Privacy notice

The contact address below starts working once laptrack.co.uk moves to its new account (from 5 October 2026). Until then, ask the person who invited you to LapTrack.

The short version

We keep your email, your password (scrambled so nobody can read it), your driver name and your lap times.
Other signed-in drivers can see your driver name next to your best laps, your record dates and your tips. They never see your email.
Don't put your real name, school, age or social media in your driver name or your tips.
You can delete your account and everything in it at any time, from the Home screen.
If you're worried about anything, ask a parent to contact us.

This notice explains what Lap Track Karting collects, why, who can see it, and what your rights are. It applies to the whole app and this website.

Who is responsible

Guy Goodall is the data controller: the person responsible for your data. LapTrack is a free, non-commercial app run for drivers at UK TeamSport tracks.

What we collect

Account: your email address, a salted and peppered PBKDF2 hash of your password (not the password itself), whether you have confirmed your email address, and the driver name you choose. Until you choose one, other drivers see you as "Unnamed user". Your email address is never shown to other drivers.
Race data: the tracks, session types, dates, kart numbers and lap times you save, and any yellow or black flags you mark on laps.
Kart reports and tips: your verdict on a kart, with an optional note of up to 140 characters, and track tips of up to 300 characters.
Sign-in: a hashed login token, and temporary hashed 6-digit codes that prove you own your email address when you sign up or reset your password.
IP address: every request reaches us through Cloudflare, which sees your IP address. To stop abuse we count sign-in attempts and code requests per IP address and per email address, and saves, posts and board views per account. These counters are stored as hashes, not in plain text.

What is stored on your device

One HttpOnly session cookie, lt_session, used only to keep you signed in. No analytics or advertising cookies.
In your browser's local storage: your account email and driver name, a copy of your saved sessions, any sessions saved while signed out, your home track and home name, and whether you have seen the latest update message.

Signing out ends the session cookie but leaves the copy of your sessions, your home track and your home name in that browser. Deleting your account removes the account's copy. On a shared device, clear the site's data in your browser settings after signing out.

Without an account, your sessions stay only in your browser and are never sent to us. Signing in syncs them to the cloud and enters your best laps into leagues and track records.

Why, and our lawful basis

We use your data to save and recall your lap history, show your progress and stats, and run leagues, track records and track boards for signed-in drivers. Our lawful basis under UK GDPR is legitimate interests: running the app you chose to sign up to. Because many drivers are under 18, we keep what other people can see to a minimum (see below), and signed-out visitors see no race data at all.

Who can see what

Your saved sessions are private to you, apart from the owner view below.
Anyone with a LapTrack account (anyone can sign up) can see, under your driver name: your best laps and number of races on leagues; your track records, with the date of that race; how many laps, yellow flags, kart reports and tips you have posted, on the track boards; and the text of your tips.
Kart reports are shown to other drivers only as totals per kart. Your name and note are not shown with them.
People who are not signed in see none of this.
The app's owners have an owner view. For each driver it shows the driver name, the date they joined, whether their email is confirmed, how many sessions, laps, kart reports and tips they have, their best lap and when they last uploaded. It also lists the latest 200 uploads with driver name, track, session type, kart, date, best lap, number of laps and upload time. It does not show email addresses.
The app's maintainers can reach the database and its backups, which hold everything above, including email addresses.

Other people's names in the app

The track records page shows reference lap times reported on gkrt.co.uk, with the name of the driver who set each one. These drivers are not LapTrack users, and we hold nothing else about them. If one of them is you and you want your name removed, contact us.

Who we share it with

Cloudflare: hosts the app and its database, and sees the IP address of every visit.
Resend: sends sign-in codes. It receives your email address and the code, and nothing else.
GitHub (Microsoft): holds the nightly database backups, which only the app's maintainers can reach.
Google Fonts: when you open the app, your browser loads its fonts from Google, which sees your IP address.
jsDelivr: when you upload a screenshot, your browser loads the text-reading (OCR) library from jsDelivr, which sees your IP address. The screenshot itself is read on your device and is not sent to jsDelivr.

Cloudflare, Resend, GitHub and Google are based in the United States and may process data outside the UK. Those transfers rely on the safeguards these companies provide under UK law, such as the UK–US data bridge or the UK's international data transfer addendum. We do not sell your data or use it for advertising.

How long we keep it

Account, race data, kart reports and tips: until you delete them or your account, or ask us to.
Login sessions: valid for 30 days. Expired ones are removed the next time you sign in, or when you delete your account.
Sign-in codes: valid for 10 minutes. Expired codes are removed the next time anyone asks for a code.
Abuse counters (hashed IP address, email or account): removed once they are more than a day old, each time anyone asks for a sign-in code.
Nightly backups: 30 days.

Your rights (UK GDPR)

Access: ask us what we hold about you.
Correction: change your driver name and delete saved sessions in the app. A single tip or kart report cannot yet be edited or deleted in the app. Ask us and we will do it.
Deletion: to delete your whole account, open Home, choose "Delete my account" and type DELETE. This removes your account, sessions, laps, kart reports, tips, driver name and sign-in data at once, and cannot be undone. Hashed abuse counters are cleared within about a day, and backups holding your data expire within 30 days. If we ever restore the database from a backup, we will delete again any account that was deleted after that backup was taken.
Objection and restriction: you can object to how we use your data, or ask us to pause using it.
Complaints: if you are unhappy with how we handle your data, contact us first. You can also complain to the Information Commissioner's Office at ico.org.uk.

Contact: [email protected]

Children

The app may be used by drivers under 18. We don't verify age. A parent or guardian can contact us to see, correct or delete a child's data. We ask drivers not to use their real name, school, age or social media handles in driver names, kart reports or tips.

Changes to this notice

We'll update this page if what we collect or how we use it changes. Last updated 4 October 2026.