Privacy policy

What data Stout Racing Lab collects, why, who sees it, and how to get it deleted.

Last updated November 9, 2026

Who we are

Stout Racing Lab at stoutracinglab.com is run by Daniel Stout, a sole proprietor in Texas, United States. We're responsible for your personal data (the "data controller"). Contact: [email protected].

In short: we collect what's needed to run the service, we don't sell your data or show ads, the AI only sees summaries computed from your telemetry, and deleting your account deletes your data.

What we collect

Data	What it is
Account	Your email address and a salted hash of your password (Argon2id). We never store the password itself. Personal API tokens are also stored only as hashes.
Logins	When you log in: the time, your IP address and your browser's name, so you can see and sign out your logins and so we can spot abuse.
Uploads	Telemetry files (`.ibt`), setup files and setup sheets. An `.ibt` file includes iRacing's session information: car, track, setup, and the display names and iRacing IDs of you and the other drivers in that session.
What we compute	Laps, corners, tires, balance, driving metrics and reports derived from your uploads.
Text you write	Session notes, and the complaint you type when you ask the engineer (for example "loose on exit at turn 3").
AI results	The recommendations, tips and coach's notes produced for you, and what you marked as applied.
Credits and purchases	Your credit balance and history, and for each purchase the pack, amount, status and Stripe's reference numbers. No card details: those go only to Stripe.
Technical	Server logs (IP address, address requested, time) for running and securing the service; error reports (what went wrong, when, on which page, your browser's name, and which account) so we can find and fix problems; a Cloudflare Turnstile check at signup; and privacy-friendly, cookieless visit statistics from Cloudflare Web Analytics.
Google Analytics (only if you accept)	Which pages you visit and for how long, your device and browser, and your approximate location (from your IP address), with a random identifier stored in a cookie. Page addresses are sent without any session ids, email-link tokens or payment references. When you buy credits: which pack, its price and an order number, without your name, email or payment details. When you sign up: only that a sign-up happened, without your email address.

How we use it

To run the service you signed up for: processing uploads, showing results, running AI analyses, keeping your credit balance (for users in the EEA/UK, the legal basis is our contract with you).
To keep it secure: rate limits, abuse and fraud prevention, and stopping repeat claims of free credits (legitimate interest).
To handle payments and refunds and keep the records the law requires (contract and legal obligation).
To email you about your account: confirming your address, password resets and important service or policy changes. We don't send marketing emails without your consent.
To see how the site is used and improve it, with Google Analytics, only if you accept analytics cookies (consent, which you can withdraw at any time).

We don't sell your personal data, share it for advertising, or use it to build advertising profiles.

AI processing

When you ask the engineer or the coach, we send our AI provider, Anthropic, compact summaries our code computes from your session (per-lap and per-corner metrics), the setup values, our car and technique notes, and the complaint you typed. We don't send raw telemetry, your email address, or driver names.

Anthropic processes this as our service provider under its commercial terms, which don't allow it to train its models on this data, and keeps it only for a limited period under its own retention policy. Nothing is sent to the AI unless you start a run. More in how we use AI.

Who we share it with

Only the service providers that run parts of the service, each limited to what it needs:

Provider	What for	Data
Anthropic	AI analyses	Session summaries and your complaint text (see above)
Stripe	Payments, tax, receipts, refunds. Stripe is the merchant of record and handles payment data under its own privacy policy.	Your email address, the purchase, and the payment details you enter at checkout
Resend	Sending account emails	Your email address and the email's content
Cloudflare	Network delivery and protection, signup check (Turnstile), visit statistics	IP address and request details passing through its network
Google (only if you accept analytics cookies)	Google Analytics: how the site is used. Google processes this under its own privacy policy.	The usage data described above

Other drivers, only if you choose to share your laps. Lap sharing is off unless you switch it on in your account. When it is on, drivers with the same car on the same track can use the best lap of each of your sessions as a reference: they see your nickname (or an anonymous label such as "Driver 4821"), the lap time, the session date and the lap's speed, brake, throttle, steering and gear traces. They never see your email address, your setup, your other laps or your AI analyses. Switching sharing off removes your laps from other drivers' lists straight away (the legal basis is your consent, which you can withdraw at any time).

We also pool the setup values from uploaded sessions, without any link to your account or session, to learn which values each car's garage allows, so suggested setup changes can be checked. Nobody sees another person's setup (legitimate interest).

We may also disclose data if the law requires it, or to protect the service and its users from fraud or abuse. If the service is ever transferred to someone else, your data would go with it under this policy, and we'd tell you first.

How long we keep it

Account, uploads, results and credit history: until you delete them. Deleting a session removes its files and results; deleting your account removes everything in it.
Backups: deleted data is gone from the live service at once, and from our backups within 14 days.
Login records: kept with your account and deleted with it.
Server logs: rotated automatically; older entries are overwritten as new ones come in.
Error reports: each one is replaced by the next report of the same kind of error, and deleted once that kind of error hasn't happened for 90 days.
Free-credit check: after you delete your account, we keep a one-way fingerprint (hash) of your email address only to stop free introductory credits being claimed twice. It can't be turned back into your address.
Payment records: Stripe keeps its own records of purchases for as long as the law requires.

Cookies and storage

Login cookie: one essential cookie keeps you logged in. It can't be read by scripts and ends after 30 days without use, or 90 days at most.
Your preferences: your theme, units and language are saved in your browser's local storage. Your language is also saved with your account, so emails and AI answers use it.
Cloudflare may set essential security cookies, and Turnstile runs a check on the signup page.
Analytics cookies, only if you accept: Google Analytics sets _ga and _ga_… cookies (kept up to 2 years) to count visits. Until you choose, and if you decline, no Google code loads at all.

No advertising cookies. You can change your analytics choice at any time with Cookie settings at the bottom of the home page and of this page; declining removes the analytics cookies.

Your rights

You can delete sessions and your whole account yourself, on the session and account pages. You can also email us to:

get a copy of your data, or have it corrected;
have it deleted, or object to or restrict how we use it;
ask any question about this policy.

We answer within 30 days and won't treat you differently for using these rights. If you're in the EEA or UK, you can also complain to your data protection authority. If you live in a US state with a privacy law (such as California), you have these rights too; we don't sell or "share" personal information as those laws define it.

Where data is stored

The service runs on our own server in the United States. Our providers, Google included if you accept analytics cookies, may process data in other countries. For users in the EEA or UK, those transfers rely on the providers' legal safeguards, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Security

Passwords are hashed with Argon2id, secrets and tokens are stored only as hashes, all traffic is encrypted (HTTPS), every account can only reach its own data, and backups are kept on a separate disk. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

Children

The service isn't meant for children under 13, and we don't knowingly collect their data. If you believe a child under 13 has an account, tell us and we'll delete it.

Changes

If we change this policy in a way that matters, we'll email you or show a notice in the app before the change applies.

Contact

Privacy questions and requests: [email protected].