Privacy Policy

Last updated: 15 September 2026 · Covers gridcard.site and the GRIDCARD app (iOS / Android)

Controller

Daniel Hofmann is the data controller in the sense of GDPR Art. 4(7) for all processing described here.

What is processed, and why

• Anonymous account. When you open the GRIDCARD app for the first time, Supabase Auth generates a random UUID. No email, phone number, or social identity is collected. Legal basis: Art. 6(1)(b) GDPR (performance of contract).
• Driver-card profile data. The handle, display name, country, race number, team tag, preferred sims and disciplines, and hardware setup that you enter in the app. Legal basis: Art. 6(1)(b) GDPR.
• Public driver card at gridcard.site/c/<handle>. Every card gets a public page, and sharing is on by default after installation. The page shows the handle, display name, race number, country, optional team tag and Discord name, preferred sims and disciplines, the gear list if enabled, the stats of a linked platform, an active PRO marker and, where applicable, a leaderboard placement. It also shows the time zone and experience level if set, a profile picture if set, and the account's invite code; the address of the preview image contains the account UUID, which is therefore visible in the page source. A card is retrievable only one handle at a time, and since 15 September 2026 the preview images cannot be listed either — each stays reachable at its own address so that link previews keep working. About the display name: if no display name is set when Le Mans Ultimate is linked, GRIDCARD adopts the driver name held in the sim, which may be a real name. It can be changed or cleared at any time under Edit profile → Identity → Display name. It does not show the Steam ID, the real name held at the linked platform, the platform account id, a sim-platform subscription, nationality or rating history — those are stripped server-side and never leave the database. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a shareable driver card as a core function). The balance rests on the page being built on a freely chosen pseudonym, excluded from search-engine indexing, and switchable off permanently; where the driver name adopted from the sim is kept as the display name, the page can carry a real name, and both the switch and the display-name field remain available at any time. Right to object (Art. 21 GDPR): the "Public ID" switch under Edit profile → Visibility turns it off at once, with no reason needed; the page then returns "not found" within minutes and the preview image is deleted server-side.
• Subscription (GRIDCARD Pro). Apple (iOS) or Google (Android) processes the payment for the monthly or yearly tier. The purchase receipt and entitlement state are received through RevenueCat. Card numbers and bank details are not received. Legal basis: Art. 6(1)(b) GDPR.
• Optional platform linking (LFM, LMU). If you link an external racing platform in the app, GRIDCARD fetches publicly available stats for the username you provide. Legal basis: Art. 6(1)(a) GDPR (consent). Unlink any time in the Settings screen.
• Steam confirmation of a Low Fuel Motorsport link. A Low Fuel Motorsport link can be confirmed through Steam. The app opens the Steam sign-in page at steamcommunity.com; the sign-in happens at Steam, and GRIDCARD receives no credentials and no password — only the signed response containing the numeric Steam ID (SteamID64). Purpose: matching that Steam ID against the account held at Low Fuel Motorsport proves the linked account belongs to the person requesting it. Without that proof, another driver's profile and statistics could be claimed as one's own. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in authentic account links, and in protecting the drivers concerned from impersonation). Storage: the Steam ID is stored against the account for as long as the link exists, and is removed when the link is undone and when the account is deleted. It is not shown on the public driver card. Where it comes from: the Steam ID reaches GRIDCARD either in the signed sign-in response from Steam or from the driver profile at Low Fuel Motorsport, where it is retrievable without signing in through the public profile interface (checked on 15 September 2026). GRIDCARD does not widen that reach: the identifier is used only for the match described above and is never published. Recipient: Valve Corporation, USA, as the operator of Steam and as an independent controller — opening the sign-in page sends the IP address, the browser identifier and any Steam cookies to Valve, under Valve's own privacy terms. Confirming through Steam is voluntary; without it the link stays unconfirmed.
• Push notifications. If you allow notifications at the operating-system prompt, Firebase Cloud Messaging issues a registration token for that device. The token is stored against your anonymous account together with the device platform (iOS or Android), the preferred language and the device's time-zone offset, up to ten devices per account. The time-zone offset is used for one purpose: holding a scheduled notification back until the local clock reads daytime. Notifications are sent when the Windows companion records a Le Mans Ultimate race, when a race-count milestone is reached, after seven days without a recorded race, once a week with your leaderboard standing, and shortly before the start of a race armed in the schedule. The message text can name the track, car class, finishing position, and the Driver Rating and Safety Rating change for the race it announces; a race start alert names the race series, its track and how long is left before the start. Legal basis: Art. 6(1)(a) GDPR (consent). Withdraw at any time by revoking the notification permission in the operating-system settings, or per topic under Settings → Notifications in the app. Four occasions can be switched off individually there: the weekly leaderboard standing, the reminder after seven days without a race, the race-count milestones and the race-start alert. The message about a recorded Le Mans Ultimate race has no switch of its own; it ends when the notification permission is revoked in the operating system. The weekly standing message stops when leaderboard appearance is switched off under Settings → Appear on the leaderboard.
• Feedback form (in-app). Your message, optional 1 to 5 star rating, and, while the diagnostics switch in the sheet is on, technical diagnostics: app version and build number, operating-system version, platform, language, handle, whether PRO is active, and up to the last 20 errors the app caught in the current session, each with its message and stack trace. Tokens, credentials and email addresses are removed from that error text before it is shown or sent. The sheet lists everything that would be attached before submitting, and the switch turns the diagnostics off. Captured errors stay in the memory of the device, are cleared when the app restarts, and reach the server only through a feedback submission made with the switch on. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in product improvement). Rate-limited to 5 submissions per account per hour.
• Server logs. IP address, timestamp, URL, user agent, kept briefly by the hosting provider (Netlify) for operations and abuse prevention. Legal basis: Art. 6(1)(f) GDPR.
• Code abuse limits. Three actions are rate-limited: redeeming a companion pairing code, a recovery code and a referral code. Only the pairing-code redemption happens without signing in; the other two require a signed-in (anonymous) account. The address measured at the network edge (the /64 prefix for IPv6) is converted to an HMAC-SHA256 digest under a secret key. Since 14 September 2026 only that digest is stored, never the address; before then the address was held in plaintext. The digest cannot be reversed without the key and is only ever compared for equality. Legal basis: Art. 6(1)(f) GDPR. Deleted after 48 hours (pairing) or one day (recovery, referral). These rows carry no account reference, so they outlive an account deletion until those windows expire.

