Privacy Policy

Version 1.0 — effective 24 August 2026

RaceLink is a league management platform for iRacing sim racing leagues. This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.

RaceLink is operated by RaceLink Operations Pty Ltd (ACN 701 664 075, ABN 41 701 664 075) from New South Wales, Australia, trading as RaceLink.io. In this policy, “we”, “us” and “RaceLink” mean RaceLink Operations Pty Ltd, and “you” means anyone who uses racelink.io or holds a RaceLink account.

RaceLink is an independent product. It is not affiliated with, endorsed by, or sponsored by iRacing.com Motorsport Simulations, LLC.

1. Contact

For anything about privacy — questions, access requests, deletion requests, complaints:

Email: dev@racelink.io

We respond to privacy requests within 30 days.

2. What this policy covers

This policy covers the RaceLink application at racelink.io and the RaceLink marketing website.

It does not cover:

• Leagues you join. League owners and administrators are independent operators. When a league asks you for information through a RaceLink form, the league decides what to ask and why. We handle that information on the league’s behalf and under the league’s instructions — see section 5.
• iRacing. Your relationship with iRacing is governed by iRacing’s own terms and privacy policy.
• Stripe. Payments are processed by Stripe. Card details are entered on Stripe’s own hosted checkout page and never reach our servers.
• Other websites. Lap guides, setup files, videos, league websites and similar material linked from RaceLink are hosted elsewhere by third parties. Replay files attached to protests are different — those are uploaded to and stored by us, and section 4.8 explains how we handle them.

3. Age requirements and young people

You must be at least 13 years old to hold a RaceLink account.

If you are under 18, a parent or guardian must read and accept our Terms of Service on your behalf, provide their email address, and supervise your use of RaceLink. This mirrors iRacing’s own requirement that under-18s have a parent or guardian set up their account.

How we check. When you sign up we ask for your date of birth. We do not store your full date of birth — we store only whether you are 13 or over, whether you are 18 or over, and the date you told us. You cannot change a declared date of birth that placed you under an age threshold; if you believe you entered it incorrectly, email us.

If we learn an account holder is under 13, we will delete the account and its personal information without delay, and will not use that information for any other purpose in the meantime.

Where a user is under 18, we apply the following by default and do not offer a way to turn them off:

• We collect only what is necessary to operate the service. There are no optional data collections.
• We do not profile users, serve advertising, or use engagement-maximising design features.
• We do not sell, share, or disclose personal information for marketing.
• We store the parent or guardian’s email address so we can contact them about the account, and for no other purpose.
• A parent or guardian may exercise any of the rights in section 10 on the young person’s behalf.

We consider the best interests of the child when deciding whether and how to collect, use or disclose personal information about anyone under 18.

4. What we collect and where it comes from

4.1 Account information

Collected directly from you when you sign up or update your profile:

• First name and last name
• Email address
• Password (stored only as a salted hash; we never see or store your password in readable form)
• Date of birth, reduced to age-threshold flags as described in section 3
• Parent or guardian email address, if you are under 18
• Time zone
• Notification preferences
• The version of our Terms of Service you accepted, and when

Account creation, sign-in and password reset are protected by Google reCAPTCHA Enterprise, which analyses device and interaction signals to distinguish humans from bots. This sends technical information about your device and behaviour to Google. See section 7.

Account emails — verification, password reset, and email-change confirmation — are sent by Supabase on our behalf.

4.2 iRacing account data

Linking your iRacing account is optional but is required for most RaceLink features to work. Linking uses iRacing’s own OAuth 2.0 authorisation, with the scopes iracing.auth and iracing.profile. You authenticate on iRacing’s site — we never see your iRacing password.

Once linked, we collect and store:

• Your iRacing customer ID and display name
• Your iRating, licence class and safety rating for each racing discipline
• The raw profile data iRacing returns about you
• Your membership of iRacing leagues, and your position in league standings
• Race schedules, session results, lap times and incident records for sessions and leagues you are involved in
• Your iRacing team memberships

We also store the access and refresh tokens iRacing issues, so we can keep your data in sync without asking you to re-authorise every session. These tokens are encrypted at rest. You can unlink your iRacing account at any time, which deletes the tokens and your cached iRacing profile data.

