Privacy Policy

1. Who We Are

Clean Grid Racing ("we", "us", "our") operates the website at cleangridracing.com. We provide an online platform for organising and participating in community-hosted online sim racing sessions.

2. What Data We Collect

We collect and process the following personal data:

2.1 Account Information

• Email address — for login, password resets, and account communications
• Display name — shown publicly on race results and driver profiles
• Password — stored as a bcrypt hash; we never store or see your plain-text password

2.2 Gaming Profile

• Racing ID — to identify you in race lobbies
• Discord username — optional, for community communication
• Experience tier — self-reported sim racing experience level
• Equipment — controller or wheel type (optional)

2.3 Racing Data

• Race results — finishing positions, penalties, fastest laps
• Driver ratings — pace, safety, and reliability scores calculated from race performance
• Stewards Room cases — incident reports and outcomes
• Host feedback — ratings given to or received from race hosts

2.4 Payment Information

Clean Grid Racing is currently free and does not collect or process any payment information. When paid membership tiers are reintroduced, payment processing will be handled by Stripe. We will store your Stripe customer ID for subscription management but will not store credit card numbers, bank details, or other payment credentials on our servers. See Stripe's Privacy Policy.

2.5 Technical Data

• Session cookies — essential for login functionality
• Server logs — IP addresses and request data for security and debugging (retained for 30 days)

2.6 Feedback Form

When you submit feedback through our feedback form, we store the following in a private internal tracker (Planka, self-hosted) so the team can act on your message:

• Name or handle — you choose what to call yourself; signed-in users have their display name prefilled
• Email (optional) — only if you want a reply
• Category — bug, copy, feature, hosting feedback, or other
• Your message — the free-form text you write
• Page URL (optional) — the page you were on, to help us reproduce bugs
• Attachments (optional) — up to 5 images / short videos / PDFs / text files (5 MB each, 25 MB total). Stored on the same internal tracker as the card.
• Account details — for signed-in submitters, the email and role on your account are attached to the card

Your IP address is not stored on the feedback card. It is written only to short-term server logs (30 days) for abuse prevention — see Server logs above.

3. Why We Process Your Data (Legal Basis)

Purpose	Legal Basis
Providing your account and login	Contract performance
Processing subscription payments (when paid tiers return)	Contract performance
Recording race results and ratings	Legitimate interest (platform integrity)
Stewarding and incident resolution	Legitimate interest (fair play)
Server logs and security	Legitimate interest (security)
Marketing communications	Consent (opt-in only)
Feedback form submissions	Consent (ticked on each submit)
Feedback-form abuse prevention (IP in logs)	Legitimate interest (platform integrity)

4. How We Share Your Data

We share your data only as follows:

• Other members — your display name, Racing ID, race results, and driver ratings are visible to other platform members
• Stripe — payment processing (email address and subscription details); only when paid tiers are active, which is not currently the case
• Cloudflare — CDN and DDoS protection (IP addresses processed transiently)

We do not sell your data to third parties. We do not use your data for advertising.

5. Data Retention

Data Type	Retention Period
Account information	Until you delete your account
Race results	Indefinite (anonymised if account deleted)
Driver ratings	Until account deletion
Stewards Room cases	Indefinite (anonymised if account deleted)
Server logs	30 days
Password reset tokens	1 hour (auto-expire)
Feedback form submissions (internal tracker)	12 months, then archived or deleted unless actively referenced

6. Your Rights (GDPR)

Under UK GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data via your profile settings
• Erasure — request account deletion (race results are anonymised, not deleted, to preserve historical records)
• Data portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent

To exercise any of these rights, contact us at the address below.

7. Cookies

We use only essential cookies required for login session management. We do not use tracking cookies, analytics cookies, or advertising cookies.

8. Security

We protect your data with:

• HTTPS encryption on all pages
• Bcrypt password hashing
• CSRF protection on all forms
• Cloudflare DDoS protection

9. Children

Clean Grid Racing is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via the website. Continued use of the service after changes constitutes acceptance.

11. Contact

For privacy enquiries or to exercise your rights:

Email: [email protected]

12. Analytics

We use Umami, a privacy-friendly, cookieless analytics tool self-hosted on our own infrastructure at analytics.aj-hosted.uk. Umami does not set cookies, does not track users across sites, and no data is shared with third parties.