RecceLabPrivacy Policy
This policy explains what personal data RecceLab collects when you use the app at reccelab.com, why we need it and what you can do about it. We collect only what the app needs to work. We do not sell your data and we do not show ads.
Who we are
RecceLab is a pace note app for rally crews, developed and operated by an independent developer based in Cyprus ("RecceLab", "we"). We are the data controller for the personal data described here. You can reach us at any time at info@reccelab.com.
Data we collect
Account
Your e-mail address and password when you sign up with e-mail (the password is stored only as a secure hash by our database provider). If you sign in with Google, we receive your e-mail address and the basic profile details Google shares with us, such as your name and profile picture.
Profile and social features
Whatever you choose to add: user name, role (driver or co-driver), team, club, country, city, short bio and your cars (make, model, year, class). Also the people you follow, your friends, teams, events, posts, photos, comments, kudos and the reports you send about other users' content.
Stages, pace notes and tracks
The stages, pace notes, folders and settings you create; GPX tracks you import; and, when you record a recce, the GPS track of that recce. Recce notes and recce tracks stay private to you unless you share them with a friend.
Race runs
When you record a run in Race Mode we store its GPS trace (position, time and speed), duration, distance, average and top speed, car and co-driver. Race runs are public by default so they can appear in stage rankings; you can make each run private, and a private account hides all of them.
Location
Your device's precise location is used only while you are actively recording a recce or a race run, and only after you allow it in your browser or phone. We do not track your location in the background.
Video
Onboard videos you open from your device are processed inside your browser and are not uploaded to us. If you link a YouTube video, we store its video ID.
Notifications
If you turn on push notifications, we store your browser's push subscription (an address issued by your browser's push service and its keys) and your app language.
Payments
If you buy Premium, payment is handled by Google Play or by iyzico. For a card payment through iyzico we pass the name, surname, phone number, city and address you enter, together with your e-mail address, to iyzico to create the subscription; we do not store these details ourselves and we never see your card number. We store your subscription status, the payment provider's reference and the date until which Premium is active.
Data on your device
To work offline, the app keeps copies of your stages, notes and settings in your browser's storage (IndexedDB and local storage) and keeps you signed in with a session token. We use no advertising or analytics cookies and no third-party tracking scripts.
Technical data
Like any website, our hosting and database providers process technical data such as your IP address, browser type and request times in their server logs, to deliver the service and keep it secure.
Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and providing the app (stages, notes, tracks, AI drafts, video sync, sync between devices) | Performance of our contract with you |
| Using your location while recording, sending push notifications | Your consent, which you can withdraw in your device settings at any time |
| Social features, public profiles, race runs and rankings | Performance of our contract with you; you control visibility with the private account and per-run settings |
| Premium subscriptions and payment records | Performance of our contract; legal obligations (tax and accounting) |
| Security, preventing abuse and cheating, handling reports and removing content that breaks our Terms | Our legitimate interest in a safe, fair service |
| Answering your messages | Our legitimate interest; performance of our contract |
Who can see your data
On a standard account your profile, public race runs and posts are visible to other RecceLab users, and some of it (for example public runs and posts) can be opened through public links by people without an account. Your e-mail address is never shown to other users. If you switch to a private account, none of your profile, runs or posts are visible to anyone else. Stages and notes are visible only to you and to the friends you share them with.
Service providers
We use the following providers to run RecceLab. They process data only on our instructions or, where stated, under their own privacy policies.
- Supabase: database and sign-in (account, profile, stages, notes, tracks, runs, posts).
- Cloudflare: website hosting, photo storage and the e-mail address info@reccelab.com.
- Fly.io (Frankfurt, Germany): our pace note engine. When you ask for an AI draft, the track points of that stage are sent to it to generate notes.
- Google: Google sign-in, Google Play payments, and push delivery to Chrome and Android (Firebase Cloud Messaging). Other browsers use their own push services, for example Mozilla or Apple.
- iyzico: card payments for Premium on the web.
- OpenStreetMap map tiles and open routing services (OSRM, BRouter, Valhalla at openstreetmap.de): when you view a map or draw a route, the map area or the route points are requested from these services.
- YouTube: if you play a linked YouTube video, it is loaded in YouTube's player, which is subject to Google's privacy policy and may set its own cookies.
International transfers
Our providers may process data outside your country, including in the European Union and the United States. Where the law requires it, these transfers rely on safeguards such as the European Commission's standard contractual clauses offered by the providers.
How long we keep it
We keep your account data for as long as your account exists. Content you delete (stages, notes, runs, posts, photos) is removed from our database. When you delete your account, your personal data is deleted immediately and any active Premium subscription is cancelled, except records we must keep by law (for example payment records, for the period required by tax law). Server logs held by our providers are kept for short periods set by them.
Your rights
Depending on where you live (for example under the EU GDPR or Türkiye's KVKK), you can ask to access, correct, export or delete your personal data, object to or restrict certain processing, and withdraw consent. You can edit most of your data directly in the app and delete your account at any time under Menu → Settings → Account → Delete account (see how to delete your account). To exercise any other right, e-mail info@reccelab.com from the address linked to your account; we will reply within 30 days. You also have the right to complain to your local data protection authority.
Children
RecceLab is intended for users aged 16 and over. Younger users may use it only with the permission of a parent or guardian. If you believe a child has given us personal data without that permission, contact us and we will delete it.
Security
Connections to RecceLab are encrypted (HTTPS), access to your data in the database is restricted to your own account by access rules, and passwords are stored only as hashes. No system is perfectly secure, so please use a strong password that you do not use elsewhere.
Changes to this policy
If we change this policy, we will update the date at the top of this page. For significant changes we will also tell you in the app.
Contact
Questions or requests about your data: info@reccelab.com.