Privacy policy

Policy version 2026-10-03. NGRally — Real Finnish rally stages.

Data and purposes

We store your username and password hash to authenticate you, optional e-mail for password recovery only, optional country, privacy acceptance timestamp and policy version, and optional profile details you choose to supply (display name, team, race number). No real name is required. Race attempts, results and splits support competition, rankings and fair-play review. One plain-text comment of up to 280 characters may be added after each finish; reports and moderation actions support abuse review.

Uploaded drive logs are used for result verification and physics diagnosis. Their headers must be redacted before upload: no environment values, absolute local paths, machine or user names. Hardware model and GPU may remain. This website does not verify that every uploaded file has been redacted.

Server request and error logs support operation and diagnosis. IP addresses are not recorded in API usage rows; in-memory login rate-limit keys expire after minutes. Operational logs are rotated and retained for at most seven days. No analytics, external fonts or tracking scripts are loaded. The browser uses a session cookie only.

Visibility and retention

Username, country, optional profile and competition results are public. E-mail, password hash and tokens are private. Your profile lasts until deletion; results remain as deleted driver after deletion and your comments are removed. Moderation records retain the reason and time; deleted account links are removed. Account-linked usage metadata lasts 30 days. Drive-log retention target is top 50 per board and 30 days for other runs; enforcement belongs to the evidence service and is not yet implemented in this website release. Private nightly backups roll off after fourteen backups; deletion reaches retained backups as they expire.

Your rights and contact

Use account settings to export your profile, attempts, results and comments as JSON, correct your profile, or delete your account with password confirmation. You may request access, rectification, erasure, restriction, portability or object to processing, and contact your local data protection authority.

Contact: privacy@ngrally.invalid. This is an owner placeholder and must be replaced with a working address before public launch. E-mail recovery delivery is not configured yet.