Privacy Policy

Last updated: 24 April 2026 · Covers gridcard.site and the GRIDCARD app (iOS / Android)

Controller

Daniel Hofmann is the data controller in the sense of GDPR Art. 4(7) for all processing described here.

What is processed, and why

• Anonymous account. When you open the GRIDCARD app for the first time, Supabase Auth generates a random UUID. No email, phone number, or social identity is collected. Legal basis: Art. 6(1)(b) GDPR (performance of contract).
• Driver-card profile data. The handle, display name, bio, country, race number, team tag, preferred sims and disciplines, and hardware setup that you enter in the app. Legal basis: Art. 6(1)(b) GDPR.
• Public driver card at gridcard.site/c/<handle>. If you enable public sharing in the app, the profile data listed above is served as a public HTML page viewable by anyone with the URL. Legal basis: Art. 6(1)(a) GDPR (consent). Withdraw at any time by disabling public sharing in the app; the page goes offline within minutes.
• Subscription (GRIDCARD Pro). Apple (iOS) or Google (Android) processes the payment for the monthly or yearly tier. The purchase receipt and entitlement state are received through RevenueCat. Card numbers and bank details are not received. Legal basis: Art. 6(1)(b) GDPR.
• Optional platform linking (LFM, LMU). If you link an external racing platform in the app, GRIDCARD fetches publicly available stats for the username you provide. Legal basis: Art. 6(1)(a) GDPR (consent). Unlink any time in the Settings screen.
• Push notifications. If you allow notifications at the operating-system prompt, Firebase Cloud Messaging issues a registration token for that device. The token is stored against your anonymous account together with the device platform (iOS or Android) and your preferred language, up to ten devices per account. Notifications are sent when the Windows companion records a Le Mans Ultimate race, when a race-count milestone is reached, after seven days without a recorded race, once a week with your leaderboard standing, and shortly before the start of a race armed in the schedule. The message text can name the track, car class, finishing position, and the Driver Rating and Safety Rating change for the race it announces; a race start alert names the race series, its track and how long is left before the start. Legal basis: Art. 6(1)(a) GDPR (consent). Withdraw at any time by revoking the notification permission in the operating-system settings, or per topic under Settings → Notifications in the app. The weekly standing message stops when leaderboard appearance is switched off under Settings → Appear on the leaderboard.
• Feedback form (in-app). Your message, optional 1 to 5 star rating, and technical diagnostics (app version, build number). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in product improvement). Rate-limited to 5 submissions per account per hour.
• Server logs. IP address, timestamp, URL, user agent, kept briefly by the hosting provider (Netlify) for operations and abuse prevention. Legal basis: Art. 6(1)(f) GDPR.

What is NOT processed

No analytics, no tracking pixels, no advertising SDKs, no crash reporting, no location or GPS data, no access to camera, photos, contacts, or health data, no cookies on the website. A cookie banner is therefore not required. Push notifications are sent, but only the messages described above, and never for advertising or marketing.

Service providers (processors under GDPR Art. 28)

• Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. Hosts the website and edge-proxies the public card pages. Transfers covered by the EU-U.S. Data Privacy Framework and SCCs.
• Supabase, Inc., 3500 S Dupont Hwy, Dover, DE 19901, USA. Database, authentication, and Edge Functions for the app and the public card backend. Transfers covered by Standard Contractual Clauses; DPA at supabase.com/terms/dpa.
• RevenueCat, Inc., 150 Spear Street, Suite 1750, San Francisco, CA 94105, USA. Processes the in-app purchase receipts and entitlement state.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Firebase Cloud Messaging). Issues the device registration tokens and delivers the push notifications, including their title and body text. On iOS the message is passed to Apple's Push Notification service for delivery to the device. Transfers covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
• Apple, Inc. (iOS) / Google LLC (Android). The payment itself is handled by the App Store / Play Store under their own privacy policies.
• Low Fuel Motorsport, Motorsport Games / Studio 397 (Le Mans Ultimate), only if you explicitly link your account in the app.

Retention

• Active accounts: as long as you keep using the app.
• Inactive anonymous accounts: deleted automatically after 30 days of inactivity by the cleanup_stale_anonymous_users() database routine.
• Server logs: short-term, not longer than needed for abuse prevention.
• Push registration tokens: kept while the device stays registered. Deleted when notifications are turned off, when Firebase reports the token as no longer valid, and when the account is deleted.
• Push send records, kept only so a retry cannot deliver the same notification twice: removed by a scheduled cleanup routine.
• Purchase records: kept for the statutory period under German tax law (§ 147 AO, up to 10 years).

Your rights under the GDPR

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), withdrawal of consent (Art. 7(3)).
• Right to lodge a complaint with your local data-protection authority.

To exercise any of these rights, email support@gridcard.site. Because the account is anonymous, please include your handle or the account UUID visible in the app's Settings → Debug screen so the correct record can be identified.

For erasure (Art. 17) you don't need to email at all. The app provides a one-tap path under Settings → Delete all data. Your account and every record tied to it are removed from the server within seconds.

Full text and German authoritative version

For the complete processing disclosures including all GDPR Art. 13 information elements, see the authoritative Datenschutzerklärung (German).