Privacy policy

Hrechukh Taras Mykolayovych, a registered sole proprietor (ФОП) in Ukraine, registration number 3680404810, trading as GenRC, is the controller of the personal data described here. There is no separate company, no data protection officer required by size, and no advertising business behind GenRC — the product is what it appears to be.

Reach the controller about anything in this policy — a question, a request, a complaint — at tarash281@gmail.com.

GenRC collects only what the feature you are using needs. There is no advertising, no analytics tracking, and no data broker relationship of any kind.

• Account: your email address, a hashed password (or none, if you sign in with Google only), display name, handle, avatar, colours, country and language — kept to run your account and show it back to you.
• Garage data: your cars, batteries, inventory, setups, runs, lap times and maintenance records — the reason you have an account.
• Timing and events: results, applications, and if you run a venue, the sessions and passings its decoder reports.
• Sign-in security: the IP address and user agent behind a login, registration, password reset or contact-form attempt, kept briefly to throttle abuse and locked accounts — see the auth_attempts table referenced in this policy's retention section.
• Notifications: a browser push subscription, only if you turn notifications on, used solely to deliver the maintenance digest and similar alerts you asked for.
• Contact form: the topic, message, your reply-to address, and up to three photos you attach, emailed to our own inbox and never stored in the database — see the section on the contact form below.
• Payment (once billing is live): none of your card details reach GenRC. Paddle, as merchant of record, handles the transaction and tells GenRC only what plan you hold and when it renews.

For a visitor in the European Economic Area, the UK, or anywhere else a legal basis must be named, here is the basis for each purpose above:

• Account and garage data: necessary to perform the contract you enter by creating an account — Article 6(1)(b) GDPR.
• Sign-in security logs and the admin audit log: legitimate interest in keeping accounts and the service secure — Article 6(1)(f).
• Push notifications: consent, given when you turn them on, and withdrawable at any time from the same setting — Article 6(1)(a).
• The maintenance digest email: legitimate interest in the service actually doing what it is for, with an off switch in Settings that stops it outright — Article 6(1)(f).
• The contact form: legitimate interest in answering the message you chose to send — Article 6(1)(f).
• Billing, once live: necessary to perform the contract, and separately a legal obligation to keep records for tax purposes — Article 6(1)(b) and (c).

GenRC does not sell personal data, and does not share it for anyone else's marketing. Data reaches these processors only to the extent running the service requires:

• Supabase — the Postgres database everything above is stored in, and the object storage behind photos and avatars.
• Resend — sends transactional email: verification links, password resets, invitations, the maintenance digest, and contact-form messages.
• Railway — hosts the API and background jobs.
• Google — only if you choose to sign in with Google, to verify your identity. GenRC never sees your Google password.
• tarash281@gmail.com — the personal inbox contact-form messages are delivered to, until GenRC operates a dedicated support mailbox.
• Paddle — once billing is live, as the merchant of record for any paid subscription.

Ukraine is where GenRC is operated from. Supabase, Resend, Railway, Google and Paddle may process data in the European Union, the United States, or elsewhere their own infrastructure runs. Each relies on its own compliance mechanism — standard contractual clauses or an equivalent safeguard — for any transfer out of the EEA or UK, as published in that provider's own data processing terms.

GenRC sets exactly one kind of cookie: an httpOnly session cookie holding the access and refresh tokens that keep you signed in. It is strictly necessary — the app does not work without it — so no cookie banner asks for consent to it, the same way a banner would not ask permission to remember which page you are on.

There is no analytics cookie, no advertising cookie, and no third-party tracking script of any kind on GenRC.

Account and garage data is kept for as long as your account exists, and is deleted with it — see the section below on deleting your account.

Sign-in security logs are kept briefly, only as long as the throttling window they guard needs — on the order of minutes to hours, not months.

Contact-form messages and their photos are never stored by GenRC at all: they are emailed once and exist afterwards only in the recipient mailboxes above, under those providers' own retention.

The admin audit log — which staff action was taken, by whom, and when — is kept indefinitely as an accountability record, and does not include the content of what was changed beyond what the action itself already made public.

You can delete your account at any time from your profile, after confirming with your password (or your email address, for a Google-only account). Deleting it removes your cars, batteries, setups, runs, lap times, inventory and photos outright.

One thing is asked separately, because it affects other people: a finishing position you hold in a club's event results and championship table. A club's standings must not retroactively change because one entrant later left, so those rows are not deleted — you choose whether they keep your name (your own choice, made at the moment you delete your account, not the default) or show as "Deleted racer" instead. Either way, your account, and everything else about it, is gone.

Tracks and venues you added to the directory stay in it, the same way a shared road stays on a map after the person who first wrote it down moves away — nobody else should lose a venue because you left.

Depending on where you live, you may have some or all of the following rights over your data. Most of them are available directly in the product rather than by writing in:

• Access and portability — the CSV export on your profile, one dataset at a time: setups, runs, lap times, maintenance, inventory.
• Rectification — edit anything about your profile or garage directly.
• Erasure — delete your account, as described above.
• Restriction and objection — write in and we will act on the request within a reasonable time.
• Withdraw consent — turn off push notifications from the same setting that turned them on, at any time.
• Lodge a complaint with your local data protection authority, if you believe a request has not been handled properly.

GenRC is not directed at children under 13, and does not knowingly collect data from them — see the terms of service for the age representation every account makes at signup. If you believe a child has provided personal data to GenRC, contact tarash281@gmail.com and the account will be closed.

The version and date at the top of this page are the policy currently in force. A change that meaningfully affects how your data is handled is announced by email to accounts it affects; a purely editorial fix may be made without notice.