Privacy Policy

Last updated 8 October 2026

The short version. Your telemetry is yours, and nobody else can read it unless you decide they can. You are asked which you want the first time you sign in, there is no default, and private means private — not other drivers, not SectorLoom administrators. That is enforced by the database itself rather than by a setting we promise to honour. We do not run advertising, we do not use analytics or tracking services, and we do not sell anything about you to anybody.

Who we are

Operated by SectorLoom, based in Virginia, United States. For anything in this policy, including a request to see a copy of what we hold or to have it deleted, write to our support address.

What we collect

Your account

Your email address and a password, handled by our authentication provider. We never see your password; it is stored only as a cryptographic hash, which cannot be turned back into the password.
The driver name you choose, which your teammates see on rosters and events.
Optionally, the driver profile you fill in: licence class, safety rating, what you race, your timezone, and whether you are open to being approached by teams. All of it is optional and you can clear it at any time.
Your answer to the sharing question, and when you answered it.

What you upload

Telemetry sessions. When you add a .ibt file, your browser reads it and sends us the result: lap times, the traces we chart (speed, throttle, brake, steering, gear and the rest), position around the lap, sector times, the car and track the session was run on, the conditions the game reported, and the setup label.
Car setups you save, and the names you give them.
Teams you create or join, their rosters and roles, and the events on their calendars.
Messages you send through the app.

Payment

Card details never reach SectorLoom. Payment is handled entirely by Stripe on their own pages. We store what we need to know whether your membership is current: a Stripe customer and subscription identifier, the plan, the status, and the date it renews or lapsed.

Technical

Our hosting and database providers keep ordinary server logs, which include IP addresses, for security and debugging. We do not combine these with your account to build a profile of you.

What we do not do

No advertising, and no advertising networks.
No analytics product, no tracking pixels, no session recording, no fingerprinting.
No tracking cookies. The app keeps your sign-in token and your own display preferences in your browser's local storage, which is not sent to anyone else and is cleared when you sign out.
We do not sell, rent or trade personal information, and we do not share it for anybody else's marketing.

Who can see your driving data

You decide, and we ask before anything is shared. The first time you sign in you are asked to choose between keeping your laps private and publishing them to the community. There is no pre-selected answer and no default: until you answer, your laps are private.

Whichever you choose, the rule is written into the database as a row-level security policy, which means it is applied to every request before any data leaves the server, whatever the app happens to ask for.

Private

Other drivers cannot see your sessions, laps or setups.
SectorLoom administrators cannot see them either. There is deliberately no administrator exception on telemetry; an administrator can manage accounts and nothing else.

Shared with a team

Separate from the choice above, and one session at a time. Turning on sharing for a session makes that single session readable by people in teams you belong to, and nobody else. Turning it off takes it away again.

Published to the community

If you choose this, every signed-in member with a current membership can find your sessions by track and car, open the full traces — speed, throttle, brake, steering and the rest — and load them alongside their own laps. Your driver name is shown with them.
It applies to the sessions you have already uploaded as well as the ones you upload next.
Switching back to private removes them again immediately, including from anybody who had the list open. We cannot undo what somebody has already looked at or written down, which is true of anything published anywhere.
Published laps stay published if your membership lapses — the choice is yours to change, not something we revoke. Suspended accounts drop out of the community listing.

Either way

Your driver name, and any driver profile you fill in, are visible to other signed-in drivers. That is the point of the team board, and it is why every field on it is optional.
Nothing you publish is sold, used for advertising, or handed to anybody outside the site.

Who we use to run the service

These are the only companies that handle your data on our behalf. Each is bound by its own agreement with us to process it only as instructed.

Provider	What it does	What it handles
Supabase	Database, file storage, sign-in	Your account, profile, telemetry, setups, teams and messages
Cloudflare	Serves the website itself	Ordinary request logs, including IP address
Stripe	Payments and subscriptions	Your card details, which they hold and we never see, and your billing email

The desktop uploader runs on your own machine. It watches the telemetry folder you point it at and sends finished sessions to your SectorLoom account. It does not read anything else on your computer and it talks to nobody but SectorLoom.

Where your data is held

Our database and file storage run in the region we selected with Supabase when the project was created; Cloudflare serves the site from locations worldwide. If you are outside the United States, your information will be processed there.

How long we keep it

Your account and everything in it: for as long as the account exists.
If you ask us to delete your account, we remove your profile, telemetry, setups and team memberships within 30 days. Messages you sent to other people may remain in their copy of the conversation, shown as from a deleted account.
Records we are required to keep for tax and accounting — invoices, essentially — are kept for as long as the law requires, typically seven years.

Your rights

Wherever you live, you can ask us to show you what we hold about you, correct it, give you a copy, or delete it. If you are in the UK, the EEA, or a US state with its own privacy law such as California, those laws give you these rights explicitly, along with the right to complain to your data protection authority. We do not charge for any of it and we will not treat you differently for asking.

Write to our support address and we will deal with it within 30 days. At the moment deletion is done by hand rather than by a button in the app; the request is all that is needed.

Children

SectorLoom is not for children under 13, and we do not knowingly collect anything from them. If you are under 18, a parent or guardian needs to agree to the terms on your behalf. If you believe a child under 13 has created an account, write to our support address and we will remove it.

Security

Traffic is encrypted in transit. Access to your data is restricted at the database level rather than only in the app, which is the part that matters: a bug in the website cannot hand somebody else your telemetry, because the database refuses the request. No system is perfect, and we will tell affected people promptly if something goes wrong.

Changes to this policy

If we change it in a way that matters, we will say so on the site and update the date at the top. Carrying on using SectorLoom after that means you accept the new version.

Contact

Questions, requests and complaints all go to our support address.