Privacy Policy

1. Introduction

LEAGR ("we", "us", "our") operates the LEAGR platform at leagr.app. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have in relation to it.

By using LEAGR you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the platform.

2. Data we collect

We collect the minimum data necessary to provide the service:

• Account dataYour email address and a hashed password when you register.
• iRacing identityYour iRacing customer ID (Cust ID) and display name, linked when you connect your account.
• Race & stats dataiRating, Safety Rating, finish positions, incident counts and other publicly available race statistics fetched from the iRacing API.
• Session tokensShort-lived authentication tokens (stored in your browser's localStorage and as an HTTP-only cookie) used to keep you signed in.
• League & season dataLeague names, rosters, scoring configurations, round results and standings that you or your league admin create within the platform.
• Usage dataBasic server logs including IP addresses and request timestamps, retained for up to 30 days for security and debugging purposes.

We do not collect your iRacing password. Race data is fetched via the official iRacing data API using your publicly associated Cust ID.

3. How we use your data

We use the data we collect for the following purposes:

• Providing the serviceDisplaying standings, driver profiles, race results and league management tools.
• AuthenticationVerifying your identity when you sign in and keeping your session secure.
• Syncing iRacing dataFetching and caching your stats from the iRacing API so they are available on your dashboard.
• Service improvementDiagnosing errors and understanding how the platform is used at an aggregate level.
• CommunicationsSending transactional emails (e.g. password reset). We do not send marketing email without explicit opt-in.

4. Data storage and retention

Your data is stored on servers located within the European Union. All data in transit is encrypted using TLS 1.2 or higher.

We retain account data for as long as your account is active. If you request deletion of your account, your personal data (email, linked Cust ID) is removed within 30 days. Race statistics sourced from iRacing's public API are not considered personal data and may be retained in aggregate form.

5. Third-party services

LEAGR uses the following third-party services that may process your data:

• iRacingRace statistics and driver identity data are fetched from the official iRacing data API. iRacing's own privacy policy applies to that data at source.
• Amazon Web Services (AWS)Cloud infrastructure and hosting services. AWS is certified under the EU-US Data Privacy Framework.

We do not sell, rent, or trade your personal data with any third party for marketing purposes.

6. Cookies

LEAGR uses a single first-party cookie:

• leagr_id_tokenA session authentication token stored as a SameSite=Lax HTTP cookie. It is used to authenticate server-side requests and expires after 24 hours of inactivity.

We do not use advertising cookies, analytics cookies, or any third-party tracking cookies.

7. Your rights

Under UK GDPR and the Data Protection Act 2018 you have the following rights regarding your personal data:

• Right of accessYou can request a copy of the personal data we hold about you.
• Right to rectificationYou can ask us to correct inaccurate data.
• Right to erasureYou can request that we delete your account and associated personal data.
• Right to restrictionYou can ask us to limit how we process your data in certain circumstances.
• Right to data portabilityYou can request an export of your data in a machine-readable format.
• Right to objectYou can object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@leagr.app. We will respond within 30 days.

8. Children's privacy

LEAGR is not directed at anyone under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes we will notify users via the platform or by email.

Continued use of LEAGR after changes are posted constitutes acceptance of the updated policy.

10. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us: