Privacy Policy

1. Introduction

Pit Crew is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App.

We are committed to compliance with the General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and other applicable data protection laws.

2. Information We Collect

2.1 Information You Provide Directly

Account Registration:

• Display name
• Email address
• Age confirmation (to verify 18+ requirement)
• Profile photo (optional)

Authentication:

• Email and password credentials (stored as a hashed authentication record via Firebase Authentication)
• Apple ID or Google Account identity (we only receive and store authentication tokens, not your full account details)

User Activity:

• Predictions and prediction history
• League participation and settings
• Chat messages and interactions
• Notification preferences (deadline reminders, result alerts)

2.2 Information Collected Automatically

Technical Information:

• Device type, operating system, and app version
• App usage events and navigation patterns (via Firebase Analytics)
• Error and crash reports, including stack traces and device context (via Sentry)
• Firestore read/write timestamps and session data

3. How We Use Your Information

We use the information we collect for the following purposes:

• Authentication & Account Management: To create and manage your account, verify your identity, and maintain security
• Service Delivery: To provide prediction, leaderboard, chat, and achievement functionality
• Push Notifications: To send opt-in notifications for prediction deadlines and published race results (via Firebase Cloud Messaging)
• Analytics: To understand how users interact with the App and identify areas for improvement (via Firebase Analytics)
• Error Monitoring: To diagnose crashes and technical issues and improve stability (via Sentry)
• Compliance: To verify age restrictions and meet legal obligations

We do not use your information for:

• Marketing or promotional emails
• Selling or sharing data with third parties for profit
• Targeted or behavioural advertising

4. Data Storage & Infrastructure

4.1 Firebase (Google LLC)

Pit Crew uses Google Firebase as its primary infrastructure provider. Your data is processed and stored within the following Firebase services:

• Firebase Authentication: Handles account creation, sign-in (email/password, Apple, Google), and session management
• Firebase Firestore: Stores user profiles, predictions, league data, chat messages, achievements, and race information
• Firebase Storage: Stores user profile photos
• Firebase Cloud Functions: Processes server-side logic including chat moderation, score calculation, league management, achievement awards, and notification dispatch
• Firebase Cloud Messaging (FCM): Delivers push notifications to your device if you have opted in
• Firebase Analytics: Provides aggregate and pseudonymous usage statistics
• Firebase Hosting: Serves the App

Your data is stored in Google's European data centres (London region, europe-west2) in compliance with GDPR requirements. Google LLC acts as a data processor under Firebase's Data Processing Amendment, with Standard Contractual Clauses (SCCs) in place.

4.2 Sentry (Functional Software, Inc.)

We use Sentry for error tracking and crash reporting on both the frontend and mobile clients. Sentry may collect stack traces, error messages, device and OS metadata, app version information, and a pseudonymous user identifier (your Firebase UID). Data may be stored in the United States under Standard Contractual Clauses. Sentry Privacy Policy.

4.3 OpenF1 API

We use the OpenF1 API to fetch race and driver information, synchronised into our own Firestore database. No personal user data is sent to OpenF1.

5. Push Notifications

If you grant permission, the App uses Firebase Cloud Messaging (FCM) to send push notifications. FCM requires us to store an FCM device token associated with your account. You can revoke push notification permission at any time via your device settings, and we will cease sending notifications immediately.

6. Data Retention

While your account is active, we retain your personal information, prediction and achievement history, chat messages (while the associated league exists), notification preferences and FCM token, and technical logs and error reports.

When you delete your account:

• Your personal information (name, email, profile photo, FCM token) is deleted within 30 days
• Your prediction history is anonymised (de-identified, not deleted)
• Your chat messages are permanently deleted
• Authentication tokens are revoked and FCM tokens are removed

Error reports collected via Sentry are retained for 90 days. Firebase Analytics data is aggregated and pseudonymous, retained up to 14 months per Google's standard retention policy.

7. Data Sharing & Third Parties

We do not share your personal data with third parties except Google LLC (Firebase), Functional Software Inc. (Sentry), where required by law or court order, or where necessary to prevent illegal activity.

We do not share your data with:

• Formula 1, the FIA, or affiliated entities
• Advertisers or marketing partners
• Data brokers or any other commercial entities for profit

Your chat messages are visible only to other members within the same league. Leaderboard rankings are visible to all members of your league.

8. Your Rights Under GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data via your profile settings or by contacting us
• Erasure — request deletion of your personal data (account deletion can be initiated from within the App)
• Data Portability — request your data in a structured, machine-readable format
• Withdraw Consent — withdraw consent for processing such as push notifications at any time
• Object — object to certain processing based on legitimate interests

To exercise any of these rights, contact us at aaron@russell-tech.co.uk. We will respond within 30 days.

9. Security

We take the security of your data seriously. Data is encrypted in transit using TLS/SSL. Firebase infrastructure enforces authentication and authorisation rules via Firestore Security Rules. Cloud Functions enforce server-side validation before any data write. Profile photos in Firebase Storage are protected by Storage Security Rules.

No method of transmission over the internet is 100% secure. While we use industry-standard protections, we cannot guarantee absolute security.

10. Age Verification

The App is intended for users aged 18 and above. We do not knowingly collect data from users under 18. If we become aware that a user is under 18, we will delete their account and associated data immediately.

11. International Data Transfers

Your data is primarily stored in Google's EU data centres (London region). For Sentry data, transfers to the United States are covered by Standard Contractual Clauses. Where any data transfers occur outside the EU/EEA, we ensure appropriate safeguards are in place in accordance with GDPR.

12. Tracking and Analytics

Pit Crew uses the following tracking and monitoring tools:

• Firebase Analytics: Aggregate, pseudonymous usage statistics. Not used for targeted advertising.
• Sentry: Crash reports and error logs for stability monitoring. Data is pseudonymous where possible.
• Firebase Authentication: Necessary session tokens for account management.

We do not use third-party advertising trackers, behavioural tracking for ad targeting, or cross-site tracking cookies.

13. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users within 72 hours of discovery, provide details of the breach and potentially affected data, explain measures being taken to mitigate harm, and report to the ICO as required by law.

14. Legal Basis for Processing

• Contractual Necessity: Processing required to provide the App and services you have requested
• Consent: Where you have given explicit consent (e.g. push notifications, analytics)
• Legal Obligation: Where required by applicable law
• Legitimate Interests: To improve our services, prevent fraud, and maintain security (e.g. error monitoring via Sentry)

15. Third-Party Services

16. Your Choices

• Update your profile information at any time through the App
• Manage push notification preferences within the App or via your device settings
• Delete your account from within the App (removes personal data within 30 days)
• Contact us to request a copy of your data or exercise any GDPR right

17. Complaints

If you believe we have violated your privacy rights under GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last Updated" date and, where appropriate, by in-app notification or email. Continued use of the App after such notice constitutes acceptance of the updated policy.

19. Contact

Russell Tech Limited
Aaron Russell
aaron@russell-tech.co.uk

We are not affiliated with Formula 1, the FIA, or any official Formula 1 entities.