What is NOT processed

No analytics, no tracking pixels, no advertising SDKs, no crash reporting, no location or GPS data, no access to camera, photos, contacts, or health data, no cookies on the website. The stream overlay stores a single value in the browser (gc.overlay.pos) holding the chosen screen corner; it carries no identifier, never leaves the device, and is required for the function explicitly requested (§ 25(2) no. 2 TDDDG). A cookie banner is therefore not required. Push notifications are sent, but only the messages described above, and never for advertising or marketing.

Service providers (processors under GDPR Art. 28)

• Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. Hosts the website and edge-proxies the public card pages. Transfers covered by the EU-U.S. Data Privacy Framework and SCCs.
• Supabase, Inc., 3500 S Dupont Hwy, Dover, DE 19901, USA. Database, authentication, and Edge Functions for the app and the public card backend. Transfers covered by Standard Contractual Clauses; DPA at supabase.com/terms/dpa.
• RevenueCat, Inc., 150 Spear Street, Suite 1750, San Francisco, CA 94105, USA. Processes the in-app purchase receipts and entitlement state.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Firebase Cloud Messaging). Issues the device registration tokens and delivers the push notifications, including their title and body text. On iOS the message is passed to Apple's Push Notification service for delivery to the device. Transfers covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
• Apple, Inc. (iOS) / Google LLC (Android). The payment itself is handled by the App Store / Play Store under their own privacy policies.
• Low Fuel Motorsport, Motorsport Games / Studio 397 (Le Mans Ultimate), only if you explicitly link your account in the app.
• Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Delivers two internal notifications to the operator: an app feedback submission (message, star rating, the diagnostics block if enabled, handle and country) and a leaderboard report (reported handle, reason, reported and reporting account ids). Nothing else reaches Resend. Transfers covered by Standard Contractual Clauses.

