Privacy notice (draft)

This notice covers the Proxie driver site during the beta. It is run by [Operator legal name]. Questions and requests go to [Support email]. It takes effect on [Effective date].

Your email account is also the account ProxieKit, the event organizer product, uses. Signing in to either with the same email uses one account record. Sign-in codes and sessions are separate.

• Email address. You enter it to sign in. It is stored in lower case with your account.
• Sign-in codes. Each request stores your email address, a keyed hash of the six-digit code (not the code itself), the times it was made and expires, the number of wrong tries and whether it was used. A code works for 10 minutes and locks after 5 wrong tries.
• Session. After a valid code we store a hash of your session token, your account, the start and end times and whether you signed out. A session lasts 30 days.
• Profile. Display name, racing number (optional), main discipline, home region (optional), whether the profile is public, and when it was created and last changed.
• Cars. Up to 10, each with year, make, model, an optional car number, whether it is your main car and whether it is public.
• Network address, in hashed form. When you ask for a sign-in code we count requests per network address to stop abuse, at most 20 an hour. Our database keeps a one-way hash of the address and the time, not the address itself.

Your public page address is made from your display name when you create the profile. It does not change if you rename yourself.

The beta does not collect phone numbers, payment details, photos or video. Those features are not connected. We send no email except sign-in codes.

The host may keep its own server logs. [Server log contents and retention: owner to confirm]

Public while your profile is on: display name, racing number, main discipline, home region, the month and year you joined, and each car you mark public (year, make, model, car number). This shows on your public page and in driver search. Anyone can see it without signing in, and the site does not tell search engines to skip these pages.

Private: your email address, sign-in codes, sessions, the network-address hash, cars you mark private, and everything on a hidden profile.

New profiles and new cars start as public. You can switch either off.

• Email address and codes: to sign you in and keep your account secure.
• Profile and cars: to show your public page and driver search results, and your own account page.
• Network-address hash: to limit sign-in code requests.

We do not use your data for advertising.

Two services handle your data for us.

• Railway hosts the site and its database, in the United States.
• Resend sends the sign-in email. It receives your email address and the message, which contains the code.

Proxie sets one cookie, a sign-in cookie named __Host-stintrank-identity. It is set after you enter a valid code and lasts 30 days. Page scripts cannot read it (HttpOnly), it is sent only over HTTPS (Secure), and it is cleared when you sign out. Deleting your profile ends every Proxie sign-in on all your devices.

There are no analytics or advertising cookies, and the site loads no third-party scripts.

• Profile and cars: until you delete the profile. Deleting replaces your name with Deleted driver, clears your racing number, discipline, home region and page address, takes your public page offline and hides your cars. Removing a single car also only hides it. Car details (year, make, model, number) stay in the database for now. [When removed cars are erased]
• Email address: deleting your profile does not delete your account, so you can sign in again. [How long the email is kept and how a deletion request works]
• Sign-in code and session records: codes expire after 10 minutes and sessions after 30 days, but the records are not deleted automatically. [Retention for these records]
• Network-address hashes: entries older than a day are removed the next time the same address asks for a code. Other entries have no scheduled deletion. [Retention for these records]
• Backups: [Backup retention]

On your account page you can:

• Edit your display name, racing number, main discipline and home region.
• Hide your profile from your public page and driver search.
• Add, edit and remove cars, and choose which are public.
• Sign out, which ends the session on our side.
• Delete your profile, after a confirmation. It cannot be undone. You can make a new profile later with the same email.

The beta has no way yet to change your sign-in email, download your data or erase your email account. Ask [Support email].

We may update this notice before Proxie leaves beta. [How changes to this notice are announced]

[Operator legal name], [Support email]