Privacy Policy

1. Information we collect

Account info: email address, display name, and password (stored as a salted hash — we never see it in plain text).

Content you enter: tracks, setups, drivers, karts, motors, clutches, sprockets, tires, parts, notes, and any telemetry CSV files you import.

Billing info: handled entirely by Stripe. We receive your subscription status and plan, never your full card number.

Usage info: basic technical data (IP address, browser) used for rate-limiting abuse, keeping you signed in, and cookieless aggregate analytics (page views) — no ad tracking or cross-site tracking.

Crash reports: if the app crashes, technical diagnostic data (browser, page, and error details) is sent automatically to our error-monitoring provider. If you choose to describe what happened in the crash dialog, your name and email are included only if you type them in — both fields are optional.

2. How we use it

• To operate your account and store the data you log
• To process payments and manage your subscription
• To generate AI hints and answers, which sends the relevant portion of your logged setup data to our AI provider (see below) at the moment you ask for it
• To prevent abuse (rate limiting on login, signup, and AI requests)

3. Who we share it with

We use a small number of service providers, each only for what they need to do their job:

• Supabase — hosts our database, authentication, and file storage (telemetry CSV uploads).
• Stripe — processes payments and manages subscriptions.
• OpenAI — processes your setup data only when you actively use the AI assistant or ask for an AI hint, to generate a response.
• Sentry — receives crash and error diagnostic data so we can fix bugs, and any name/email you choose to add when submitting a crash report.
• Resend — delivers the message when you use the contact form, including the name, email, and message you submit.
• Vercel— hosts the app and provides cookieless, aggregate page-view analytics that don't identify you individually.

We don't sell your data or share it with anyone else.

4. Cookies

We use cookies only for authentication (keeping you signed in) and remembering your light/dark theme preference. No third-party advertising or tracking cookies.

5. Data retention

We keep your data for as long as your account is active. If you'd like your account and data deleted, email us (below) and we'll delete it, typically within 30 days.

6. Your rights

You can request a copy of your data or ask us to delete it at any time by emailing us — self-service export/delete isn't built into the app yet.

7. Security

We use industry-standard practices (encrypted connections, hashed passwords, row-level database access control) to protect your data, but no online service can guarantee absolute security.

8. Children's privacy

The Service isn't directed at children under 16, and we don't knowingly collect their data.

9. Changes to this policy

We may update this policy occasionally. We'll update the effective date above when we do.

10. Contact

Questions, data requests, or deletion requests: email dialedinpitnotes@gmail.com.