Privacy policy

Effective [[EFFECTIVE_DATE]]

1. Who we are

Lapboard is run by [[OPERATOR_NAME]] (“we”, “us”). You can contact us at [[CONTACT_EMAIL]].

2. What we collect

• Account details. Your username and a password. We store only a salted, one-way hash of your password, never the password itself.
• Groups. The groups you create or join and whether you are an admin.
• Timer details. The licence number and unit ID of each timer you activate, when you activated it, and a running lap counter that stops old records being replayed.
• Lap data. For each lap you upload: the track, the car set on your timer, lap and sector times, the date and time recorded by the GPS, the timer’s software version, and the result of our checks, including the reasons a lap was not ranked.
• GPS log slices. For each lap, the raw GPS data covering the lap plus a few seconds either side: position, speed, heading, accuracy and time, about ten times a second. This is location information. It can show where a track is and how you drove it. Only upload laps you are happy for us to hold. Your browser cuts out just this slice, so the rest of your SD card never leaves your computer.
• Sign-in cookie. A single cookie that keeps you signed in (see section 5).
• Server logs. Our servers and our network provider log requests, which can include IP addresses and the pages requested. These logs are rotated automatically and are short-lived.

The timer itself never connects to our servers. We only receive what you choose to upload.

3. Why we use it

• To run your account and your groups.
• To check your laps against the GPS data and rank them.
• To show results to the members of your groups.
• To keep the service secure, investigate suspected tampering and fix faults.

We don’t sell your information and we don’t use it for advertising.

4. Who can see it

• Members of your groups see your username, the car set on your timer, your best verified lap on each track, your sector times and the date. They do not see your GPS data.
• Group admins can invite people to their group.
• We can see everything described in section 2, because we run the service.
• Service providers who help us run it, listed in section 6.
• Others, where the law requires it. We may disclose information if required by law or a court order, or to protect people’s safety or our rights.

5. Cookies and tracking

We use one strictly necessary cookie, which keeps you signed in. It is marked secure and HTTP-only, is only sent to this site, and expires after 30 days or when you sign out. We don’t use advertising or analytics cookies or trackers.

6. Where it is stored and who helps us run it

• Lapboard runs on a server operated by us in [[HOSTING_LOCATION]].
• Web traffic passes through Cloudflare, which provides our secure connection and protection against attacks. Cloudflare processes requests, including IP addresses, as our service provider and under its own privacy policy.
• Backups are kept [[BACKUP_LOCATION]] and are deleted after about 14 days.

Because of how internet traffic is routed, information may pass through servers in other countries.

7. How long we keep it

• Account and lap results: until you ask us to delete them or we close the service.
• GPS log slices: [[RETENTION_MONTHS]] months after upload, then deleted. The lap time stays, but we can no longer re-check the lap.
• Server logs: a short rolling window, then overwritten.
• Backups: about 14 days, so deleted data fully leaves our systems within that time after deletion.

8. Your choices

Email [[CONTACT_EMAIL]] to:

• get a copy of the information we hold about you;
• correct it;
• have your account, laps and GPS slices deleted. We aim to do this within [[DELETION_DAYS]] days. If you created a group that others belong to, we hand it to another member instead of deleting it.

We may need to confirm it is really you before acting on a request.

9. Security

Traffic is encrypted in transit. Passwords are hashed. Timer secrets are encrypted at rest. Access to the server is restricted, and the part that checks uploaded GPS files is isolated from the internet. No system is perfectly secure, so please use a strong, unique password. If we learn of a breach that is likely to cause you serious harm, we will tell you.

10. Children

Lapboard is for people aged 18 and over, and we don’t knowingly collect information from anyone younger. If you think a child has joined, contact us and we will delete the account.

11. Changes

We may update this policy. We will post the new version here with a new effective date, and tell members if the changes are significant.

12. Contact

Questions or complaints: [[CONTACT_EMAIL]].