4.3 Information about people who do not have RaceLink accounts

iRacing league rosters, standings, results and team lists include drivers who have never signed up to RaceLink. When we sync a league, we necessarily store information about those drivers — typically their iRacing display name and customer ID, their finishing positions, lap times and incident counts.

We hold this as a cache of data sourced from iRacing’s league data, on the basis that we have a legitimate interest in displaying complete and accurate league standings and results, which cannot be done with gaps. We limit what we store to what is needed to render standings, schedules and results, and none of it is visible without a RaceLink account.

We cannot practicably contact every driver appearing in a league’s data to give them individual notice, so we publish this policy instead. If you are one of these drivers, section 10 applies to you in full: you can ask us what we hold, correct it, or ask us to delete it. If you ask us to delete it, we will also record a minimal suppression entry (your iRacing customer ID) so that later syncs do not silently pull your information back in. That suppression entry is the one thing we keep, precisely so that your deletion request keeps working.

Replay files uploaded with protests are a second source of information about people who have not signed up. An iRacing replay records the state of an entire session, so it contains driving data for every car that took part, not only the drivers a protest concerns. We do not extract, index or analyse the contents of replay files — we store them, make them available to the administrators of the league the protest was filed in, and delete them on the schedule in section 11.

4.4 League forms and registration

League administrators can build their own forms — for season sign-up, driver declarations, paid registration, whatever they choose. They decide what fields to include, and free-text fields mean they could ask for real names, contact details, addresses or anything else.

For the content of league forms, the league is responsible for what is collected and why. We are acting on the league’s instructions. Under the League Operator Agreement, a league owner agrees that every form they build is for the purpose of running their league — we do not require them to give a separate, form-by-form justification. We store form definitions and submitted answers, make them available to that league’s administrators, and delete them when instructed. Our Terms of Service prohibit league operators from using forms to collect health information, government identifiers, financial account details, or other sensitive information — but we cannot inspect every free-text answer, so if a league asks you for something that seems inappropriate, do not answer it and tell us at dev@racelink.io.

Forms require a signed-in RaceLink account. There are no public or anonymous forms.

4.5 Payments

League owners connect their own existing Stripe account to RaceLink using Stripe Connect. Money for registration fees moves between you and the league through Stripe — RaceLink never holds your funds. We deduct a platform fee from the league’s payout; you are charged only the price the league advertises.

Payment happens on Stripe’s hosted checkout page. Card numbers, expiry dates and security codes never touch RaceLink’s servers and we never see them.

What we do store, from Stripe’s webhooks:

• Stripe account, checkout session and payment intent identifiers
• Amount, currency and description
• Payment status — paid, refunded, disputed or failed
• Which RaceLink user and which league the payment relates to

4.6 Google Calendar (optional)

If you choose to connect Google Calendar, we ask Google for permission limited to calendars our application creates. We create a separate calendar in your Google account named “Racelink Races” and write your upcoming race schedule to it.

We do not read, modify or have access to your primary calendar or any other calendar in your account. When you disconnect, we delete the “Racelink Races” calendar and the stored Google authorisation tokens.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Calendar data for advertising, do not sell it, do not transfer it except as necessary to provide the calendar feature, and do not allow humans to read it except with your explicit permission, for security purposes, to comply with law, or in aggregated and de-identified form.

4.7 Calendar subscription feed (optional)

You can subscribe to your race schedule from any calendar application using a personal ICS feed URL. That URL contains a secret token in place of a password, so anyone who has the URL can see the event names, dates and times in your race schedule. The feed contains no other personal information.

You can regenerate the token at any time, which immediately breaks the old URL. The feed is excluded from search engine indexing. Treat the URL like a password — and be aware that if you paste it into a third-party calendar service, that service will store it and fetch it on a schedule.

4.8 Protests and penalties

If you file a protest, we store your allegation as you wrote it, the driver or drivers it concerns, the session it relates to, and the outcome.

Replay files. You can attach an iRacing replay file to a protest as evidence. When you do, the file is uploaded to and stored on our infrastructure — we are not merely linking to it. We store the file itself, its filename, its size, when you uploaded it, and which protest it belongs to.

