Privacy

The short version

• You don't need an account to use Overcut.
• We collect as little as we can: how the site is used, reports of errors, and what you choose to give us, such as feedback or the email address you sign in with.
• We don't sell personal data, and Overcut has no advertising.

What we collect and why

When you visit

Like any website, our servers and hosting providers receive technical details with each request: your IP address, your browser or device, and the pages you ask for. We use them to serve Overcut, keep it secure and stop abuse (for example, limiting how many requests one address can make). They're kept only briefly, in logs. We rely on our legitimate interest in running a secure, working service.

Usage analytics

On the website and in the app we use PostHog, hosted in the EU, to understand how Overcut is used: the pages and screens visited and some actions, such as opening a live timing or watch link, following a series, driver or team, or signing in. PostHog stores a random identifier (in a cookie and your browser's storage on the website, on your phone in the app) so it can tell visits apart. While you're signed in, we link that activity to your account's number, never your name or email address, so we can see how Overcut is used over time; signing out starts a new random identifier. We use this to decide what to improve, relying on our legitimate interest in improving Overcut.

Error reports

When something goes wrong on the website, in the app or in our servers, Sentry (hosted in Germany) receives a report of what failed, on which page or screen and in which browser or device. For errors on the website, the report includes a replay of that visit (what was on screen and what was clicked) so we can see what happened. Form fields are masked. Sentry works out a rough location (city and country) from your connection's IP address and keeps that, not the address itself, and we've set it not to collect account details. We rely on our legitimate interest in fixing problems.

Feedback

If you send feedback, we receive your message, the page you sent it from and, if you give them, your name and email address. We use them to read and reply to it, relying on our legitimate interest in hearing from people who use Overcut.

Accounts

An account is optional (following series, drivers and teams, and notifications, are on their way). If you make one, we keep:

• your email address, and a name if you choose to give one;
• a profile photo, if you add one or sign in with Google (see below). We crop it square and save a fresh copy, so details stored inside the file, such as where a photo was taken, aren't kept;
• the devices you've signed in on (the name of each and when it was last used), so you can sign one out;
• your passkeys' public keys, if you use passkeys. Your fingerprint, face or device PIN never leaves your device;
• if you sign in with Google or Apple, the identifier and email address they give us;
• if you turn on two-step verification, its secret key (encrypted) and your recovery codes, so we can check the codes your authenticator app shows.

The first time you sign in with Google or connect it to your account, if your account has no photo yet, we copy your Google profile photo and keep it as your account's photo. We store our own copy rather than loading it from Google each time, so Google doesn't learn when it's shown. Apple doesn't share a photo. You can change or remove your photo at any time in your account settings; removing it deletes it, and we won't copy it from Google again.

Your name and photo are shown to you, when you're signed in. Overcut doesn't show them to anyone else. Photos are stored with the rest of Overcut's images, at an address that can't be guessed.

We use these to provide your account, which is the contract between us. Sign-in emails are sent through Resend. You can delete your account at any time in its settings, which deletes it with its photo, sign-ins and passkeys.

Stored on your device

The website and apps keep a few settings on your device, such as which results you've revealed during a race weekend, “Always show results”, your light or dark theme, and on the website your recent searches. They stay on your device and aren't sent to us.

Live streams and links

Live streams are YouTube videos, embedded through youtube-nocookie.com, so YouTube doesn't store information about you until you play one. Once you do, Google's privacy policy applies to it. Links to live timing and broadcasters take you to other sites, whose own policies apply.

Who helps us run Overcut

These providers process personal data for us, only as we instruct them to:

• Laravel Cloud hosts our servers, database and stored files, such as profile photos.
• Vercel hosts the website.
• PostHog provides the usage analytics.
• Sentry receives error reports.
• Resend sends our emails, such as sign-in codes and account notices.
• Expo delivers updates to the apps (and, later, their notifications).

Google and Apple are involved only if you choose to sign in with them (and Google's photo is copied only as described above). We share personal data with anyone else only if the law requires us to.

Some of these providers are based in, or use services in, the United States. Where personal data leaves the European Economic Area, it's protected by the safeguards the GDPR requires, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

• Server logs: briefly, for security and troubleshooting.
• Analytics and error reports: for the limited periods set in PostHog and Sentry.
• Feedback: until we've dealt with it and no longer need it.
• Account data: until you delete your account.

Your rights

You can ask us for a copy of the personal data we hold about you, and ask us to correct it, delete it, restrict how we use it or send it to you in a portable form. You can also object to our using it on the basis of our legitimate interests. Write to privacy@overcut.com and we'll reply within a month.

If you're unhappy with how we've handled your data, you can complain to Ireland's Data Protection Commission at dataprotection.ie, or to the data protection authority where you live.

Children

Overcut is for a general audience. Accounts aren't intended for children under 16.

Changes

When this policy changes, we'll update the date at the top. If a change is significant, we'll tell account holders before it takes effect.