Pit Helper ("Pit Helper", "we", "us", "our") is a web application that helps endurance-karting teams manage pit stops and race strategy. This Privacy Policy explains what personal data we collect, why, how we protect it, and the rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and equivalent rules.
1. Who is responsible for your data
The data controller for Pit Helper is:
If you have any question about this policy or your personal data, contact us at the email above and we will respond without undue delay.
2. When this policy applies
This policy applies to the Pit Helper website (pit-helper.com), the web application at /app, and the free demo. It does not apply to third-party services we link to or connect with — for example live-timing providers (such as Apex Timing) — which operate under their own privacy policies.
3. What data we collect
Data you give us
- Account data — if you create an account: your email address and a password. Passwords are hashed by our authentication provider and are never stored or visible to us in plain text.
- Licence & purchase data — your licence key, licence status and validity dates, and the payment reference or note you send when you buy a licence (for example a Revolut or bank transfer reference). We do not collect or store your card numbers — payments are made directly through your bank or payment app.
- Race & team data you enter — the race, track and team settings you configure, pit-lane state, saved timing-feed presets, and any team or manager notes. This is operational data you choose to enter to use the app.
- Regulation text (AI feature) — if you use the optional "read the regulations" feature, the text you paste is sent to our AI provider to extract race settings. Do not paste personal data you do not want processed this way.
- Support messages — anything you send us by email or Telegram.
Data we collect automatically
- Technical data — IP address, approximate region, browser/device type, and timestamps (for example last activity), used to run the service, keep devices in sync, secure accounts and prevent abuse.
- No third-party analytics or advertising — we do not use Google Analytics, advertising networks, or cross-site tracking tools. We keep only minimal server logs (see above) to run and secure the service.
- Local storage — we store settings and preferences (theme, language, layout, demo counters, referral code) in your browser's local storage. This stays on your device and is used only to make the app work.
4. Why we use your data, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|
| Provide the app, your account, licences and device sync | Performance of a contract |
| Process your purchase and keep records of it | Contract; legal obligation (accounting/tax) |
| Keep the service secure, prevent abuse, enforce licence limits | Legitimate interests |
| Extract settings from regulation text you submit (AI feature) | Contract (feature you request) |
| Respond to your support requests | Legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights and use the minimum data needed. You can object to this processing — see section 8.
5. Cookies and local storage
Pit Helper does not use advertising or tracking cookies, and has no third-party analytics. We use:
- Functional local storage — to remember your settings, keep you signed in and run the app. This is essential to the service and does not require consent.
Because we do not set tracking cookies, there is no cookie-consent banner. If we ever introduce cookie-based tracking or analytics, we will ask for your consent first.
6. Who we share data with
We do not sell your personal data. We share it only with service providers ("processors") who help us run Pit Helper, under contracts that require them to protect it and use it only on our instructions:
| Provider | What they do | Data involved |
|---|
| Supabase | Database & authentication | Account, licence, race and preset data |
| Railway | Application hosting | Requests, IP, server logs |
| Anthropic | AI regulation parsing (optional feature) | The regulation text you submit |
| Revolut / your bank | Receiving payment for a licence | Payment reference you provide |
We may also disclose data if required by law, to protect our rights, or as part of a business transfer (for example a sale of the service), in which case we will tell you.
When you connect the app to a live-timing feed (such as Apex Timing), your browser communicates with that third party directly under their terms and privacy policy. We are not affiliated with those providers.
7. International transfers
Some of our providers are located outside your country, including outside the European Economic Area (for example in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, so that your data keeps a comparable level of protection.
8. How long we keep data
- Account & licence data — for as long as your account or licence is active, and for a reasonable period afterwards to handle disputes and meet legal obligations.
- Purchase records — for the period required by accounting and tax law.
- Server logs & technical data — for a short period, then deleted or anonymised.
- Race & team data you enter — until you delete it or ask us to.
- Regulation text (AI) — processed to return your result; not retained by us as a long-term record.
9. Your rights
Under the GDPR (and similar laws) you have the right to:
- Access the personal data we hold about you;
- Rectify data that is wrong or incomplete;
- Erase your data ("right to be forgotten");
- Restrict or object to certain processing;
- Portability — receive your data in a machine-readable format;
- Withdraw consent at any time, where we relied on consent.
To exercise any of these, email [email protected]. We will respond within the time limits the law sets (normally one month). You also have the right to lodge a complaint with your local data-protection authority — in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, your national supervisory authority.
10. How we protect your data
We use technical and organisational measures to keep your data safe, including: encryption in transit (HTTPS/HSTS), hashed passwords, access controls and one-time tokens for live connections, licence and device checks, rate limiting, input validation and security headers. No system is perfectly secure, but we work to protect your data and to limit what any single failure could expose.
11. Children
Pit Helper is intended for use by racing teams and adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy as the service evolves or the law changes. We will update the "Last updated" date above and, for significant changes, take reasonable steps to notify you. Continuing to use Pit Helper after an update means you accept the revised policy.