Draft, under legal review
Privacy
Short version: this website sets no cookies for visitors and uses no analytics. The app reads iRacing telemetry on your PC and never uploads it.
Who is responsible
OnePromise GmbH, Güterstrasse 213, 4053 Basel, Switzerland, [email protected]. See the imprint.
Which law applies
We are based in Switzerland and process personal data under the Swiss Federal Act on Data Protection (FADP, in force in its revised form since 1 September 2023). If you use this website or buy from the EU or EEA, we also follow the EU General Data Protection Regulation (GDPR) where it applies to us (Art. 3(2) GDPR).
EU representative (Art. 27 GDPR): we have not appointed one, because we process personal data of people in the EU only occasionally and not on a large scale (Art. 27(2)(a) GDPR).
This website
Hosting and server logs
The site is hosted on Cloudflare Pages. To deliver and secure the site, Cloudflare's servers process your IP address and the data your browser sends with each request (page, time, browser type) in server logs. We do not use these logs for anything else. For visitors in the EU or EEA the legal basis is our legitimate interest in delivering and securing the website (Art. 6(1)(f) GDPR). Cloudflare processes these logs for us as a processor under its Data Processing Addendum. We do not keep or analyse them; Cloudflare deletes them under its own retention rules.
Cookies, analytics, tracking
For visitors: no cookies, no analytics, no tracking, no third-party embeds. Fonts and scripts are served from this site.
The one exception is the private admin area (/admin/): there, Cloudflare Access sets a sign-in cookie. It concerns only the site owner.
Local storage
If you use the light/dark switch, your browser stores that one choice (key to-theme) in its local storage. It never leaves your browser.
Referral code
Your browser keeps a code in its session storage for this tab: the code from a referral link you open (?code=...), or a code you apply at checkout. It also keeps there whether you closed the code bar at the top of the page. The code is stored so it can be applied at checkout. It is not a cookie. The code is sent to our server only to check it, and to the payment provider when you pay. Both are gone when you close the tab.
If you write to [email protected], we process your email address and your message to answer you.
Purchases
Checkout, payment, invoices, taxes and refunds are handled by Polar as merchant of record. When you click "Continue to secure payment", our server asks Polar to open a checkout for your plan (and your referral code, if you have one) and sends you to Polar's payment page. Your name, email address and card details are entered there, not on this website, and we do not store them. Orders and referral codes are processed in Polar. The provider collects the data it needs for that and is responsible for that processing: Polar's privacy policy. When the site owner opens the private admin overview, our server reads the order records from Polar (they include the buyer's email address, plan and payment status) only to count trials, payments and the use of referral codes. It stores none of this and shows no personal details.
The Trofeo Overlays app
Telemetry
The app reads iRacing telemetry locally on your PC. It is never uploaded.
Files on your PC
Your settings, the track shapes the app has learned and its log files are stored on your PC, in the folder %APPDATA%\TrofeoOverlays.
Track outlines from OpenStreetMap
For a track the app has not seen, it can download the track outline from OpenStreetMap data, once per track. The request goes to the public Overpass API at overpass-api.de. It contains the location of the track and identifies the app by name and version. That server necessarily sees your IP address. The answer is cached on your PC. You can switch this off in the Track map settings (OpenStreetMap downloads). Track data © OpenStreetMap contributors, ODbL.
Disclosure abroad
Some of our providers process data outside Switzerland, in particular in the USA (Cloudflare and the payment provider). Where the country has no adequate level of data protection, we rely on safeguards such as the Swiss-US Data Privacy Framework or standard contractual clauses. Cloudflare, Inc. is certified under the Swiss-US Data Privacy Framework. Polar Software, Inc. (Delaware, USA) relies on standard contractual clauses.
Your rights
You can ask us for access to your data, correction, deletion, restriction of processing, and a copy in a common format, and you can object to processing. Write to [email protected]. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you are in the EU or EEA, to your local data protection authority.
Changes
If the site or the app changes what it does with data, this page changes first.