Retention

• Active accounts: as long as you keep using the app.
• Inactive anonymous accounts: deleted automatically after 30 days of inactivity by the cleanup_stale_anonymous_users() database routine.
• Server logs: short-term, not longer than needed for abuse prevention.
• Push registration tokens: kept while the device stays registered. Deleted when Firebase reports the token as no longer valid, when the app signs out, and when the account is deleted. Switching individual notification types off in the app stops the sends but does not by itself delete the token; revoking the notification permission in the operating system stops delivery.
• Push send records, kept only so a retry cannot deliver the same notification twice: removed by a scheduled cleanup routine.
• Subscription events received from RevenueCat: the account identifier and the event type, removed by a scheduled routine after 90 days. Payment itself is handled by Apple or Google, who keep the receipts under their own terms and statutory retention periods; GRIDCARD receives no card or bank details and keeps no accounting record of its own.

Drivers without a GRIDCARD account (Art. 14 GDPR)

This section is for people who do not use GRIDCARD but whose data is processed briefly.

What, and from where. When a GRIDCARD user opens a Low Fuel Motorsport race result or championship table, GRIDCARD fetches that page from the Low Fuel Motorsport interface and caches the response. The response holds the whole classification or table, so it also covers other participants: a displayed name in the form "F. Lastname", country, position, lap times, penalties and points, and the identifier of the account held at Low Fuel Motorsport. That source is Low Fuel Motorsport, where the same details are publicly readable without signing in.

A second source is Le Mans Ultimate. When the Windows companion records a race, it reads the game's result file. That file holds the in-sim names of the other participants in the same race, together with their positions, lap times and classes, and in endurance races the names of the drivers who shared a car. These details are readable only by the account that recorded the race, are never published, and are deleted after 30 days (90 days with PRO).

Recipient. Supabase, as the backend processor, stores this cached data. It is not passed to any other recipient.

Purpose and legal basis. Legitimate interest, Art. 6(1)(f) GDPR. The cache exists only to show a race classification without hitting the Low Fuel Motorsport interface on every view. There is no analysis, no combination with other sources, no profiling and no onward disclosure.

Retention. Race results are deleted after seven days. Championship tables are deleted at the end of the season. No permanent record accumulates.

Why this is published rather than sent. Notifying each person individually would only be possible through Low Fuel Motorsport, and would be out of proportion to processing that ends after seven days and covers publicly available details (Art. 14(5)(b) GDPR). The information is therefore made public here. Anyone affected can object at any time (Art. 21 GDPR) at support@gridcard.site and ask for the relevant cache entry to be deleted.

Your rights under the GDPR

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), withdrawal of consent (Art. 7(3)).
• Right to lodge a complaint with your local data-protection authority.

To exercise any of these rights, email support@gridcard.site. Because the account is anonymous, the account UUID helps identify the right record, as do the handle and details only the account holder can know. A handle alone is not accepted as proof of identity — it appears on the public card and on the leaderboard, so anyone can read it. Under Art. 12(6) GDPR further information may be requested where there is reasonable doubt about identity. A request is not refused merely because a particular identifier cannot be produced; where identity still cannot be established after that, Art. 11(2) GDPR applies.

For erasure (Art. 17) you don't need to email at all. The app provides a one-tap path under Settings → Delete all data. Your account and every record tied to it are removed from the server within seconds.

Full text and German authoritative version

For the complete processing disclosures including all GDPR Art. 13 information elements, see the authoritative Datenschutzerklärung (German).