Privacy

What we collect

When you upload an iRacing .ibt session file, we receive:

• The .ibt file you upload
• Your email address (entered at the verification step)
• Standard server logs: IP address, browser user-agent, request timestamps
• Payment metadata if you purchase a Yellow or Purple pack (handled by Stripe)

What we store

We do not retain your raw .ibt file. After the engine processes a session, the raw file is deleted and we keep only:

• Consolidated lap statistics - aggregate metrics like best lap time, sector splits, and zone-level performance scores. No tick-by-tick channel data.
• Generated reports - the Quick Debrief PNG and PDF (where applicable), stored on Cloudflare R2 with short-lived signed-link access.
• Your email and credit balance - to deliver reports and track free / paid sessions remaining.

What we never do

• We do not sell your data - to anyone, ever.
• We do not share your data with third parties for marketing or advertising.
• We do not display your name or email on any report card.
• We do not run third-party advertising on PitDelta.
• We do not use your telemetry to train AI models.
• We do not retain raw .ibt files after processing.

How we use your email

Your email is used for three things only: sending you a one-time verification code, delivering generated reports, and showing your free / paid credit balance. We do not send marketing emails, newsletters, or promotional content.

Spotter (free tier) and product examples

Spotter is free. To show prospective drivers what PitDelta produces, we may occasionally use a Spotter user's Quick Debrief card as an anonymous product example in marketing materials (landing page, social media, Discord communities).

Before any card is used in marketing, we remove:

• Track name and car name
• Exact session date
• Specific lap numbers

Your name and email are never displayed on a debrief card under any tier — there is nothing to remove because they are never there in the first place. The marketing-eligible content is the structural insight (zones, mechanisms, engineer voice), not session-identifying metadata.

Yellow Pack and Purple Pack reports are always private and are never used in marketing. If privacy matters to you, the paid tiers give you a clear opt-out.

Service providers we use

PitDelta runs on the following infrastructure. Each provider processes data only as needed to deliver the service:

• Vercel - frontend hosting
• Railway - backend hosting and PostgreSQL database
• Cloudflare R2 - short-lived report storage with signed-URL access
• Stripe - payment processing for Yellow and Purple packs
• Resend - transactional email delivery (verification codes, report delivery)
• Anthropic API - generation of engineer-quip text snippets. Only de-identified zone metrics are sent; no email, name, or identifying session metadata.

Data retention

• Raw .ibt files: deleted from our storage on successful job completion. Files from failed or abandoned uploads are deleted within 48 hours by an automated lifecycle rule.
• Generated report files (PNG / PDF): retained for 30 days from completion to allow re-download, then automatically purged.
• Consolidated lap statistics: kept for the lifetime of your account.
• Email and credit balance: kept for the lifetime of your account, deleted on request.
• Server logs: 30 days, then rotated.
• Payment records: retained for the period required by tax law.

Lawful basis for processing (GDPR Art. 6)

• Contract performance - processing telemetry to generate the report you requested.
• Legitimate interest - server logs for security and abuse prevention; using anonymized Spotter cards as product examples.
• Consent - you can withdraw consent for marketing use at any time by upgrading to Yellow or Purple, or by emailing us to delete your account.
• Legal obligation - payment records retained for the period required by tax law.

Your rights under GDPR

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar data-protection law, you have the right to:

• Access the data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (right to erasure)
• Request a copy of your data in portable form
• Object to specific processing or withdraw consent at any time
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email privacy@pitdelta.co. We will respond within 30 days.

Contact

For privacy questions, data requests, or anything else covered by this policy, email privacy@pitdelta.co.