Privacy at Drivts

Translation for convenience. Only the German version of this privacy policy is legally binding. Read the German version

1Who is responsible

HeNoMedia, owner Henning Norden
Am Südhang 25c
24819 Todenbüttel, Germany
Email for privacy matters: datenschutz@kaltstart-racing.de

Drivts is a product of Kaltstart Racing, a channel of HeNoMedia.

2What Drivts is made of

Hosting. Website, portal, live channel, database and downloads run on our own platform on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the Helsinki (Finland) and Nuremberg (Germany) data centres. We have a data processing agreement with Hetzner under Art. 28 GDPR.

Encryption. All connections between your browser, your PC and our servers are encrypted (TLS).

3Visiting the website

What is processed. When you visit the website, our server processes technically necessary data: IP address, time, requested address, amount of data transferred, browser and operating system (from the user agent).

Purpose. Delivering the site and keeping operations secure, for example against attacks.

Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest is secure, working operation.

Retention. Our server does not log IP addresses. The other details are only processed for the duration of the request.

No tracking. We do not use any analytics, advertising or social media services. Fonts are hosted on our own server; no content is loaded from Google or other providers.

Cookies on the website. Only the language cookie from section 5.

4Account and sign-in

What we store.

• your email address
• your language
• if you create any: passkeys (public key, identifier, device type, a name such as “Linux x86_64”, identifier of the authenticator’s manufacturer). Your fingerprint or face image never leaves your device.
• if you set it up: the secret of your authenticator app (encrypted) and check values for your backup codes
• your sign-in sessions (validity, sign-in method). We do not store your IP address or browser for this.
• whether your access is activated and until when

Sign-in emails. To sign in, we email you a link that is valid for 15 minutes. We also send notification emails when something changes in your sign-in methods. The emails are sent via Resend (Resend, Inc., USA) acting as our processor, processed in Resend’s EU region in Ireland. For this, Resend receives your email address and the content of the email.

Abuse protection. To slow down mass sign-in attempts, we count requests per IP address and per email address. This happens in memory only and is forgotten after one hour.

Purpose. Providing your account and letting you sign in securely.

Legal basis. Art. 6(1)(b) GDPR (contract for the use of Drivts); for the abuse protection, Art. 6(1)(f) GDPR.

Retention. Until you delete your account. Sign-in sessions expire after 30 days without use, sign-in links after 15 minutes.

4aContact form

What we process. Your email address, your name if you give it, and your message. We forward them to ourselves by email (via Resend, see section 4) and do not store them in the portal’s database. Against mass abuse we count requests per IP address in memory only, for one hour.

Purpose. Answering your request.

Legal basis. Art. 6(1)(f) GDPR; for questions about a contract, Art. 6(1)(b) GDPR.

Retention. We delete the email once your request is dealt with and no retention obligation applies.

5Cookies and browser storage

We only set cookies that are necessary for the service. That is why we do not ask for consent (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act).

In your browser’s storage (localStorage), the portal also remembers whether you have turned on read-aloud and “keep screen on”. This stays on your device.

6The program on your PC

What stays on your PC. The program reads the Assetto Corsa telemetry through the game’s interface and stores it locally. The raw game data stays on your PC and is deleted there after 7 days. The program does not access your microphone, camera or files.

Pairing a device. When you pair the program with your account, we send the name of your PC (the computer name, which you can change in the portal). After that, the program checks in about every 10 minutes with its program version and operating system, so you can see in the portal which PCs are active.

Updates. About every 6 hours, the program asks get.drivts.com for a new version. Our server sees your IP address, but no identifier of your account. When Node.js is updated, the file is downloaded from nodejs.org (OpenJS Foundation, USA).

Purpose. Recording your training, linking the device to your account, keeping the program up to date.

Legal basis. Art. 6(1)(b) GDPR.

Unpairing. When you unpair a PC, the program deletes the local training data on that PC. It does the same on every paired PC as soon as it learns that your account has been deleted.

7Training data in the portal

What goes to the portal.

• Sessions: start and end, game, track, car, best lap, best drift, whether you or a guest drove, whether it was training, a check or the placement test
• Laps: time, gap, best time, position
• Traces per lap, about 20 values per second: speed, throttle, brake, clutch, handbrake, steering, gear, RPM, drift angle, slip angle, position and heading on the track, lap progress, time
• in tandem: position, heading and speed of the other car, without names
• Events: drifts, spins, laps, off-track moments, checks, tasks, placement test results, zones you create for a track, your best run as a “ghost”
• what the coach said: lines, tasks, debriefs and short coach notes about your patterns (for example “lifts completely off the throttle in most drifts”)
• AI costs per line (model, amount, price)

What does not go to the portal. Raw game data, chat, names of other drivers, data from other games.

