Plain language: what we keep, why, and how you stay in control.
This policy is a template and still has to be reviewed by the site owner before it is relied upon.
The controller of your personal data is the owner of this site, who can be reached through the GitHub repository. Undercut is a non-commercial hobby project run on a self-hosted server.
Browsing the site needs no account and stores nothing about you. If you create an account, we keep:
| Data | Purpose |
|---|---|
| E-mail address | Sign-in, account verification, password reset and the opt-in race e-mail. |
| Display name | Shown next to your picks on leaderboards and in private leagues. |
| Password (stored only as a salted hash) | Signing in. The plain password is never stored. |
| Preferences (theme, e-mail opt-in) | Remembering your settings. |
| Favourites (drivers, teams, circuits) | Showing them on your pages. |
| Predictions and league membership | Running the prediction game and scoring it. |
The legal basis is performing the service you asked for (your account and the game) and, for the race e-mail, your consent, which you can withdraw at any time.
There are no tracking cookies, no analytics and no advertising. The only cookies are the session cookie and the CSRF cookie, which are strictly needed to keep you signed in and to protect forms. Your theme choice is kept in your own browser storage and never sent to us.
We send e-mail only for address verification, password reset and, if you switch it on in settings, the race e-mail with your prediction score. Every race e-mail has a one-click unsubscribe link.
Account data is kept while your account exists and removed when you delete it. Backups of the database are kept for at most 30 days, so deleted data disappears from backups within that time. Public statistics (results, standings) are not personal data and are kept.
You can download a copy of your data and delete your account at any time in settings. Deleting removes your profile, favourites and predictions.
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format and to withdraw consent. To use a right that settings does not cover, open an issue on the GitHub issues page without including personal details. You may also complain to your national data protection authority (in Poland, the President of the Personal Data Protection Office, UODO).