Replay files are held in private storage. They are not publicly accessible and have no permanent public URL. Access is granted only through short-lived signed links issued to administrators of the league the protest was filed in, and to us where necessary to operate, support or secure the platform. We accept only iRacing replay files, subject to a file size limit, and we serve them as downloads only — they are never rendered or executed in a browser.

Be aware of what you are sharing when you upload one. A replay contains session data for every driver who took part, so uploading it discloses information about people beyond the driver you are protesting. Only upload replays of sessions you took part in, and only where it is genuinely needed as evidence.

Protests, and any replay attached to them, are visible only to administrators of the league concerned, and to us where necessary to operate or troubleshoot the platform. They are not published to other members. If a penalty results, the affected driver is notified of the penalty.

Protest content is written by users, not by us. We do not verify allegations and take no position on whether they are true. If a protest about you is inaccurate, defamatory or abusive, email dev@racelink.io and we will review it.

4.9 Other information

• League messages and announcements written by administrators and delivered to league members.
• In-app notifications generated for you.
• Bug reports you submit — your email address, your description of the problem, and a severity rating.
• Stint and fuel plans, including event details and driver names entered manually by the person building the plan. Names entered here are free text and may not correspond to any RaceLink account.
• Technical and security data — server logs including IP addresses, request paths and timestamps, and reports of Content Security Policy violations, which stay on our own infrastructure and are not sent to any third party.
• Analytics — see section 6.

5. Our role: when we are responsible and when the league is

For your account, your iRacing data, your notifications, protests you file, and platform operation generally, we decide how information is handled and we are responsible for it. Under the GDPR we are the “controller”.

For the content of league forms and league messages, the league decides and we act on its instructions. Under the GDPR we are the “processor” and the league is the controller. League operators accept a separate agreement covering this, which requires them to have a lawful basis for what they collect and to comply with applicable privacy law.

If you have a question about information a league collected from you, ask the league first. If you cannot reach them, contact us and we will help.

6. Cookies, analytics and tracking

We use very little here, deliberately.

Cookies we set:

Cookie	Purpose	Duration
Supabase session cookies	Keeps you signed in	Session / until sign-out
OAuth and CSRF state cookies	Security for the iRacing, Google Calendar and Stripe Connect connection flows	A few minutes, httpOnly

All of these are strictly necessary to provide a service you have asked for. We do not use cookies for advertising, profiling or cross-site tracking, so we do not show a cookie consent banner. There is nothing to consent to.

Analytics. We use Vercel Analytics and Vercel Speed Insights to understand aggregate traffic and page performance. These are configured without cookies and without persistent identifiers. They do not track you across sites or build a profile of you.

We do not use Google Analytics, Meta Pixel, or any advertising or social media tracking technology. We do not sell or share personal information, and we do not disclose it for cross-context behavioural advertising.

Fonts are served from our own infrastructure, not from a third-party font CDN.

Marketing website. Our marketing site and development blog collect no personal information. There are no forms, no newsletter, and no analytics on it. If we add a contact or newsletter form in future, we will use the details you provide only to respond to you or send what you asked for, will not add you to any other list, and will keep enquiries for no more than 24 months.

7. Who we share information with

We do not sell personal information. We share it only with the service providers below, only for the purposes listed, and only to the extent needed.

Provider	What it handles	Where
Supabase	Database, authentication, file storage for uploaded replays, serverless functions, account emails	Tokyo, Japan (ap-northeast-1)
Vercel	Application hosting, analytics, performance monitoring	United States and global edge network
iRacing	Identity linking and the source of all racing data	United States
Stripe	Payment processing and Stripe Connect	United States, Australia and Ireland
Google (Calendar API)	Optional calendar sync, only if you connect it	United States
Google (reCAPTCHA Enterprise)	Bot and abuse prevention on sign-up, sign-in and password reset	United States
Resend	Emails us a copy of bug reports you submit, so we see them promptly	United States

We may also disclose personal information:

• To league administrators, where you are a member of their league — your name, iRacing display name, ratings, standings, results, and your answers to their forms.
• To other members of a league you join, limited to your name, iRacing display name, ratings, standings and results.
• Where the law requires it — in response to a valid legal request, court order or regulatory demand.
• To protect people — where we reasonably believe disclosure is necessary to prevent a serious threat to someone’s life, health or safety.
• To a buyer, if RaceLink is ever sold or transferred, subject to that buyer being bound by terms no less protective than this policy. We will notify you before any such transfer takes effect.

