1. Introduction
This Privacy Policy describes how OneRacing (“we,” “our,” or “us”) handles information in relation to our mobile application and our website at oneracingapp.com (together, “the Service”), a global hub for motorsport events, news, and community. We are committed to protecting your privacy and being transparent about our data practices — including the analytics tools we use, which this policy describes openly.
2. Information We Collect
When you create an account, we collect:
- Account data: Username, email address, and password (stored as a secure hash — we never store your password in plain text)
- Date of birth: Asked once at sign-up, used only to apply age-appropriate community protections (see section 10). It is never shown publicly and never used for advertising.
- Profile data: Optional profile photo and any information you choose to add to your profile
- Social login data: If you sign in with Google, Apple, or Facebook, we receive your name, email address, a provider account ID, and (for Google/Facebook) a profile picture from that provider
- Community content: Posts, replies, poll votes, likes, blocks, and any images you upload to the community wall
- Favorites & game activity: Categories and content you favorite; scores, streaks, and results from daily challenges
- Device & preference data: Push notification token, platform (iOS/Android), app language, and timezone — used to deliver notifications and localize content
Whether or not you have an account, our servers derive an approximate country from your IP address to serve region-appropriate content. We do not store your IP address with your profile.
What we don’t do: We do not show ads, we do not use advertising networks, and we never sell your personal data. We do use a product-analytics service (PostHog) to understand how the Service is used — section 3 explains exactly what that involves. Account creation is optional.
3. Analytics & Measurement
We use PostHog (PostHog Inc., hosted in the United States) to measure how the Service is used, so we can fix problems and improve features. This includes:
- Usage events: Pages and screens viewed, sign-up/login events, and gameplay events (e.g. a game being started)
- Identification: If you are logged in, events are associated with your numeric user ID (and on mobile, your username). We do not send your email address to PostHog.
- Session replay (website only): A random sample of about 10% of website sessions is recorded as an anonymized interaction replay to help us debug usability issues. Replays capture interactions with the page, not your device.
- App lifecycle (mobile): Install, update, open, and background events
On the website, analytics runs cookielessly (in-memory, no persistent identifiers stored in your browser) and is routed through our own domain infrastructure. On mobile, the app also includes the Meta (Facebook) SDK, which is required for Facebook Login and reports basic app events (such as app installs and sessions) to Meta Platforms, Inc. We have disabled the collection of the advertising identifier by this SDK.
4. How We Use Your Information
- Authentication: To identify you when you log in and keep your session secure
- Personalization: To display your favorites and saved preferences across devices
- Community: To display your posts and replies, and to apply age-appropriate safety protections
- Leaderboards: To display your username and scores in public game rankings
- Communications: To send account-related emails (email verification, password reset) and the push notifications you have enabled
- Service improvement: To understand usage patterns and fix problems (see section 3)
5. Data Storage & Retention
Server storage: Account data, community content, favorites, and game scores are stored on our servers. This allows your data to sync across devices when you’re logged in.
Local storage: Some preferences and cached content are also stored locally on your device for faster access.
Data retention: Your data is retained for as long as your account is active. You can permanently delete your account and all associated data at any time directly from the app or website (Profile → Delete Account).
6. Public Information
Content you post to the community wall (posts, replies, uploaded images) and your username and scores on game leaderboards are visible to other users and to visitors of the website. Your email address and date of birth are never publicly displayed.
7. Push Notifications
OneRacing may send push notifications about upcoming races, results, your favorite categories, and community interactions (likes and replies to your posts). Notifications are:
- Sent only if you grant notification permissions
- Configurable per type in the app’s notification settings
- Fully optional — you can disable them at any time in the app or in your device settings
We use Expo Notifications for delivery. Your device push token and the notification content pass through Expo’s push service for this purpose.
8. Third-Party Services
We share data with the following service providers, strictly to operate the Service:
- PostHog (US): product analytics and sampled website session replay — see section 3
- Meta Platforms (US): Facebook Login, and basic app events from the Meta SDK on mobile — see section 3
- Google (US): Google Sign-In (identity verification), and machine translation of app content (no personal data is sent for translation)
- Apple (US): Sign in with Apple (identity verification)
- Resend (US): transactional email delivery (verification, password reset) — receives your email address
- Expo (US): push notification delivery — receives your device push token
- Cloudflare (global): network infrastructure and security in front of our servers — technically processes all traffic, including IP addresses
- YouTube (US): embedded video players for official streams and highlights, loaded in privacy-enhanced mode (youtube-nocookie.com). YouTube’s own terms apply when you play a video.
We do not sell or rent your personal data to anyone, and we do not share it with data brokers or advertising networks.
9. Data Security
- Passwords stored using secure hashing (never in plain text)
- Authentication via short-lived access tokens and secure refresh tokens
- Encrypted communication between the app and our servers (HTTPS)
10. Children’s Privacy & Safety
We ask for a date of birth at sign-up to keep younger fans safe. You must be at least 13 years old to create a OneRacing account. Our community features are built with child safety in mind:
- Minimum age: new registrations from users under 13 are not accepted. Pre-existing under-13 accounts are restricted to view-only community access and excluded from analytics.
- Safety reminder: before exchanging any content, users see a clear in-app reminder about online safety and the real-world risk of interacting with people online.
- Parental controls: an adult can enable, restrict to view-only, or fully hide the community for an account, behind a parental gate.
- Moderation: users can report or block others; we review reports and remove objectionable content and abusive users, typically within 24 hours.
We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
11. International Users & Regional Rights
OneRacing is available globally. By using the Service, you acknowledge that your data is stored on our servers and processed by the providers listed in section 8, some of which are located in the United States. We handle your data in accordance with this Privacy Policy regardless of where you are located.
European Economic Area / UK: we process your data to provide the Service you request (contract), to keep it secure and understand usage (legitimate interest), and to meet child-safety obligations (legal obligation). You have the right to access, correct, delete, or export your data, to object to processing, and to lodge a complaint with your local data protection authority.
California: we do not sell or share your personal information as defined by the CCPA/CPRA. You have the right to know what we collect (this policy), to delete your data, and to non-discrimination for exercising your rights.
12. Your Rights and Choices
- Access: Request a copy of the data we hold about you by contacting us
- Correction: Update your profile information at any time through the app settings
- Deletion: Delete your account and all associated data directly from the app — go to your profile and tap “Delete Account”
- Guest mode: Browse without creating an account — no account data exists in that case, though anonymous usage analytics (section 3) still applies
- Notifications: Disable push notifications per type in the app, or entirely through your device settings
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make any material changes that affect how we handle information, we will notify users through the app or other appropriate means and update the date at the top of this page. The updated policy will be effective immediately upon posting.
14. Contact Information
If you have any questions about this Privacy Policy, our data practices, or wish to exercise any of your rights, contact us at:
Email: [email protected]