Privacy Policy

racem8 (racem8.com) is operated by, and personal data under GDPR (Regulation 2016/679) is controlled by:

• Company: Roads To Excellence s.r.o.
• Company ID: 04430972
• Registered address: Nedvědovo náměstí 1164/14, Podolí, 14700 Praha 4, Česká republika
• Contact: support@racem8.com
• Registration: Commercial Register maintained by the Municipal Court in Prague, section C, file 247456.

We process only data that is necessary to provide the service and to comply with legal obligations.

2.1 Account and profile

Email, name (optional), hashed password, role (racer, coach, parent, manager, engineer), language, time zone, registration date and IP address. For Google sign-in we also process your Google ID and profile data (name, email, avatar) within the scope you authorise via OAuth.

2.2 Telemetry and training data

GPS traces from your data logger (Alfano, MyChron, RaceBox), GoPro or phone, lap times, kart setup data, notes, photos, video. This data is the core of the service — racem8 makes no sense without it. The GPS track of a session is your precise location over time — where you were on the track, metre by metre, while recording. What: the GPS from your GoPro, logger or phone inside the sessions you import or send. Why: only for lap analysis (lines, braking points, comparing laps) and the features you turn on yourself (sharing a lap with your coach or a link). It isn't used for advertising, sold or used to track you anywhere else. How long: as long as your account exists (section 5), and in backups for at most 120 days after that. Deletion: delete a session and its GPS track goes with it; delete your account and all of them go. With a session you can optionally add rider details (age, weight, start number) and conditions (tyres, pressures, weather). Age and weight are visible only to you and your coach — never on a shared or public link; for a rider who is a minor they are managed by the parent or coach who uploaded the session. The written analysis of a session is drafted by an AI model (Anthropic, see section 4) from your first name, your kart, the track and the session's lap and corner numbers (in a comparison with other riders, also their first names) — never from your age, e-mail or GPS track. A photo of the paper session sheet that you or your team's mechanic send (by e-mail, from the app or through the QR code on the sheet) is kept with the team, and an AI model (Anthropic, see section 4) reads the session's details from it; nothing reaches a session until the team's coach confirms it.

2.3 Payments

For paid tiers we process order data, billing address, transaction ID and payment status. Card data (PAN, CVC, expiry) never reaches us — it is processed directly by the payment provider (Revolut Bank UAB, Apple, Google).

2.4 Coach and team communication

Messages, comments and annotations within coach/team workflows. This data is only visible to members of the relevant team space.

2.5 Technical and operational logs

IP address, user-agent, login time, application errors. Used for security, abuse prevention and diagnostics. Crash reports from the web and the apps go to Sentry (EU) without your account, e-mail or name.

From your IP address we work out only the country, to show prices in the right currency (Czechia → CZK, otherwise EUR). This happens on our own server from a local database; the IP address is not sent anywhere and the country is not stored. Database: IP Geolocation by DB-IP (CC BY 4.0).

2.6 The racem8 apps (iPhone, Android)

The apps work with data on your phone: sessions you import from your GoPro, lap timer or files, and the GPS and motion data inside them. Analysis runs on the phone; a session reaches our servers only when you send it. To find your GoPro the app uses Bluetooth and joins the camera's own Wi-Fi network (iPhone asks for location permission only because iOS requires it for that). Separately, the sessions themselves contain your precise location over time: the GPS track recorded by your GoPro or logger (see 2.2). We don't track you across apps. On Android the app asks for Bluetooth (scan and connect), nearby Wi-Fi devices and location for the same reason. The racem8 tab shows your account on racem8.com inside the app; what you enter there is processed as described above. The apps send crash reports (Sentry, see section 4) without your account, e-mail or name, and app updates are delivered by Expo (see section 4). Signing in uses your racem8 account, Google or Apple; with "Hide My Email" we receive Apple's relay address and write to you only through it.

2.7 Maps

Satellite map images come straight from Google's servers to your browser, so Google sees your IP address and which area of the map you are looking at; we send Google nothing else. Google handles this as a separate controller under its own privacy policy.

