Privacy notice — TrackDayR Competitive Hub

1. Who is responsible (controller)

MadCow srl, Piazza Martiri della Libertà, 31 – 27036 Mortara (PV), Italy — VAT number IT02815500182.
Contact for anything about your data: ale@trackdayr.com.

2. What this notice covers

This notice covers the TrackDayR Competitive Hub (“the Hub”), the website and installable app that shows the results of the game TrackDayR. It concerns two groups of people:

all TrackDayR players whose results appear on the Hub, also if they never visited it or signed in (section 3);
people who sign in to the Hub with their Steam account (sections 4 and 5).

3. Players' public game data (also if you never signed in)

What we show. For each result published in the game's leaderboards: the player's Steam display name and avatar, their Steam identifier (SteamID64, visible in the address of rider pages), the time or score, the position, the bike and class used, the results of official tournaments and the TDR XP points of the world ranking.

Where it comes from. From the leaderboards of TrackDayR published on Steam by Valve Corporation, read through the Steam Web API. Display names and avatars come from the public part of Steam profiles, which Steam always shows to everyone. The Hub does not combine this data with other sources.

Why, and on what legal basis. To show the game's official competitive results — leaderboards, rankings, tournaments and rider pages — to the TrackDayR community. The legal basis is our legitimate interest, and that of the community, in following the game's competitions (Art. 6(1)(f) GDPR). We weighed this interest against the players' rights: the data are the same that the game and Steam already publish; players who post a time expect it to appear in the game's rankings; we show nothing more than is needed to recognise a result (no contact details, no location, no activity tracking); we do not use the data for advertising or profiling and do not sell it; and every player can object easily at any time.

How long. The Hub does not keep its own archive of these data: it reads them from Steam and keeps temporary copies in memory, for at most about 24 hours. When a name, avatar or result changes or disappears on Steam, the Hub follows within that time.

Your right to object. If you do not want to appear on the Hub, write to ale@trackdayr.com with your SteamID64 or the link to your Steam profile. We may ask you to confirm that the Steam account is yours. Once your request is accepted, your name and avatar are replaced by “Hidden rider” on every page of the Hub, you no longer appear in name searches and your rider page is closed. We handle requests without undue delay and at the latest within one month. Your results stay in the leaderboards as anonymous rows, so that the positions of the other players remain correct. The leaderboards inside the game and on Steam are not part of the Hub: requests about the game itself can be sent to the same address.

4. If you sign in: your Hub account

Steam identifier (SteamID64) received from Steam when you sign in, used to identify your Hub account and link it to your game results.
Public Steam display name and avatar address, read from your public Steam profile and kept to show your profile.
Hub settings you choose (profile visibility, preferred disciplines, notification topics).
Session data: a random session identifier (stored only as a hash), creation and expiry time.
Activity log: security-relevant events on your account (sign-in, sign-out, settings changes, privacy requests, notifications switched on or off), without IP addresses.

We do not ask for or store your real name, postal address, phone number, e-mail address or Steam password. IP addresses are used only in memory, for a few minutes, to limit abuse (rate limiting): they are not stored, and our web server does not keep access logs with IP addresses.

5. Notifications (optional)

You can ask the Hub to send notifications to your phone or computer (for example when someone beats one of your times, or when an official tournament is announced, starts or is about to end). They are off until you switch them on in Settings and allow them in your browser.

What we keep: for each device where you switched them on, the push address created by your browser, the encryption keys the browser provides, the language of the texts, the date of the last delivery; the topics you chose; and, for the “time beaten” notice, your last known position and time on each leaderboard, to notice when they change.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with “Turn off on this device” in Settings or in your browser's settings; the push address of that device is then deleted.
Delivery: notifications travel through the push service of your browser's maker (for example Google for Chrome, Apple for Safari and iPhone, Mozilla for Firefox, Microsoft for Edge on Windows). That service receives the push address and an encrypted message that it cannot read.

6. Summary of purposes and legal bases

Showing the game's public results (section 3) — legitimate interest, Art. 6(1)(f) GDPR.
Providing the Hub features you request when signed in (account, profile, dashboard, settings) — performance of the service you asked for, Art. 6(1)(b) GDPR.
Notifications — consent, Art. 6(1)(a) GDPR.
Security, abuse prevention and integrity of the service — legitimate interest, Art. 6(1)(f) GDPR.
Anonymous visit statistics (section 7) — legitimate interest, Art. 6(1)(f) GDPR.

The Hub makes no automated decisions with legal or similarly significant effects. Positions and points come from the game.

7. Cookies and storage on your device

The Hub uses only technical cookies that are strictly necessary: a session cookie to keep you signed in, a short-lived cookie (10 minutes) that protects the Steam sign-in process and, only if you choose a language, a preference cookie (tdr_lang, 12 months) that remembers it. No advertising, analytics or profiling cookies are used, and no third-party tracking scripts are loaded.

Visit statistics. To know how many people use the Hub and where they come from, after each page your browser sends us, without cookies, the address of the page, the name of the website you came from (for example instagram.com: only the name of the site, not the full address) and the campaign label contained in the link (for example utm_source=tiktok). We keep only daily totals per page, not individual visits, and nothing that identifies you or your device. If you have switched on “Do Not Track” or “Global Privacy Control” in your browser, nothing is sent.

Your browser also keeps, only on your device and without sending them to us, two small notes: that you have seen the guided tour, and whether you closed the “add to Home Screen” hint on iPhone/iPad. To receive notifications and to be installable, the Hub registers a small script in your browser (a “service worker”); it does not store pages or track your browsing.

8. How long we keep data

Sessions expire after a configured period (default 7 days) and are then deleted.
Activity log entries are deleted after a configured period (default 90 days).
Your account is kept until you ask us to delete it (it is then deleted after a short review period, normally 7 days), or until nobody has signed in to it for 24 months: it is then deleted automatically.
Notification data are deleted when you switch notifications off, when you ask for the deletion of your account, or as soon as your browser's push service reports that the device no longer accepts them. Your last known positions are deleted when you switch off the “time beaten” topic or the last device.
Objections under section 3 are kept as long as they apply, so that you stay hidden.

9. Who receives data, and where

Hosting: the Hub runs on servers of OVHcloud (OVH SAS, France) located in the European Union. OVHcloud processes data only on our behalf, under a data processing agreement (Art. 28 GDPR).
Valve Corporation (Steam, United States) performs the sign-in and is the source of the game data shown on the Hub; to read it, the Hub sends Steam identifiers to the Steam Web API. Valve participates in the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023. When you use Steam, Valve's own privacy policy applies.
Push services (section 5): they are chosen by your browser, not by us, and operate under the privacy terms of your browser's maker. They receive only the push address and an encrypted message they cannot read; they may process data outside the European Economic Area.

We do not sell data and do not share it for advertising. We protect the data we keep with encrypted connections (HTTPS), session identifiers stored only as hashes, restricted server access and regular backups.

10. Children

The Hub is meant for people who may hold a Steam account. If you are under 14, ask a parent or guardian before signing in or turning on notifications (Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code).

11. Your rights

You can access and download your Hub data and request the deletion of your Hub account from the Settings page. You also have the right to rectification (your name and avatar come from Steam: change them there), restriction, objection (section 3), and to withdraw consent to notifications at any time. For any request, write to ale@trackdayr.com. Deleting your Hub account does not delete the official results stored in the game's leaderboards on Steam. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.

12. Changes

We will publish any change on this page and update the date below; important changes will also be announced on the Hub. Last updated: 17 October 2026.