Privacy Policy

1. Controller

Alexander Jaeger
Wolfenbütteler Str. 17
30519 Hannover, Germany
E-mail: fausto89@web.de

2. Overview

This website processes personal data in these areas: sign-in and account management (Discord sign-in), your public profile, lap-time submissions and their verification (screenshots as private originals, published best times as the result), your garage, the Hub (crews, events, sign-ups), reports and moderation, and the technical delivery of the site (hosting, server logs).

3. Sign-in with Discord (OAuth)

We use Discord as an external sign-in service (OAuth 2.0). We request the Discord permissions identify, email and guilds.join; Discord shows them to you before you sign in. Discord sends us your Discord user ID, username, avatar and the e-mail address linked to your Discord account. The e-mail address is stored in your account with our sign-in and database provider and is never shown publicly. With guilds.join, you are added to our Discord server once, right after you sign in; you can leave the server at any time. We never see or store your Discord password.

Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for). Discord Inc. is responsible for the processing on Discord's side; see discord.com/privacy.

4. Your profile

Your display name is shown publicly on leaderboards, in crew rosters and in event sign-up lists. You can change it at any time in My Account › Settings. We keep a history of previous display names so moderators can trace abuse (e.g. someone switching names after a violation); only you and the moderators can see it. It is deleted when you delete your account.

Legal basis: Art. 6(1)(b) GDPR; for the name history Art. 6(1)(f) GDPR (our legitimate interest in a fair community free of abuse).

5. Lap submissions, screenshots and verification

When you submit a lap time, we process the time, the vehicle and other submission details; the screenshot you upload as proof (private, never public); the review and verification status and any moderator notes. If you add a video link, it can be shown publicly next to your time on the leaderboard.

Purpose: proving and checking that a lap time is genuine, preventing cheating and abuse. Legal basis: Art. 6(1)(b) GDPR (providing the service) and Art. 6(1)(f) GDPR (our legitimate interest in a fair leaderboard that can't be manipulated).

Retention: screenshots are reduced in size when uploaded and deleted 60 days after submission. The exception is the screenshot of the current best time of a vehicle on a track: it stays while that time is the best time and is deleted 60 days after it has been beaten. Proof for submissions still under review or that have been reported is kept until the review or report is closed. When you delete your account, all your screenshots are deleted immediately; the lap time itself stays. Only authorised moderators can see the private originals, and only to review them.

6. Your garage

You can mark vehicles you own in the game. This list is private: only you can see it. It is deleted when you delete your account. Legal basis: Art. 6(1)(b) GDPR.

7. The Hub: crews and events

Crews: If you request to join a crew, the crew leader and the moderators see your request. Once you are a member, your display name is shown publicly in the crew roster. If you apply for a role (crew leader or event host), the moderators see your application including your message and links.

Events: If you host an event, its details are shown publicly, including the host PSN name and Discord link you enter, and the host crew. If you sign up for an event, your display name can be shown publicly in the event's sign-up list. Sign-ups for sample events are only stored in your own browser (see section 11), not on our servers.

Legal basis: Art. 6(1)(b) GDPR. Retention: until you leave the crew, cancel the sign-up, delete the event or delete your account.

8. Reports and moderation

If you report a lap time or other content, we store your report (what you reported, the reason, your explanation) together with your account. Only moderators see who sent a report; the person or crew you reported is not told by us. You see the status and outcome of your own reports. We keep reports as long as we need them to document moderation decisions; reports you sent are deleted when you delete your account.

If you report by e-mail, we process your name, e-mail address and message to handle the report and tell you the outcome.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 of the EU Digital Services Act where it applies, and Art. 6(1)(f) GDPR (our legitimate interest in a safe, lawful community).

9. Hosting and technical delivery

The website is hosted on GitHub Pages (provider: GitHub, Inc., 88 Colin P Kelly Jr St, San Francisco, CA 94107, USA). When you open the site, GitHub automatically processes technical access data (server logs, including IP address, time of access and the file requested). GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is therefore based on the European Commission's adequacy decision (Art. 45 GDPR).

Our domains are registered with Cloudflare, Inc. (USA). Visits to our second domain gellhornracing.com are forwarded to this site by Cloudflare; for this, Cloudflare processes the technical request data (including IP address). Cloudflare is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Visits to leonidaracing.com itself do not pass through Cloudflare.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in delivering the website securely and reliably).

10. Database and sign-in provider (Supabase)

User accounts, profile data, submissions, private proof, Hub content and reports are stored and managed with Supabase (Supabase Inc., USA) in an EU data region. We have a data processing agreement with Supabase under Art. 28 GDPR (Supabase Data Processing Addendum, part of Supabase's terms). Where data is transferred to the USA, the EU Standard Contractual Clauses included in it apply (Art. 46(2)(c) GDPR).

Legal basis: Art. 6(1)(b) GDPR in conjunction with Art. 28 GDPR (processing on our behalf).

11. Browser storage, cookies and tracking

When you sign in, your login session is stored in your browser's local storage so you stay signed in. Sign-ups for sample events are stored there too. Both are technically necessary for the functions you use and need no consent under Section 25(2) TDDDG. You can remove them at any time by signing out or clearing your browser data.

We currently use no analytics or tracking services. If we ever add an analytics or statistics service, we will add it here beforehand, with its legal basis and a consent banner.

12. Minimum age

Accounts are for people aged 16 and over (see the Terms of Use). If we learn that an account belongs to someone younger, we delete it.

13. Your rights

You have the right to access the data we store about you (Art. 15 GDPR), to have incorrect data corrected (Art. 16 GDPR), to have your data deleted (Art. 17 GDPR), to restrict processing (Art. 18 GDPR), to data portability (Art. 20 GDPR), to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR), and to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Please send requests to the contact e-mail above.

Deleting your account: You can delete your account yourself at any time under My Account › Settings › Delete my account. This deletes your display name, your Discord link and login, your garage, crew membership and roles, events you created, event sign-ups, reports you sent, your screenshots and video links; submissions not yet reviewed are deleted too. Lap times that have already been reviewed stay on the leaderboard without a name, as "Deleted driver", and can no longer be linked to any person. Deletion is permanent: signing in with Discord again creates a new, empty account.

If you only remove our website from the authorized apps in your Discord settings, your account with us is not deleted; your data stays as it is until you sign in again and delete your account, or send us a deletion request.

14. Changes to this policy

We update this privacy policy when the way we process data changes. The version published at the time of your visit applies. This version: 27 September 2026.