Privacy Policy

Who we are

PitSheet is a hobby project for the RC racing community, operated from Norway. Questions or requests about your data: andremelst@gmail.com.

What we store

• Account: email address, username, display name, and a securely hashed password (bcrypt — we never store or see your actual password).
• Your garage content: cars, setup sheets, drive logs, batteries, service records, parts, wishlists, and the photos you upload.
• Optional: your MyLaps transponder number, if you add it to enable Speedhive result imports.
• Preferences: currency, driver labels, and similar settings.

We do not run analytics or advertising trackers. The only cookie is the session cookie that keeps you signed in.

Your photos

• Photos are stored on our server (not in a third-party cloud) and are only accessible to you — every image request is authenticated and ownership-checked.
• Uploads are recompressed on the server, which removes hidden metadata such as GPS location from your camera photos.

Where your data lives & who processes it

Your data is hosted on servers operated by netcup GmbH in Nuremberg, Germany (EU), under a GDPR Art. 28 data-processing agreement. We use two further processors: Resend for sending password-reset emails (operating under a data-processing agreement and the EU–US Data Privacy Framework), and Sentryfor error monitoring — configured with EU data residency (Frankfurt) and without personal identifiers; it receives technical error details so we can fix crashes. Speedhive imports query MyLaps' public results API; your personal data is not sent to them. We do not sell or share your data with anyone else.

Backups & retention

We keep your data for as long as you have an account. Encrypted backups are taken nightly and retained for 30 days — so deleted data disappears from backups within 30 days as well.

Sharing

Nothing you create is public unless you explicitly share it. A shared setup link shows the setup, the car's name, and your display name — you can revoke the link at any time.

Your rights

• Export: download everything as JSON from your profile at any time.
• Deletion: delete your account and all content yourself from your profile ("Delete account"). It takes effect immediately.
• Access & correction: everything is visible and editable in the app; anything else, email us.
• You can also complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe we handle your data incorrectly.

Children

Accounts are for ages 13 and up. Family driving is supported without child accounts — parents tag cars and sessions with driver labels under their own account.

Changes

If this policy changes materially, we'll note it here with a new date.