PaceFinder

Privacy & Cookie Policy

Last updated: April 2026

PaceFinder is a sim racing analytics tool. We collect only what is necessary to provide the service. We do not sell your data, share it with advertisers, or use it for any purpose other than running and improving PaceFinder.

1. Who we are

PaceFinder is an independent project. For privacy questions, contact us via the feedback form inside the app or at hello@pacefinder.app.

2. Data we collect

We collect only what you provide directly or what is generated by your use of the service:

  • Account information — email address, display name, and a hashed (bcrypt) password. We never store your password in plain text.
  • Race session data — circuit, date, lap times, finishing position, car, and lobby type extracted from screenshots you upload. This data is tied to your account.
  • Waitlist email — if you join the waitlist, we store your email address and your position in the queue.
  • Usage analytics — anonymous page views and basic interaction events via Umami Cloud (no cross-site tracking, no personal identifiers, only loaded with your consent).
  • Feedback submissions — messages you submit via the feedback form, including your display name and email for follow-up.

3. How we use your data

Your data is used exclusively to:

  • Provide and operate the PaceFinder service
  • Send transactional emails (account verification, password reset, alpha invites)
  • Understand how the product is used so we can improve it
  • Respond to feedback you submit

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.

4. Data storage and security

Your data is stored in Upstash Redis (managed cloud database). Passwords are hashed with bcrypt before storage. Authentication uses short-lived, HttpOnly, Secure JWT cookies that are never accessible to JavaScript.

We retain your account data for as long as your account exists. Race session data is stored indefinitely until you delete it or your account. You can delete individual sessions from the dashboard, or delete your account entirely via Settings.

5. Third-party services

ServicePurposePrivacy
VercelHosting & deploymentPolicy
UpstashDatabase (Redis)Policy
ResendTransactional emailPolicy
Umami CloudAnonymous analyticsPolicy
Cloudflare TurnstileBot protection (feedback)Policy
Anthropic ClaudeScreenshot parsing (Spotter)Policy

Screenshot images sent to the Spotter feature are processed by Anthropic's API and are not stored by PaceFinder after the session data is extracted.

6. Cookies

We use a minimal set of cookies:

CookieTypePurpose
pf_sessionStrictly necessaryKeeps you logged in. HttpOnly, Secure. Expires with session or after 30 days.
pf-cookiesPreferenceRemembers your cookie consent choice. Stored in localStorage.
_umami_*AnalyticsAnonymous visitor identifier used by Umami. No personal data. Only set with your consent.

The auth cookie (pf_session) is strictly necessary for the service to function and does not require consent under ePrivacy rules. Analytics cookies are only active after you accept.

7. Your rights

Depending on where you are located, you may have rights including:

  • Access — request a copy of the data we hold about you
  • Deletion — delete your account and all associated data via Settings, or contact us
  • Correction — update your display name and email via Settings
  • Objection — opt out of analytics at any time via the cookie banner

To exercise any of these rights, use the feedback form in the app or email us at hello@pacefinder.app.

8. Children

PaceFinder is not directed at children under 16. We do not knowingly collect data from anyone under 16.

9. Changes to this policy

We may update this policy as the service evolves. Material changes will be communicated via email to registered users. The “last updated” date at the top of this page reflects the most recent revision.

© 2026 PaceFinder · Forza Motorsport is a trademark of Microsoft.

← Home