Race Collective Limited
Privacy Policy
Last updated: 17 May 2026 • Effective date: 17 May 2026

1 Introduction
Welcome to Race Collective. This Privacy Policy explains how Race Collective Limited (“we”, “us”, or “our”) collects, uses, stores, and shares information about you when you use our mobile application (the “App”) and any related services (collectively, the “Services”).
By creating an account or using the App you agree to the practices described in this policy. If you do not agree, please do not use our Services.

2 Who We Are
The data controller for the purposes of applicable data protection legislation (including the UK GDPR and the Data Protection Act 2018) is:
Race Collective Limited
Contact: hello@racecollective.com

3 Information We Collect
3.1 Account & Profile Data
– Email address (authentication and account recovery)
– Username (displayed publicly on leaderboards and club pages)
– Profile picture (optional; uploaded by you)
– Password (stored as a secure hash — we never see your plaintext password)

3.2 Activity & Performance Data
– Karting session times — lap times, best lap, session date
– Photographs of timing sheets submitted for OCR processing
– Track and venue selections linked to your sessions
– Gamification data — XP points, levels, and streaks derived from your activity

3.3 Location Data
– Approximate GPS coordinates, requested only at the moment of upload to auto-detect the nearest karting track and verify sessions are submitted from a recognised venue
– We do not continuously track your location or store a history of your whereabouts

3.4 Social & Community Data
– Friends / following relationships you create within the App
– Club memberships and club activity
– Notifications and social interactions within the platform

3.5 Technical Data
– Device type, operating system, and app version
– IP address and access logs (held by our infrastructure provider)
– Crash reports and diagnostic data to help us fix bugs

4 Legal Basis for Processing (UK GDPR)
– Contractual necessity — processing your account and session data to deliver the Services
– Consent — accessing your device camera and GPS; you may withdraw consent at any time via your device settings
– Legitimate interests — improving our Services, preventing fraud, and maintaining platform security
– Legal obligation — complying with applicable laws and regulations

5 How We Use Your Information
– Provide and operate the App, including leaderboards, lap-time tracking, and club features
– Process timesheet images using OCR to extract lap times
– Verify session authenticity using GPS proximity to known venues
– Display your results publicly on leaderboards (username and lap times)
– Send account-related emails (verification, password reset)
– Calculate and display gamification metrics (XP, levels, streaks)
– Improve the accuracy of our OCR and track-detection systems
– Detect and prevent fraudulent or manipulated submissions

6 Sharing Your Information
We do not sell your personal data. We may share data with:
– Supabase — our database and authentication provider (AWS EU region); processes data on our behalf under a Data Processing Agreement
– Google — timesheet images are submitted to Google for OCR; subject to Google’s API data processing terms
– Google Maps Platform — venue and map data; subject to Google’s privacy policy
– Apple App Store / Google Play Store — app distribution; subject to their respective policies
– Law enforcement or regulators — where required by law or to protect user safety

7 Publicly Visible Information
The following is displayed publicly within the App and visible to all users:
– Your username
– Your profile picture (if set)
– Your lap times and session records on track leaderboards
– Your club memberships
– Your XP level and ranking
Please choose a username that does not reveal information you wish to keep private.

8 Data Retention
– Account and profile data: retained for as long as your account is active
– Session and lap time data: retained indefinitely to maintain leaderboard integrity
– Timesheet images: retained for verification and dispute resolution; deletable on request
– Location data: used transiently at upload; the resolved venue is stored but raw coordinates are not retained beyond the session
– On account deletion: personal data anonymised or deleted within 30 days, except where legally required

9 Your Rights
Under UK data protection law you have the right to:
– Access — request a copy of the personal data we hold about you
– Rectification — ask us to correct inaccurate data
– Erasure — ask us to delete your data (“right to be forgotten”)
– Restriction — ask us to limit how we process your data
– Portability — receive your data in a structured, machine-readable format
– Object — object to processing based on legitimate interests
– Withdraw consent — for location or camera access, via device settings at any time
To exercise any of these rights, contact us at hello@racecollective.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

10 Security
– Encrypted data transmission (TLS / HTTPS)
– Secure hashed password storage via Supabase Auth
– Row-level security policies on our database
– Access controls limiting who can view or modify data
No method of internet transmission is 100% secure. If you suspect a security breach, contact us immediately.

11 Children’s Privacy
Our Services are not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us so we can delete it.

12 Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy in the App and updating the “Last updated” date above. Continued use of the Services after changes constitutes acceptance.

13 Contact Us
Race Collective Limited
Email: hello@racecollective.com