RaceSlot is software that somebody runs. The person or organisation running this deployment decides what it does with your data, which makes them its controller under the GDPR, and this policy is theirs.

Operator

Ricardo Silva

Contact

[email protected]

Write to that address to ask anything in this policy. If it says it is not set, the operator has not finished setting the service up, and you should ask whoever gave you your invite before creating an account.

RaceSlot registers you for an iRacing practice session, withdraws you again, and queues a session for later -- from your phone, from a series list, or from an overlay over the running sim. It is invite-only and free of charge.

RaceSlot never registers, withdraws or joins from a server. Every one of those happens on your own PC, in the iRacing client you signed in to yourself, carried out by a small Windows helper (RaceSlot Agent) that clicks through that client for you when you ask. To show you the series list and the session times, the server signs in to the iRacing website with a read-only sign-in and does nothing there but read.

Your account

• Your email address, which is your identity here, and your password as an argon2id hash with its salt. The hash cannot be turned back into the password, and nobody, the operator included, can read it.
• Optionally a display name (at most 80 characters) and a picture (a PNG of at most 64 KB). Both are shown on your own screens and in the desktop helper's account menu, and nowhere else.
• Which invite code you used, and when you signed up. The code is marked as spent against your account so it cannot be used twice.

Signing in, and the one cookie

• A session: an id, the hash of a random secret, and an expiry. Your browser holds the id and the secret in a cookie named irs_session, which lasts 30 days from the moment you sign in and is not extended by use. The server keeps only the hash, so a copy of the database cannot forge a session.
• Failed sign-in attempts, recorded against your email address and against the network address the request came from, so a wrong password cannot be tried without limit. They count for 15 minutes and are deleted within 24 hours. Sign-up attempts are recorded by network address alone, the same way, to stop invite codes being guessed.

Your racing setup, and what RaceSlot did for you

• The names you give your iRacing logins (labels of at most 80 characters), your favourite series and their order, and the car you chose for each. Nothing here is verified against iRacing; an iRacing customer id is kept only on accounts that were verified back when the app could still ask, and nothing writes one now.
• What you are registered for, as RaceSlot last recorded it: the series, whether it is a practice or a race, and since when. This is what stops a second registration being made on top of the first.
• Your queue: each session you asked for in advance, when it is due, what happened to it, and the trail of decisions the queue took about it (fired, deferred because the PC was off, missed, cancelled).
• Every registration attempt and how it ended -- the series, the kind, the outcome and the guard that refused it, if one did. The last hour of these is what enforces the ceiling of 20 actions an hour. They are kept for the life of your account.
• Every command sent to your PC and the helper's own words about what it saw when it carried it out -- including the text of the controls and rows the iRacing client showed it, which is how a failed click is diagnosed.

The desktop helper on your PC

RaceSlot Agent reads the iRacing client's own window through Windows UI Automation, the interface a screen reader uses, and clicks through it. It types nothing into that client but series names and car names. It never reads or sends your iRacing password, and it has no field for one. What it sends to the server is:

• The result of each command, with the evidence described above.
• Its own log, every few seconds, one line at a time (each at most 2000 characters). The log carries what the helper did, what the client showed, and the path of its own settings file -- which includes your Windows user name. Lines are deleted after 7 days, plus at most the 10 minutes between clean-ups.
• Calibration runs, if you press Calibrate: where the client's controls sat at several window sizes, as one document of at most 512 KB. Kept for the life of your account.
• A crash excerpt, if the helper ever ends without warning: the last forty lines of the fault report Python wrote, shipped once on the next start. Those lines carry file paths, and a file path on Windows carries your Windows user name.
• Your PC's computer name, sent once when you sign the helper in and kept as the label on its token, so a second PC can be told apart from the first.

On the PC itself the helper keeps a settings file (the server address, your email, the dry-run, tray and overlay preferences, and its polling token), the web session it uses for the Series and account panes -- encrypted with Windows DPAPI so only your Windows account on that machine can open it -- its calibration record, and the crash log. Nothing of the server's is written there; nothing on the PC is read but the iRacing client's window.

The server's own read-only iRacing sign-in

The series list and each favourite's practice and race times are printed on the iRacing members site and in no API this product can reach, so the server reads them there with a headless browser, about every 10 minutes. Whose sign-in it uses is the operator's choice, and there are two shapes:

• The operator's own iRacing account, the default. Its email and password live only in the server's environment, are never written to the database, are returned by no page and appear in no log. Your data is not involved: what is stored for you is the series list and the timers it read, the same facts for everybody.
• Your own iRacing sign-in, only when the operator has set none. You may enter your iRacing email and password on Setup, and remove them there at any time; removing them stops the reading. The email is stored in clear so the card can show which login it holds. The password is stored as an AES-256-GCM ciphertext under a key that lives in the server's environment and never in the database, so a copy of the database alone yields nothing -- but a copy of the database plus the environment yields the password. That is weaker than a password sealed under your own RaceSlot password, and it is the price of reading on a timer with nobody signed in. It is stated here rather than hidden.