Internal access. A small allow-listed set of RaceLink site administrators can access platform-wide features to run special events. Access to production data is limited to those who need it, secured with multi-factor authentication, and used only to operate, support and secure the service.

8. Sending information overseas

RaceLink runs on infrastructure outside Australia. Our database and file storage are hosted in Tokyo, Japan, and the other providers in section 7 are mostly based in the United States. So yes — your personal information is stored and processed overseas, including uploaded replay files.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, as required by APP 8. In practice this means using established providers with published privacy commitments and data processing terms.

For users in the European Economic Area or the United Kingdom: Japan has been recognised by the European Commission as providing an adequate level of data protection, so storage of your information in Japan does not itself require additional safeguards. Where information reaches a provider outside an adequate jurisdiction, transfers rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), incorporated into our agreements with each provider. Australia does not have an EU adequacy decision.

We have not appointed a representative in the EU or the UK.

9. Why we use your information, and our legal basis

What we do	Information used	Legal basis (GDPR)
Create and operate your account	Account information	Performance of a contract
Verify your email, reset your password	Email address	Performance of a contract
Check you meet the minimum age	Age-threshold flags, parent/guardian email	Legal obligation and legitimate interests
Sync your iRacing data and show standings, schedules and results	iRacing data and tokens	Performance of a contract
Show complete league standings and results including non-members	Third-party driver data (section 4.3)	Legitimate interests
Run league forms and registration	Form answers	Performance of a contract; the league’s own basis as controller
Process registration payments	Payment records	Performance of a contract
Sync your calendar and provide the ICS feed	Schedule data	Your consent
Run protests and penalties	Protest and penalty records	Performance of a contract and legitimate interests
Send you league messages and notifications	Contact and preference data	Performance of a contract
Prevent bots, abuse and fraud; keep the platform secure	Technical data, reCAPTCHA signals, logs	Legitimate interests
Fix bugs and improve the service	Bug reports, aggregate analytics	Legitimate interests
Meet tax and record-keeping obligations	Payment records	Legal obligation

Under Australian law, the corresponding obligations are in APP 3 (collection), APP 5 (notice), APP 6 (use and disclosure), APP 8 (overseas disclosure), APP 10 (accuracy), APP 11 (security) and APPs 12 and 13 (access and correction).

Where we rely on legitimate interests, we have assessed our interest against your rights and concluded the processing is proportionate. You can object — see section 10 — and we will stop unless we have compelling grounds not to.

Where we rely on consent, you can withdraw it at any time by disconnecting the relevant integration. That does not affect anything done before you withdrew.

10. Your rights

These rights apply to everyone, wherever you live — including people who appear in league data without a RaceLink account. We have chosen not to make them depend on your jurisdiction.

You can ask us to:

• Tell you what we hold about you and give you a copy.
• Correct anything inaccurate, out of date or incomplete. Note that data sourced from iRacing must be corrected at iRacing — we will re-sync once you have, and we will correct anything we generated ourselves.
• Delete your personal information. See below for what deletion does and does not remove.
• Give you a portable copy of the information you provided to us, in a machine-readable format.
• Restrict or object to particular processing, including anything we do on the basis of legitimate interests.
• Withdraw consent for optional integrations.

How. Email dev@racelink.io. There is currently no self-service deletion or export in the app — a person handles each request. We may ask you to confirm your identity, using the email address on your account, before we act.

Timing. We acknowledge requests within 5 business days and complete them within 30 days. If a request is complex and needs longer, we will tell you why and when to expect a response.

Cost. Free. We do not charge for access, correction or deletion requests.

What deletion removes. Your profile, credentials, iRacing tokens, cached iRacing profile data, notification preferences, in-app notifications, messages you sent, bug reports, your answers to league forms, and any replay files you uploaded — the files themselves, not just the database records pointing at them.

