Privacy policy

This is a translation. The German version (Datenschutzerklärung) is legally binding.

This page explains which data StintOS processes, why, where it is stored and for how long. In short: telemetry and speech recognition stay on your PC. Only the data needed for your account, team, app, leaderboard and analysis goes to our server. There is no advertising, no tracking and no analytics.

1. Controller

Kevin Welsch, [Street and number], [Postcode, city], Germany
Email: datenschutz@stintos.com

2. This website (stintos.com)

The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you visit, the server processes technically necessary data: date and time, the address requested, data transferred, browser and operating system, and your IP address. IONOS anonymises IP addresses in its logs and deletes the logs after eight weeks at most. The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). A data processing agreement with IONOS is in place. [Conclude the DPA in the IONOS account, then remove this mark]

Fonts, images and scripts are served from our own web space. Nothing is loaded from Google or other third-party servers.

Stored in your browser: if you pick a language, the site remembers it in a cookie (stintos_lang, one year). Whether you are logged in is remembered in your browser's storage (stintosKonto) so the header shows “My account” instead of “Log in”. Both are needed for the function you asked for and are not sent to us (§ 25(2) TDDDG).

3. Our server (stintos.com, own server at Hetzner)

Account, team, app, leaderboard, analysis and updates run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, located in Nuremberg. A data processing agreement with Hetzner is in place. [Conclude the DPA in the Hetzner Console, then remove this mark] The server logs requests with the IP address; these logs are deleted after 14 days. To protect against overload, some services store the IP address for one minute at most or only as a checksum. Server backups are deleted after 14 days.

Account

When you sign up we store your first name, last name, email address, your password (only as a one-way hash), the plan you chose, and when you signed up and last logged in. For every logged-in device (PC, phone, browser) we store a session with the device name and when it was last used. On the “My account” page the server sets a cookie for this (stintos_sitzung, 30 days, only for konto.stintos.com). The legal basis is the contract of use (Art. 6(1)(b) GDPR).

Emails

To confirm your email address and for “Forgot password” we send you an email via the info@stintos.com mailbox at IONOS. The sending log (recipient and time) is deleted after 14 days.

Lap book, leaderboard and driver analysis

After each lap StintOS sends the lap to the server: name, car, class, track, lap time, sectors, session, conditions (temperatures, rubber, wetness, wind, time of day, whether the setup was fixed) and a recording of the lap with 20 samples per second (speed, throttle, brake, gear, steering, rpm, forces). This also includes your iRacing customer ID, iRating, licence and the name of your setup. Customer ID, iRating, licence and setup are never shown to anyone; we only need the customer ID to assign your laps to you. In the leaderboard others see your name, time, sectors and conditions, and they can race your lap as a ghost. The legal basis is the contract (Art. 6(1)(b) GDPR).

Driver values and tyre values

StintOS learns fuel use, lap times and tyre wear per driver, car and track and stores these values on the server so they are available on each of your PCs and in your team. Wear rates are also added to shared averages without a name, only with a random device ID.

Team, app and spectators

During a session, team members see the driver's situation: name, position, time left, fuel, tyres, lap times and strategy calls. Spectators you invite by QR code see the same. Team data is kept until the team is dissolved or you leave it. The app keeps your login in the phone's browser storage and stores its program files for use without a connection.

Team radio

When you join the team radio, your voice goes directly and encrypted (WebRTC) to the others in your team's radio room. Our server only brokers: who is in the room right now (name and device, which channel you talk in, which channels you listen to and whether you are in the car — for the role channels) and the technical connection offers, which are deleted after 60 seconds at most. If two devices cannot reach each other directly, our server relays the encrypted voice without being able to decrypt it; it sees the IP addresses but does not log them. Nothing is recorded. The microphone is only open while you are in the team radio and — depending on your setting — hold the button or speak. The legal basis is the contract (Art. 6(1)(b) GDPR).

Team chat

When you write in the team chat, we store the message with your name in the team, the time, the channel (all, pit wall or driver + spotter) and — if you are driving — track and date. Only members of your team who may see that channel by their role can read it. So that your messages disappear when you delete your account, we also store a checksum of your account (not your email address). Messages are kept until the team is dissolved; you can delete your own messages at any time, the team principal can delete all. If notifications are on in the app, new messages arrive as notifications — you can switch this off in the chat. The legal basis is the contract (Art. 6(1)(b) GDPR).

Emergency alert

If you trigger an emergency (by hand or automatically), your name, the reason, track, lap and position go to the team members you chose for it. The entry and who has seen it remain in the team messages (the last 20).

Push notifications

If you allow notifications in the app, we store the address your browser creates for them. Notifications are sent encrypted through your browser's push service (Apple, Google or Mozilla). The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time in the app or in your phone's settings.

Updates

At start, StintOS checks whether a new version exists. Only the version number and technically necessary connection data are transferred.

4. What stays on your PC

iRacing telemetry, speech recognition, voice output and your settings are processed on your PC and are not sent to us. A bug report goes to your clipboard; whether you paste it anywhere is up to you.

5. Discord

We link to our Discord server. Only when you open the link does Discord Inc.'s privacy policy apply.

6. Payment

For the subscription we use [Payment provider and address]. You enter your payment details there; we only learn whether and until when your subscription is paid.

7. How long we keep data

We keep your account, laps, driver values and sessions until you delete your account. You can do that yourself at any time under “My account”; this deletes your account, all sessions, “My StintOS” and your laps in the lap book. Your driver values are anonymised: name, customer ID and devices are removed, the plain measurements (such as consumption and tyre wear per car and track) remain without any link to you so StintOS can keep learning. Personal data disappears from backups within 14 days. Anonymous tyre averages remain as well because they have no link to you. Statutory retention duties for invoices are not affected.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. You can withdraw consent at any time with effect for the future. Write to datenschutz@stintos.com. You may also complain to a data protection authority, for example the one responsible for us: [Supervisory authority with address].

9. Security

All connections to our servers are encrypted (HTTPS). Passwords are stored only as hashes. Server access is possible only with a key.

10. Changes

If the way StintOS processes data changes, we update this policy. The version with the date above applies.