Privacy policy | StintCrow

1. Who we are

StintCrow is operated by Brocode 021 Doo, Dr Svetislava Kasapinovica 32, 21000 Novi Sad, Serbia (“we”, “us”). We are the controller of the personal data described in this policy.

Team administrators decide which people to add to a team and which race information to share. An administrator who adds another person’s details must have a lawful reason to do so and must tell that person about this policy.

2. Information we collect

We collect the following information:

Account information. When you sign in with Google, we receive your account identifier, verified email address, display name and profile image.
Team and driver information. Names, optional email addresses, roles, team logos, profile links and race lineups that you or an administrator enter.
Race and training information. Event locations and schedules, timing links, regulations, stint plans, kart assignments, lap observations, training sessions and calculated statistics.
Technical information. Requests, device and browser details, IP addresses, error reports and security records that our infrastructure providers process to run the service.
Usage information. Page visits, device and browser details and analytics identifiers collected by Google Analytics.

You can browse the public pages without an account. You need Google sign-in to use team features. Driver email addresses and logo uploads are optional. We do not collect payment card details.

Do not enter health information, identity documents or other sensitive personal data in team or race fields.

3. How we use information

We use personal data for these purposes and on these legal bases:

To provide the service, including accounts, teams, shared race plans, live timing and training capture. Legal basis: performance of our agreement with you.
To keep the service secure and reliable, prevent misuse and fix errors. Legal basis: our legitimate interests.
To understand how visitors use the site and improve it. Legal basis: our legitimate interests.
To comply with legal obligations and respond to lawful requests. Legal basis: legal obligation.

Stint and pace calculations support team decisions. They do not make automated decisions that have legal or similarly significant effects on you.

4. How we share information

Inside StintCrow, the authorized members of your team can see its team information. Teammates see the name, email address and photo saved on the team roster. A team’s race plan, notes and timing preferences are visible only to that team’s members. Race catalog details, including which teams entered, their classes and timing links, are visible to all signed-in users.

We share personal data only with:

Service providers. Google Firebase provides authentication, database, file storage, server functions and analytics. These providers process data on our behalf.
Authorities and other parties when the law requires it, or when it is necessary to protect rights, safety or the security of the service.
A successor organization if StintCrow is merged, acquired or transferred. This policy will continue to apply to the transferred data.

We do not sell personal data and we do not share it for advertising.

Timing providers and external image hosts have their own privacy practices. When you load a remotely hosted image or open an external link, that host can receive your IP address and browser details.

5. International transfers

We may process data outside Serbia and outside your country. Firebase Authentication processes data in the United States. Other Firebase services can process data wherever Google and its subprocessors operate. Google’s data-processing terms set out the safeguards that apply to these transfers. Contact us for details of the safeguards for your data.

Firebase data-processing terms

6. Cookies and browser storage

StintCrow uses essential browser storage for sign-in, preferences, team selection, setup drafts and reliable race and training capture. Race and training observations that are not yet saved to the server stay on your device until the server confirms them, you remove them, or you clear browser storage. Signing out does not always remove these local copies. Take care on shared devices.

We use Google Analytics to measure site visits and usage. Google Analytics uses cookies and similar identifiers. We turned off Google signals and ad personalization. You can limit analytics with your browser’s privacy settings or a content blocker.

7. Data retention

We keep accounts, teams, race data and training history until you or your administrator delete them, or until we complete a deletion request. There is no automatic age-based expiry.

When a team leaves a race, it loses access to that race’s recorded history. We keep that history so the team can rejoin. When a team is deleted, access stops at once and its race and training history enters a recoverable cleanup. Deleting a team does not delete shared races or other people’s accounts.

Security logs, backups, uploaded files and deletion records can follow a different schedule and can remain for a limited time after deletion. We keep information when we need it to complete a recovery, meet legal obligations or resolve disputes.

Clearing browser storage removes the copies on that device only. It does not delete server records.

8. Security

We use access controls, encrypted connections and the security features of our infrastructure providers to protect personal data. No service is completely secure. Keep your Google account secure and keep team join codes private.

9. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict or receive a copy of your personal data. You can object to processing that is based on our legitimate interests. Where processing is based on consent, you can withdraw it at any time.

To make a request, contact us with enough information to identify your account. We may need to verify your identity. We respond within the time that applicable law requires.

You can complain to the Commissioner for Information of Public Importance and Personal Data Protection of Serbia, or to the data protection authority where you live.

10. Children

StintCrow is not directed at children under 16. We do not knowingly collect personal data from children under 16 without the consent of a parent or guardian. A team that includes younger drivers must get that consent before it adds their details. If you think a child’s data was added without consent, contact us and we will delete it.

11. Changes to this policy

We update this policy when the service or our data practices change. The date at the top of this page shows the current version. We tell users about material changes through the service.

12. Contact

Send privacy questions and requests by post to Brocode 021 Doo, Dr Svetislava Kasapinovica 32, 21000 Novi Sad, Serbia. Mark the letter “StintCrow privacy”.