Privacy

What we collect

When you upload an iRacing .ibt session file, we receive:

• The .ibt file you upload
• If you use Benchmark Debrief: a second .ibt from another driver that you upload. We read that driver's in-sim name from the file and reduce it to two letters for the report, unless you type a label yourself — see below
• If you join or run a Crew Room: one .ibt per driver, uploaded by each of them through the invite link
• Your email address (entered at the verification step)
• If you are a Crew Room guest and ask to be sent the card: an email address for that one message. No account is created
• Standard server logs: IP address, browser user-agent, request timestamps
• Payment metadata if you purchase a Purple Pack or a Blue subscription (handled by Stripe)

What we store

We do not keep your raw .ibt file once it has done its job. A solo or benchmark file is deleted as soon as your report is built. A Crew Room file is kept for 30 days, because that is what lets members compare against each other, and is then deleted automatically. Exact periods are under Data retention below. What we keep afterwards is:

• Consolidated lap statistics - aggregate metrics like best lap time, sector splits, and zone-level performance scores. No tick-by-tick channel data.
• Generated reports - the Quick Debrief PNG and PDF (where applicable), stored on Cloudflare R2 with short-lived signed-link access.
• Comparison driver identifiers - for a benchmark or room comparison we keep the driver's label (two letters read from their file, or the label you typed) and a salted, irreversible hash of their iRacing account ID. We keep no name, no account ID and no email for them.
• Your email and credit balance - to deliver reports and track free / paid sessions remaining.
• Cross-session coaching aggregates (Coaching Memory) - corner-level habit summaries derived from your consolidated lap statistics across sessions, so your reports can show what is improving over time. Never tick-by-tick data. These are built for every account on every plan, including the free tier, and are kept so your history survives a lapsed subscription. They are deleted with your account on request.

What we never do

• We do not sell your data - to anyone, ever.
• We do not share your data with third parties for marketing or advertising.
• We do not display your name or email on any report card.
• We do not run third-party advertising on PitDelta.
• We do not use your telemetry to train AI models.
• We do not keep raw .ibt files as a permanent archive - every one is on a deletion timer, listed under Data retention below.

How we use your email

Your email is used for three things only: sending you a one-time verification code, delivering generated reports, and showing your free / paid credit balance. We do not send marketing emails, newsletters, or promotional content.

Benchmark Debrief uploads

Benchmark Debrief compares your session against a second .ibt file from another driver, which you upload. By uploading it you confirm the other driver has shared that file with you and is fine with it being used for a comparison.

Benchmark files receive the same treatment as your own: the raw file is deleted after processing, and we keep only the comparison statistics needed for your report.

How the other driver is identified. By default we read their in-sim name out of the file and reduce it to two letters - “Andrew Miller” becomes “AM” - before anything is stored or drawn. The full name is never saved and never printed. If you type a label instead, yours is used verbatim, because you chose the string and you are the one publishing it - so do not type anything you would not want on a card you share.

What we keep about them. That label, and a salted, irreversible hash of their iRacing account ID. We keep the hash so we can tell one pairing from the same pairing repeated fifty times, and so a session benchmarked against its own account can be spotted. Reversing it needs both our server secret and the original account ID, which only iRacing holds. We have no name, no email and no account ID for them, and no way to contact them.

They have the same rights you do. If you were someone else's benchmark and you want your data gone, email privacy@pitdelta.co - see Your rights under GDPR below for what we need from you.

Crew Rooms

A Crew Room compares several drivers from the same track and car in one debrief. The room is created by a Blue subscriber, who shares an invite link; each other driver uses it to upload one session. One card comes back covering the whole room.

If you join a room as a guest. The invite link lets you upload one file, and — once the room has been run — shows you the crew card for that room. It does not create an account, and it shows you nothing else of the owner's: not their other rooms, not past sessions, not their email. Invite links expire, and the owner can revoke one at any time.

What the room owner sees about you. A two-letter label read from your file, your lap times, and how your corners compare to the rest of the room. Not your name, not your email, not your account ID. If two drivers reduce to the same two letters, neither keeps them - both are shown as “driver 2”, “driver 3” instead.

What the report says about you. Every driver comes away with a finding of their own — quickest through a corner, most repeatable, closest to the pace. There is no ranking of drivers and no “slowest” label. Where you lose time, the card names the corner and what was different about it.

Your file, and how long it stays. Unlike a solo or benchmark upload, a room session is kept for 30 days. That is what lets any member run a full Benchmark Debrief against a crew mate's session without either of you uploading again — so by dropping a file into a room you are allowing it to be used both for the shared card and for a detailed comparison against you individually, by the other drivers in that room, for that period. After it, the file is deleted automatically. We keep the same salted account hash described above, for the same reason.

Removing a session. The room owner can remove any file at any time, and a guest can ask them to; email privacy@pitdelta.co if you would rather not go through them. Removal deletes the telemetry itself — every lap, every trace.