2.8 Usage of the service

While you are signed in, we keep a record of how you use racem8: when you sign in, when you upload a session, and which sessions, Lab, lap videos, team pitwall or (as a coach) rider's data you open — with the time, and the device and app version it came from (web, iPhone, Android or desktop). Why: to make racem8 better (what helps, where people get stuck) and to help you when something goes wrong — if you write to support, we can see what happened. We keep this on our own server, in our own database: no third-party analytics, no cookies for it, and we never sell or share it. We don't use it for marketing e-mails. The detailed record is kept for 12 months; after that only anonymous totals remain (how many sessions were opened on a day, say), nothing that points to you. You can object to this at any time (section 6): write to support@racem8.com — we stop recording your usage and delete what has been recorded.

Each processing purpose has its own legal basis under Article 6 GDPR:

• Performance of contract (Art. 6(1)(b)): account, telemetry, coach communication, payments — we cannot provide the service without this data.
• Legitimate interest (Art. 6(1)(f)): technical logs for security and abuse prevention, and the record of how the service is used (section 2.8), to improve it and to help you when something goes wrong. You can object to this processing at any time.
• Consent (Art. 6(1)(a)): marketing e-mails — tips from your sessions and the occasional offer, only if you turned them on. You can withdraw consent at any time with the unsubscribe link in any e-mail or in Plan & billing.
• Compliance with legal obligation (Art. 6(1)(c)): accounting and tax regulations (10-year invoice retention).

We never sell your data. We share it only with the following processors, who are contractually bound to protect it:

Transfers to processors in the USA are covered by the EU Standard Contractual Clauses (Art. 46 GDPR).

Apple and Google (Sign in with Apple or Google, Apple Pay and Google Pay, the app stores, Google's satellite map imagery) are not our processors: the data you give them there they process as separate controllers under their own privacy policies. You manage it in your Apple or Google account.

• Account and profile: for the lifetime of the account + 30 days after deletion (technical recovery window).
• Telemetry: for the lifetime of the account. We will delete earlier on request.
• Payment records and invoices: 10 years (accounting and tax regulations).
• Technical logs: at most 90 days.
• Usage of the service (section 2.8): the detailed record 12 months, then only anonymous totals.
• Backups: kept for at most 120 days; deleted data disappears from them no later than that.

Under GDPR you have the following rights regarding your personal data:

• Right of access (Art. 15) — to know what data we hold.
• Right to rectification (Art. 16) — to correct inaccurate data.
• Right to erasure (Art. 17) — to be forgotten. If you signed in with Apple, deleting your account also revokes racem8's access to your Apple ID.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — to receive your data as a ZIP of CSV and JSON files.
• Right to object (Art. 21) — to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — at any time, without affecting prior lawful processing.

To exercise your rights, email support@racem8.com. You may also lodge a complaint with the supervisory authority — ÚOOÚ.

The site uses only cookies it needs to work (sign-in) and the preferences you set yourself (language, light/dark). No analytics or advertising cookies and no third-party trackers — so there is nothing to consent to. Our own record of how the service is used (section 2.8) uses no cookies and needs no consent. Full list in the Cookie Policy.

Traffic between you and racem8 is encrypted with TLS 1.2+. Passwords are stored as bcrypt hashes. Databases run in Hetzner's EU data centre (Finland) with at-rest encryption; encrypted backups are kept with AWS in Frankfurt (EU). Access to production systems is restricted and logged.

In Files you can share chosen files with people who have no racem8 account: you create a link protected by a 6-digit PIN, and you can revoke it at any time — it stops working immediately.

• Whoever has the link and the PIN sees only the files you chose for that link — nothing else from your account.
• For each link we record how many times it was opened and when it was last opened. We don't create accounts for the people who open it; for security we limit wrong PIN attempts per IP address.
• A link can also let someone send you files (a mechanic or a photographer, say). What they send is stored in your account as private — nobody else sees it until you share it.
• For a rider who is a minor, the linked parent or guardian account can manage and share the files on the rider's behalf.
• A lap video you share by link can be watched by anyone who has the link; delete the session and the video goes with it.

On material changes we will notify you by email at least 30 days in advance. The current version is always on this page; the effective date is shown at the top.