Older sessions. Sessions you drove before pairing are only uploaded once you have agreed to it.

Guests. If someone else drives on your PC, you can mark the session as a guest session. Guest sessions also go to the portal and do not count towards your level. Please let your guest know, and delete the session if your guest asks you to.

Purpose. Showing you your history, level, streak and analysis, and letting the coach work with your progress.

Legal basis. Art. 6(1)(b) GDPR. For older sessions, additionally your consent in the program.

Retention. Until you delete the session or your account. Of a deleted session we only keep its identifier, so that your PC does not upload it again, and the AI costs as a cost record without driving data.

8Live channel

While you drive, the program continuously sends the status of your session to our live channel: track, car, level, goals, task, the coach’s latest lines, key figures of your drifts and the drift angle about once per second. That way you can see it in the portal, on your phone too.

The live channel writes nothing to the database. It keeps the status in memory and forgets it 10 minutes after you disconnect.

Legal basis. Art. 6(1)(b) GDPR.

9The AI coach

What the AI receives. After a drift, the numbers for it are sent to Anthropic’s language model Claude: your level and its goals, key figures of your drifts (for example entry, angle, length, countersteer), a short trace of throttle, brake, clutch, handbrake, steering and angle, the comparison with your last session and the coach’s notes from earlier sessions. In tandem, gap and role are added, without names.

What the AI does not receive. Your name, your email address, track, car, the names of other drivers.

Route. Your PC uploads the telemetry to our server. There we analyse your drift and send only the anonymous numbers to Anthropic, without your account identifier and without your IP address. Anthropic only sees our server and cannot link the numbers to anyone. The AI’s answer comes back to your PC through our server.

Recipient. Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, as processor. On the transfer to the USA, see section 10. According to its own terms, Anthropic does not use data from the API to train its models and deletes it after the periods set out in those terms.

Labelling. Everything the coach says or writes is labelled as AI (Art. 50 EU AI Act).

No decisions with legal effect. The coach does not decide anything that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). Whether a level is passed is calculated by the program from your measurements using fixed rules.

Speech output. The lines are read aloud by the speech output of your browser or operating system. Some browsers use online voices from their manufacturer for this. We have no influence on that; you can choose a local voice in your browser settings.

Legal basis. Art. 6(1)(b) GDPR. Without the AI there is no coach; it is the core of the service.

10Transfers to third countries

Anthropic is based in the USA, and Resend has its head office there. We base the transfer on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), where the provider is certified, and otherwise on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

All other data stays in the EU (Hetzner, Finland and Germany).

11Activation, operations and logs

Every account is activated by hand. For this we store which access applies until when. We log important events (sign-in email sent, passkey created or deleted, device paired, export, activation, access by an operator, account deletion) without email address and without name, with the time and the account identifier. Once your account is deleted, a pseudonym replaces the account identifier there.

Purpose. Tracing who did what and when, and detecting abuse.

Legal basis. Art. 6(1)(f) GDPR.

Retention. 12 months.

12How long we keep what

13Who receives data

We do not sell data and do not pass it on for advertising.

14Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20): in the portal under “Export” as CSV or ZIP, the traces of each session as CSV,
• object to processing based on legitimate interests (Art. 21),
• withdraw your consent, for example to uploading older sessions, with effect for the future (Art. 7(3)).

Do it yourself in the portal: export your data, delete individual sessions, manage passkeys, unpair devices, delete your account.

Deleting your account. In the settings under “Delete account”. You confirm with a code from your authenticator app or a backup code, or without an app through a link by email that is valid for 30 minutes. Deletion happens immediately: your account with all sessions, training data, devices, sign-in sessions, passkeys and the authenticator. You get a confirmation by email. All that remains is the activation and the AI costs under a pseudonym with no link to you (10 years), the log from section 11 with a pseudonym (12 months) and a check value of the device keys without link to the account (90 days), from which the program on your PC learns that the account has been deleted. If your account is suspended, write to us at datenschutz@kaltstart-racing.de and we delete it for you.

Complaints. You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

15Changes

When Drivts changes, we update this policy. The date at the top shows the current version.