Removal is not retroactive. Reports already produced keep the figures they were built from. Once a crew card or a debrief has been generated, emailed or shared, it cannot be recalled, and deleting the file it came from does not unmake it.

What is left afterwards. The room keeps a record that you took part: your two-letter label and the salted hash. No telemetry, no name, no email. That record is what keeps past sessions coherent for the rest of the room.

If you ask for the card by email. A guest can leave an email address to be sent the crew card once the room has been run. It is used for that one message: no account, no mailing list, no other mail. It is deleted when the room owner removes your session, or automatically when the session expires after 30 days — whichever comes first. The room owner never sees it.

If you asked to hear when rooms open, we store your email for that one purpose. Email privacy@pitdelta.co to be taken off it.

Spotter (free tier) and product examples

Spotter is free. To show prospective drivers what PitDelta produces, we may occasionally use a Spotter user's Quick Debrief card as an anonymous product example in marketing materials (landing page, social media, Discord communities).

Before any card is used in marketing, we remove:

• Track name and car name
• Exact session date
• Specific lap numbers

Your name and email are never displayed on a debrief card under any tier — there is nothing to remove because they are never there in the first place. The marketing-eligible content is the structural insight (zones, mechanisms, engineer voice), not session-identifying metadata.

All paid-tier reports are always private and are never used in marketing - this covers Purple, Blue, and any earlier packs you may still hold. If privacy matters to you, the paid tiers give you a clear opt-out.

Service providers we use

PitDelta runs on the following infrastructure. Each provider processes data only as needed to deliver the service:

• Vercel - frontend hosting
• Railway - backend hosting and PostgreSQL database
• Cloudflare R2 - short-lived report storage with signed-URL access
• Stripe - payment processing for session packs and the Blue subscription
• Resend - transactional email delivery (verification codes, report delivery)
• Anthropic API - generation of engineer-quip text snippets. We send the track and car, the session type and date, your lap times, corner names and the zone metrics behind them - and, for a benchmark or room comparison, the other driver's label, because the text refers to them by it. We never send your email, your name, any iRacing account ID, or raw telemetry.

Data retention

• Raw .ibt files - yours and any benchmark file you upload: deleted from our storage on successful job completion. Files from failed or abandoned uploads are deleted within 48 hours by an automated lifecycle rule.
• Raw .ibt files uploaded to a Crew Room: kept for 30 days, then deleted automatically. They are kept so members can compare against each other without uploading again; the room owner can remove any of them sooner.
• Generated report files (PNG / PDF): retained for 30 days from completion on the paid tiers, then automatically purged. Spotter cards are kept for 90 days, because the free tier is where product examples come from — see Spotter (free tier) and product examples above.
• Consolidated lap statistics and cross-session coaching aggregates: kept for the lifetime of your account.
• Comparison driver labels and hashes (benchmark and room drivers): kept with the session record they belong to, and removed on request from the driver concerned.
• A Crew Room guest's notification email: deleted with the session it belongs to — when the owner removes it, or automatically when the session expires.
• Room invite links: expire automatically, and can be revoked earlier by the room owner.
• Email and credit balance: kept for the lifetime of your account, deleted on request.
• Server logs: 30 days, then rotated.
• Payment records: retained for the period required by tax law.

Lawful basis for processing (GDPR Art. 6)

• Contract performance - processing telemetry to generate the report you requested.
• Legitimate interest - server logs for security and abuse prevention; using anonymized Spotter cards as product examples; processing a benchmark or room driver's session so the comparison you asked for can be produced, on the basis that you have their permission to upload it and that we reduce their identity to a short label and a salted hash before storing anything.
• Consent - you can withdraw consent for marketing use at any time by upgrading to any paid tier, or by emailing us to delete your account.
• Legal obligation - payment records retained for the period required by tax law.

Your rights under GDPR

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar data-protection law, you have the right to:

• Access the data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (right to erasure)
• Request a copy of your data in portable form
• Object to specific processing or withdraw consent at any time
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email privacy@pitdelta.co. We will respond within 30 days.

If you were someone else's benchmark or room member. You have the same rights and you do not need a PitDelta account to use them. Email us with your iRacing customer ID - the numeric one on your iRacing account page. We cannot look it up for you, because we never stored it; we need it to derive the hash that identifies your records.

What we can and cannot confirm. We will delete every record our hash reaches, and tell you how many. Some early records carry no driver hash at all, and no query can find them - that is the cost of not storing the identifier in the first place. We would rather say so than claim a completeness we cannot demonstrate.

Who controls your data

The data controller is UAB Global InnoLine, company code 302770839, Žilvino g. 20, 08401 Vilnius, Lithuania. For data requests email privacy@pitdelta.co.

Contact

For privacy questions, data requests, or anything else covered by this policy, email privacy@pitdelta.co.