash is operated by [Company Name], registered at [Company Address], United Kingdom. If you have questions about this policy or how your data is handled, contact us at privacy@racedash.io.

2. What data we collect

We collect only what we need to run the service:

Account data — your email address, and your password (hashed) if you choose to set one.
Sign-in data — the IP address and browser of each sign-in, stored with that session.
Device data — the name and platform of each computer you use RaceDash on, and a one-way hash of its hardware ID. We never store the ID itself.
Waitlist data — the email address you give us when you join the waitlist.
Subscription data — your Stripe customer ID and subscription status, so we know which features you're entitled to.
Usage data — anonymous, aggregated events about which features you use, so we can decide what to build next.
Support data — any messages or attachments you send us via support.
Feedback — what you write when you send feedback from the desktop app, your account email, and your app version and platform. If you tick "Attach diagnostic log", we also get the app's log from your last two sessions. Before it leaves your computer, the app removes credentials, email addresses and your computer's user name from it. The log can still contain file names and names of drivers from your timing data, so untick the box if you don't want to send it.

3. What we don't collect

Your video footage. RaceDash renders locally on your machine — your footage never leaves your device.
Your telemetry data. Logger exports stay on your machine and are never uploaded.
Tracking cookies across the web. We don't set third-party trackers and we don't sell data to advertisers.

4. How we use your data

To operate and maintain the RaceDash service.
To send you emails about your account — license grants and expiry reminders, device changes, and replies to feedback you send. These are part of the service and are always sent.
To announce new versions of RaceDash. You can turn these off on your account page, or with the link at the foot of any of them.
To send news about RaceDash features and products, only if you opt in when you create your account or on your account page. We record when and where you gave consent, and you can withdraw it at any time.
Every release and news email has an unsubscribe link that works without signing in, and supports your email app's own one-click unsubscribe.
We keep a copy of each email we send you for 12 months for support and debugging. After that we delete its contents and keep only a record that it was sent. Sign-in codes and reset links are never stored.
If you join the waitlist, to email you about early access and the launch, and for nothing else. To leave the waitlist, email us at privacy@racedash.io.
To keep bots off the waitlist form. We check each sign-up with Vercel BotID, and we count sign-ups from each IP address for 5 minutes. We keep a one-way hash of the IP address for that count, not the address itself.
To respond to support requests.
To understand, in aggregate, how RaceDash is used.

5. How long we keep your data

We delete data when we no longer need it. A job runs every day and removes everything past these periods:

Sign-in sessions, with their IP address and browser: 30 days after the session ends.
Sign-in codes and email links: 1 day after they expire.
Sign-in tokens of the desktop app and other connected apps: 7 days after they expire.
Invitations you didn't accept: 90 days after they expire.
Devices you removed: 12 months after you removed them. A device you still use stays while your account is open.
Emails we send you: we delete the contents after 12 months, and the record that we sent the email after 24 months. The record of a sign-in email goes after 90 days.
Data export requests, with the IP address and browser that asked for and downloaded them: 12 months.
Our admin log: a record of what our team did, such as changing a license or viewing an account. We keep each entry for 24 months.
Your account, licenses and settings: while your account is open. When you delete it, see section 8.

6. Third-party services

We use a small number of third parties to run the service, and we only share data with them when required to deliver it:

Stripe — subscription billing
Vercel — marketing site hosting
Resend — email delivery, and the list of waitlist email addresses
GitHub — we store feedback you send from the desktop app, with your account email and any diagnostic log you attach, as an issue in a private GitHub repository that only the RaceDash team can read
Cloudflare Turnstile — bot protection on sign-in and sign-up forms
Remotion — the video renderer in the desktop app. Each export tells Remotion that a render ran and whether it succeeded, under Remotion's free license. It sends no footage, project data or account details.
Better Auth Infrastructure — sign-in security events: your email address, name, IP address and approximate location

If you choose to sign in with Google, Apple or Microsoft, that provider confirms your identity to us and shares your name and email address, and Google or Microsoft may also share your profile picture. We don't receive your password for those accounts. Their own privacy policies apply to that sign-in.

Each of these processors has their own privacy policy, which we keep links to in [/support/data-processors].

7. Your rights

If you're in the UK or the EU, you have the right to:

Access the data we hold about you
Correct inaccurate data
Delete your account and the data associated with it. You can do this yourself on your account page, or by emailing us.
Object to certain types of processing
Request a portable copy of your data

To get a copy of your data, sign in at racedash.io/account and choose Email me my data, or use Email me my data… in the Account section of the RaceDash app. We'll email you a link to download a JSON file of the personal data held in your RaceDash account and by the services that process it for us. The link works once and expires after 24 hours.

For any other request, email us at privacy@racedash.io.

8. When you delete your account

When you delete your account, these happen straight away, or within a few days if a provider is unavailable:

Your sign-in methods, sessions and devices are removed.
Your name and email address are replaced in our records.
The copies of emails we sent you are cleared.
Your subscription ends.
You are removed from our mailing lists.
Feedback issues you filed are deleted.
Emails you sent to our support and privacy addresses are removed from our inbox.
We ask Better Auth to erase your sign-in events.

We keep a record that your license existed, without your name or email address. If you bought a subscription, that record keeps your billing country and, if you gave it, your waiver of the 14-day right to cancel, because tax and consumer law require us to be able to show them.

We keep a record of each data export you asked for, so we can show we answered it. The record no longer holds your IP address, your browser or the download link, and we delete it 12 months after the request.

Some copies are held by our providers or in our backups and take longer to clear:

| Copy | When it goes | | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | Email delivery logs at Resend | after 30 days | | Stripe payment records (charges and events) | we ask Stripe to redact them 90 days or more after you delete your account | | Stripe invoices | kept by Stripe for as long as tax law requires | | Better Auth Infrastructure events | we ask Better Auth to delete them within 30 days of our request | | Emails you sent to our support and privacy addresses | deleted within 30 days | | Your Stripe customer record | usually deleted straight away; if we need to review a recent payment first, once that review is done | | A record of your deletion request, including your email address | until every step above is done; then the email address is removed | | Copies of our database in short-lived test environments | when that test environment is deleted | | Our database backups | when the backup window passes | | A desktop that is offline when you delete | stops working within 14 days |

We keep our copy of the deletion request we send to Better Auth, and their reply, as proof that we asked.

Track data you contributed stays in RaceDash, without your name or email address.

9. Children

RaceDash is not for children under 13, and we don't knowingly collect their data. If you're 13 to 17, you need a parent or guardian's permission to use RaceDash. If you think a child under 13 has created an account, email us at privacy@racedash.io and we'll delete the account and its data.

10. Changes to this policy

We'll update this page when our practices change and notify account holders by email for any material changes.