Whichever sign-in is used, it reads and nothing else. No part of RaceSlot registers, withdraws, joins, buys or changes anything on iRacing through it; the code says so at the boundary, and it does nothing there but read.

Server logs

The server writes an operational log that Railway collects: boot lines, one line per read of the iRacing site, and the reason a read failed. It is written so as not to carry your data -- it names series, never people -- and the helper's shipped log is stored in the database, not printed there. Railway's own edge keeps request logs (addresses, paths, times) under its own retention, which the operator does not control.

• To provide what you asked for (contract, GDPR article 6(1)(b)): your account, your sessions, your favourites and cars, the commands to your PC, the queue, and the series list and timers shown to you.
• To keep the service safe and working (legitimate interest, article 6(1)(f)): the sign-in rate limits, the record of attempts behind the hourly ceiling, the helper's log, calibration runs and crash excerpts. The interest is diagnosing a failed click on a machine nobody else can see; you can end the log by stopping or uninstalling the helper.
• Your own iRacing sign-in, when you add one (consent, article 6(1)(a)), withdrawn by removing it on Setup.

RaceSlot sets exactly one cookie, irs_session, and only once you sign in. It is strictly necessary -- it is what makes you signed in -- and it is marked HttpOnly, Secure and SameSite=Strict, so no script can read it, it never travels over plain http, and no other site can send it.

There is no analytics, no advertising, no tracking pixel and no third-party script of any kind; the fonts are served from this site. Because nothing optional is ever set, there is no cookie banner to click through: the law asks for consent only for what is not strictly necessary, and here there is nothing of that sort.

• The operator, who runs the server and can read its database and the helper's shipped log -- which they do to diagnose a problem you report.
• Railway, which hosts the server and its database as the operator's processor, in europe-west4 (the Netherlands, in the European Union). The database is one file on a volume there.
• iRacing receives what your own client sends when the helper clicks, exactly as if you had clicked -- from your PC, never from this server. The server's read-only sign-in sends iRacing the operator's credentials (or, in the fallback shape, yours) and reads pages.
• Cloudflare, which answers the domain name and, when the operator has its proxy switched on, also carries your requests to and from Railway as the operator's processor. Carrying them, it sees what any carrier sees -- your IP address and each request's headers, which it keeps in its own security logs under its own retention -- and handles the rest only in passing; it stores no page and no form you send. It never holds the database, your password hash or the stored iRacing sign-in. With the proxy off, the name resolves straight to Railway and Cloudflare sees only the lookup.

Nobody else. Nothing is sold, shared for advertising, or sent to anyone not named here.

• Your account and everything filed under it: until you delete the account.
• A session: 30 days from sign-in, or until you sign out.
• Failed sign-in and sign-up attempts: counted for 15 minutes, deleted within 24 hours.
• The helper's log lines: 7 days, plus at most the 10 minutes between clean-ups.
• Registration attempts, commands, the queue's trail and calibration runs: the life of the account. They are not expired on a timer, and this policy says so rather than implying otherwise.
• The series list and the timers: replaced by each new read.

Under the GDPR you may ask to see the data held about you, to have it corrected, to have it deleted, to receive a copy in a portable form, to have its processing restricted, and to object to processing based on legitimate interest. Where you gave consent, you may withdraw it.

• See and correct: your name, picture, labels, favourites and cars are all on Setup. Your email cannot be changed on a screen; write to the operator.
• Delete: Setup has a Delete your account control. It asks you to type your email, and it removes the account and everything filed under it at once -- labels, favourites, cars, sessions, the helper's tokens and log, the queue, every recorded attempt and command, and any stored iRacing sign-in. It refuses while you are still registered for a session (withdraw first; deleting the record would not take you out of the session on iRacing) and while your PC is in the middle of a command. The invite code you used stays spent.
• Anything else, or a deletion you cannot do yourself: write to [email protected]. The operator answers within a month.
• Complain: to the supervisory authority where you live. For Portugal that is the CNPD, the Comissão Nacional de Proteção de Dados (cnpd.pt).

Passwords are hashed with argon2id. Sessions and the helper's tokens are stored hashed, so a stolen database is not a stolen sign-in. Everything travels over https, with HSTS, and every page carries a content security policy that lets only this site's own scripts run. Sign-in and sign-up are rate-limited. The operator's own iRacing credentials are held in the server's environment only. The helper refuses to talk to any server address that does not begin with https://, and on the PC it keeps its web session under Windows DPAPI.

What that does not cover, said plainly: the fallback iRacing password can be recovered by somebody holding both the database and the server's environment; the helper's polling token sits in a plain settings file on your PC, readable by anything running as you there; and the helper's log ships automatically while it runs.

RaceSlot is not for anyone under 16, and no account should be created for them.

The version and the date at the top change whenever a promise in this policy changes. The operator will tell account holders about a change that matters before it takes effect.