Privacy Policy

TrackSims (tracksims.com) is run as a sole proprietorship based in Canada ("TrackSims", "we", "us"). It is not a company; the operator of the site is an individual. We are the data controller for the personal data described in this policy. This policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have over it.

Contact for privacy matters: tracksimsf1@gmail.com

Account data. When you create an account, we collect your email address and a hashed password (or, if you sign in via a supported provider, the identifier that provider shares with us — for Google sign-in, that is your email address, your name, and your profile picture). Authentication is handled by our infrastructure provider Supabase. If you joined with an invite code, that code and the email address that redeemed it are stored alongside your account.

Usage data. We record how the site is used: the address of each page you open, including anything after the "?" in it, the page title, the address you arrived from, when you opened it, and how long you stayed. Each record also carries a random identifier stored in your browser's local storage, so a later visit from the same browser can be recognised as a return visit. If you are signed in, each record carries your account email address and can be read back for your individual account. If you are signed out, no name or email is attached — only that browser identifier.

These records contain no IP address. Our hosting provider works out an approximate location from your IP address — country, region, city, an approximate latitude and longitude, and time zone — and we store that location with the record, never the address itself. They also carry the user-agent string your browser sends with every request, which we use to tell automated traffic apart from people. Device is recorded as one of three values — mobile, tablet or desktop — taken from the width of your browser window.

We separately use Vercel Web Analytics, which is aggregated and anonymous, and which also derives approximate (country/region-level) location from your IP address.

Google Analytics. We also use Google Analytics 4. When you visit, Google Analytics sets cookies on your device and collects information such as the pages you view, how you arrived, how long you stay, your device and browser, and an approximate location derived from your IP address. Google processes this data to provide us with reports. It does not receive your name or account email from us. You can stop it by blocking cookies for this site or by installing Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Technical data. Standard technical information sent by your browser — IP address, browser type, device type, and operating system — is processed in server logs by our hosting and database providers for security and to operate the site. When you ask the site to render a high-quality graphic, your IP address is passed to our rendering service for rate limiting and held there in memory for ten minutes.

Communications. If you contact us, we keep the correspondence and your contact details for as long as needed to handle your request.

We do not knowingly collect special categories of personal data, and we do not collect payment card details ourselves. There is no payment or billing system on the Service today. If we offer paid features in the future, payments will be handled by a third-party payment processor, which will collect your payment details under its own privacy policy; we would receive only limited information such as subscription status.

• To provide the Service — creating and maintaining your account, signing you in, and delivering features you request. Legal basis: performance of a contract.
• To secure and operate the Service — preventing abuse, debugging, and maintaining logs. Legal basis: our legitimate interest in running a secure, reliable service.
• To understand usage — records of which pages and features are used, including per-account records for signed-in members, so we can improve the product and support you. Legal basis: our legitimate interest in improving the Service.
• To communicate with you — service emails about your account (e.g. sign-in and account confirmation emails) and replies to your enquiries. Legal basis: performance of a contract / legitimate interest. Any marketing email would be sent only with your consent, which you can withdraw at any time.
• To comply with law — where processing is necessary to meet a legal obligation.

We do not sell your personal data, and we do not share it with third parties for their own advertising. We share data only with service providers (processors) who help us run the Service:

• Supabase — database hosting and authentication (stores account data).
• Vercel — website hosting and privacy-focused web analytics, and the approximate location described in Section 2.
• Google — Google Analytics 4, which receives the information described in Section 2.
• Railway — runs the service that renders graphics on request, and receives the IP address described in Section 2.
• A payment processor — only if and when paid features are offered.

These providers process data on our instructions under data processing agreements. We may also disclose data where required by law, or in connection with a merger, acquisition, or sale of assets (in which case this policy would continue to apply to your data or you would be notified of changes).

Our service providers may store or process data in countries outside your own, including the United States. Where data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision.

• Account data — for as long as your account exists. There is no delete-my-account button on the site: to have your account removed, email us at the address in Section 12 and we will remove it by hand and confirm when it is done. We may keep data longer where a legal obligation requires it.
• Usage data — kept indefinitely. Nothing expires the page and event records described in Section 2, and while you are signed in those records carry your email address. Email us if you would like yours removed.
• Google Analytics data — held by Google, which deletes event records (each page view and interaction) after two months and data tied to a browser identifier after fourteen months without activity.
• Server logs — held by our hosting and database providers under their own retention periods.
• Correspondence — kept as long as needed to handle your request and for a reasonable period afterwards.

Depending on where you live, you have some or all of the following rights over your personal data:

• to access a copy of the personal data we hold about you;
• to correct inaccurate data;
• to delete your data ("right to be forgotten");
• to restrict or object to processing, including processing based on legitimate interests;
• to receive your data in a portable format;
• to withdraw consent at any time, where processing is based on consent;
• to complain to your data protection authority (in the EEA/UK, your local supervisory authority).

California residents (CCPA/CPRA): you have the right to know what personal information we collect, to request deletion or correction, and to not be discriminated against for exercising these rights. We do not sell or "share" (for cross-context behavioral advertising) personal information as those terms are defined in the CCPA.

To exercise any of these rights, email tracksimsf1@gmail.com. There is no automated tool for this on the site — every request is handled by hand, and we may need to verify your identity first. We will respond as promptly as we can, and within any period the law that applies to you requires.

We use reasonable technical and organizational measures to protect personal data, including encryption in transit, hashed passwords, and access controls on our database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is not directed at children and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

For details of the cookies and similar technologies we use, see our Cookie Policy.

We may update this policy from time to time. We will post the updated version on this page and update the "Last updated" date; for material changes we will provide additional notice, such as email to account holders.

TrackSims is contactable by email. Privacy questions and requests: tracksimsf1@gmail.com