Privacy policy

Trackside (trackside.events) is a motorsport event tracker run by an individual developer in the UK. This page explains, in plain English, what personal data the service stores and why. Questions or requests: email support@trackside.events.

What we store

• Account details — your name, display name, email address, and avatar. If you sign in with Google or Apple, we store the identifier and profile basics those providers share; we never see your password for those accounts.
• Your activity on Trackside — meetings and events you mark as going or watching, series and tracks you favourite, tracks you've visited, reviews you write, friends you connect with, crews you join and the messages you post in them, saved searches, and issue reports you file.
• Photos you upload — the image itself, your caption, and what you tagged it to. Uploads are reviewed by a moderator before they appear publicly, so a moderator sees them even if they're never published.
• How you found us — when you create an account, we record where that visit came from: the campaign tags in the link you followed (for example utm_source=x), the website that linked to us (its domain only, not the page), and the first Trackside page you opened. It tells us which posts and sites bring people in. It is held with your session until you sign up, and forgotten if you don't. It is never shared.
• Location, only if you set one — used to show events near you. It is never collected automatically.
• Notifications — a record of what we've sent you (for example, "your meeting moved"), and your per-type notification preferences.
• Questions you ask the assistant — see The chat assistant below.

The chat assistant

The catalogue assistant sends the text of your question to a third-party AI provider, which generates the answer. Don't put anything personal or sensitive in a question — it leaves our servers. That provider is currently Google (Gemini), processing in the US; if we change provider we'll update this page. We keep a count of questions asked so we can apply daily limits; for signed-out visitors that count is keyed to a one-way salted hash of your IP address, not the address itself. Answers are generated and can be wrong — check anything that matters against the organiser.

Cookies

Essential cookies are always set: a session cookie (keeps you signed in), a security (CSRF) cookie, and an optional remember-me cookie. The site can't work without them. Two small preference cookies — your light/dark choice and whether the sidebar is collapsed — are also stored; they hold no personal data.

Analytics cookies are set only if you choose "Accept all" on the cookie banner, and only on the live site (trackside.events). We use Google Analytics 4, provided by Google LLC, to see which pages get visited so we can improve the service. It sets the cookies _ga and _ga_* (kept for up to 2 years). We collect page views and a small set of anonymous interaction events — for example a sign-up, a filter applied to the meetings list, or a meeting opened from it, and whether you were signed in — but never your name, email address or account. Advertising features and Google signals are turned off, and Google Analytics 4 does not log your IP address. Google may process this data on servers outside the UK, including in the US, under UK-recognised safeguards (the UK Extension to the EU–US Data Privacy Framework). If you decline, no analytics code loads at all — there is no cookieless fallback tracking.

Changed your mind? Change your cookie choice — this forgets your decision, removes any analytics cookies, and shows the banner again.

Other services we pass data to

• Google Maps — track and meeting pages embed Google's map, so loading one tells Google you requested that map.
• Ko-fi — if you donate, the payment happens entirely on Ko-fi's site; we never see your card details. Ko-fi tells us the donation amount and the name or message you chose to attach, which is how supporter badges work.
• Cloudflare and AWS — serve and host the site, and process the usual server logs on our behalf.

Calendar feeds are shared by link

If you subscribe a calendar app to Trackside, the feed URL contains a secret token, and anyone who has that URL can read that feed — including which meetings you're attending — without signing in. That's what makes it work in Google, Apple, and Outlook calendars, which fetch anonymously. Treat the URL like a password, and if you ever share it by accident you can reset it from your calendar settings, which instantly breaks the old one.

What other people can see

Reviews, published photos, and your display name and avatar are public. Your attendance, favourites, and friend list follow your privacy settings, which you control in Settings. Crew messages are visible to that crew's members.

Where your data lives

On servers in AWS's London region (eu-west-2). Email is sent through AWS SES. Nightly encrypted database backups are kept for 30 days. We don't sell or share your data with anyone, full stop.

Deleting your data

You can delete your account yourself: Settings → Security → Delete account. It is immediate and permanent, and it takes your personal details with it. Prefer us to do it, or want your account anonymised instead so your reviews survive without your name on them? Email support@trackside.events from your account address. You can also ask us for a copy of your data, or to correct it, at the same address.

Changes

If this policy changes materially we'll note it here and, for anything significant, email account holders.