Privacy Policy

1. Who we are

Death Race Tracking is the website deathracetracking.com and the Death Race Tracking mobile app. It is run by Ian Peppiatt, trading as Lethargic Imp, in the United Kingdom. Ian is the data controller, which means he decides how your personal data is used and is responsible for it.

We are registered with the Information Commissioner's Office (ICO). Our registration number is ZC106342. For anything to do with your data, email [email protected].

2. What we collect

We only collect what we need to run Death Race Tracking.

• When you sign in: you sign in with Google or Discord. They send us your email address, your name (Google) or username (Discord), your profile picture and an account ID. We never see or store your password.
• Your profile: your display name, your country if you choose to add it (so you can appear on regional leaderboards), a profile picture if you upload one, your time zone and your display settings.
• Your activity: the films you mark as watched, when and where you watched them, your ratings, notes, picks and predictions, your library, the badges you earn, and the people you add as friends or block.
• Imports: if you import your viewing history from Letterboxd, the data you upload so we can match it to films.
• Payments: payments are handled by Stripe. We keep a Stripe customer ID, what you paid for, the amount, the date and your subscription status. We never see or store your card details.
• Newsletter: whether you have subscribed.
• Technical data: your IP address, browser and device type, and the time of each request. These are kept in server logs for security and to find faults. When someone opens a shared list link, we record their IP address and browser.
• Analytics: only if you turn Analytics on, which pages are visited, the type of device used and the country visited from. This is not linked to your account.

3. What other people can see

• Leaderboards are public. They show your display name, your avatar, your country if you have added one, and how many films you have watched. If you have not set a display name, we show an anonymous handle such as "User 8f3ca1" and never your real name.
• Friends: people you add as friends can compare their progress with yours.
• Public profile: this is off by default. If you turn it on, anyone with your link can see the sections you choose to show. You can change the sections, replace the link or turn the profile off at any time on your Profile page.
• Picks and predictions: these are private unless you create a link to share them.
• Ratings: your ratings count towards the average rating shown for each film, without your name.
• Notes: your notes are always private.

Your email address is never shown to other users.

4. How we use your data

Data protection law says we need a lawful reason for each use of your data. These are ours.

• To provide the service you signed up for (contract): signing you in, saving what you have watched, running races, taking payments, managing subscriptions, and sending account emails such as receipts and renewal reminders.
• Because you said yes (consent): sending you the newsletter, measuring how the site is used, and showing adverts. All three are off until you turn them on, and you can turn them off again at any time.
• Because we have a good reason that does not override your rights (legitimate interests): showing you on leaderboards, keeping the site secure, preventing abuse and fixing faults.
• Because the law requires it (legal obligation): keeping records of payments for tax.

5. Who we share your data with

We do not sell your data. We share it only with the companies we need to run Death Race Tracking, and only as much as each one needs.

• Railway (a US company; our servers and database are in the EU): hosts the site, the database and uploaded profile pictures.
• Cloudflare (US): protects the site from attacks and delivers it quickly. All traffic to the site passes through Cloudflare.
• Google and Discord (US): sign you in.
• Stripe (US): takes payments and manages subscriptions.
• Postmark (US): sends account emails, such as receipts and renewal reminders.
• Kit (US): sends the newsletter. If you subscribe, Kit holds your email address and first name.
• Umami (EU): analytics, only if you turn Analytics on.
• Google AdSense (US and EU): adverts on free accounts, only if you turn Marketing on.
• TMDB (US): film posters and images load from TMDB's servers, so TMDB sees your IP address. We do not send TMDB anything from your account.

We may also share data if the law requires us to.

6. Sending data outside the UK

Some of these companies are based in the United States. When your data is sent there, it is protected by the UK-US Data Bridge or, where a company is not covered by it, by the UK's International Data Transfer Agreement or Addendum.

7. How long we keep your data

• Your account, profile and activity: for as long as you have an account. When you delete your account, they are removed from the live site straight away and from our backups within 30 days.
• Payment records: for 6 years, held by Stripe and in our accounting records, because UK tax law requires it.
• Newsletter: until you unsubscribe.
• Server logs and shared list records: for up to 90 days.

8. Your rights

You have the right to:

• see the personal data we hold about you
• have anything inaccurate corrected
• have your data deleted
• get a copy of your data in a format you can take elsewhere
• object to uses based on legitimate interests
• ask us to limit how we use your data in certain circumstances
• withdraw consent at any time

You can do some of this yourself on your Profile page. Export my data downloads the films you have watched, with dates and ratings. Delete account permanently deletes your account and everything in it.

For anything else, email [email protected]. We will reply within one month. If a request is complicated, we may need up to two more months, and we will tell you if so.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Age

Death Race Tracking is for people aged 16 or over. We do not knowingly collect data from anyone under 16. If you believe a child has an account, email us and we will delete it.

10. Security

All traffic to the site is encrypted. Sign-in is handled by Google or Discord, so we never hold a password. Access to the database is restricted to us.

If a data breach puts your rights at risk, we will report it to the ICO within 72 hours where the law requires, and tell you without undue delay.

11. Cookies

Our Cookie Policy lists the cookies we use and explains how to change your choices.

12. Changes to this policy

We update this policy when the way we use your data changes. If a change is significant, we will tell you by email or with a notice on the site. The date at the top of the page shows the latest version.

13. Contact us

If you have any questions, email [email protected].