What deletion does not remove, and why. Race results, lap times, finishing positions and standings for sessions you took part in remain, because they are the historical record of a competition involving other people and are sourced from iRacing’s league data rather than created by us. Protests you filed and penalties issued to you remain in the league’s disciplinary record, with your name removed where the record still makes sense without it. Payment records are retained for the period tax law requires. We will explain exactly what remains when we confirm your deletion.

We also keep a minimal suppression record — your hashed email address and iRacing customer ID — solely to stop future syncs re-creating information we deleted at your request.

Complaints. If you are unhappy with how we have handled your information, tell us first at dev@racelink.io. If we do not resolve it:

• Australia — Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992.
• EEA — your national data protection authority.
• United Kingdom — Information Commissioner’s Office, ico.org.uk.

11. How long we keep things

Information	Retention
Account and profile	While your account is active. Deleted within 30 days of a deletion request.
Inactive accounts	Deleted after 24 months with no sign-in, following a warning email to your address 30 days beforehand.
iRacing OAuth tokens	Deleted when you unlink, when you delete your account, or after 90 days with no successful refresh.
Cached iRacing profile, ratings and licences	Overwritten on each sync. Deleted when you unlink or delete your account.
Race results, standings and schedules	For the life of the league, plus 12 months.
Protests and penalties	For the life of the league, plus 12 months.
Replay files uploaded with protests	6 months after the protest is decided, then deleted. Deleted immediately if the uploader deletes their account, or on request by any driver who appears in the session. The protest record and its outcome remain; the file does not.
League messages and announcements	24 months, or until the league is deleted.
Form definitions and submitted answers	Until the league deletes them, or 90 days after the league’s account is closed.
Payment records	7 years, as required by Australian tax law.
In-app notifications	6 months.
Bug reports	6 months after the report is closed.
Stint and fuel plans	12 months after the event they relate to.
Server logs and CSP violation reports	90 days.
Suppression records for deleted data	Kept indefinitely, because their only purpose is to keep a deletion effective.
Terms acceptance records	For as long as your account exists, plus 7 years.

We do not currently have automated purge jobs for every category above — closed bug reports are the exception, purged automatically on the schedule above. Where deletion is otherwise manual we run it on a scheduled review, and we will always action an individual request within the 30 days in section 10.

12. How we protect your information

• Passwords are hashed by Supabase Auth. We never store them in readable form.
• iRacing and Google OAuth tokens are encrypted at rest, with the encryption key held outside the database.
• All traffic is served over HTTPS.
• Database access is controlled by row-level security, so users can only reach records they are entitled to.
• Uploaded replay files are held in private storage with no public URL. They are reachable only through short-lived signed links issued to people entitled to see them, and access is governed by the same row-level security rules as the protest they belong to.
• We accept only iRacing replay files, enforce a maximum file size, and serve every file as a download rather than rendering it, so nothing uploaded by a user can execute in anyone’s browser.
• Card data never touches our systems — payments happen entirely on Stripe’s hosted checkout.
• Sign-up, sign-in and password reset are protected by reCAPTCHA Enterprise.
• A Content Security Policy is enforced, and violations are logged for review.
• Administrative access to hosting, database, payment and domain accounts requires multi-factor authentication or passkeys, and is limited to people who need it.

No system is perfectly secure. RaceLink is a small operation, and we would rather tell you what we actually do than promise more than we can deliver.

13. Data breaches

If a data breach occurs and we assess that it is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware, and notify affected individuals without undue delay where the risk to their rights is high.

Our notification will tell you what happened, what information was involved, what we are doing about it, and what we recommend you do.

14. Automated decision-making

We do not make automated decisions about you that have legal or similarly significant effects. Standings and championship points are calculated arithmetically from race results, but every protest outcome, penalty, class assignment and account suspension is decided by a human — a league administrator, or us.

15. Changes to this policy

We will update this policy when what we do changes. The version number and effective date at the top will change, and for any change that materially affects your rights or how we use your information we will notify you by email and in the app before it takes effect.

16. Third-party terms that also apply to you

• iRacing — iracing.com
• Stripe — stripe.com/privacy
• Google, for Calendar and reCAPTCHA — policies.google.com/privacy
• Supabase — supabase.com/privacy
• Vercel — vercel.com/legal/privacy-policy