Privacy

The short version

• Signing in uses Discord, and asks for the smallest scope on offer: your user ID, display name and avatar. Not your email. StintLab has never had it.
• There are no passwords.
• Live telemetry is never saved to disk. It sits in memory while people are watching your room and disappears when the server restarts.
• No analytics, no trackers, no ads, no scripts from other sites.
• You can delete all of it yourself, from your account menu.

What gets stored

If you sign in

Sign-in is Discord OAuth using the identify scope, which is the smallest Discord offers. It doesn’t include your email, your servers or your messages. What’s kept against your account:

• your Discord user ID
• your Discord display name
• the URL of your Discord avatar
• when the account was made, and when it was last used
• any companions you pair: each one’s PC name, install ID, when it was paired and last used, and a fingerprint of its key (never the key itself)
• your notifications (the newest 50: room invites, joins, race starts, companion news) and which kinds you want on the site or by Discord DM

Plus a session token in a cookie so you stay signed in. It tells the server which account you are and nothing else.

You don’t have to sign in. Rooms, plans and the companion all work signed out. Signing in is what makes your rooms, rates and teams follow you between devices.

Plans and rooms

A room holds the plan you made: race length and start time, tank size, fuel, energy and tire rates, lap times, the stints and tires, and the driver names you typed into the roster. Those names are whatever you chose to type. Nothing checks or requires real ones, and a roster of nicknames works just as well.

If you set up a Discord webhook for stint reports, the webhook URL is stored with the room so reports can be sent. Remove it from the room and it’s gone.

Short messages sent between Dashboard screens (“Box this lap”, a driver’s note) are kept with the room too, the last 20 of them, and cleared when a new race starts. The Debrief adds nothing: it is worked out from the stints already in the room.

Rooms are deleted 60 days after anyone last touched them. A room you’ve saved to your account is kept until you unsave or delete it.

Live telemetry

While the companion is running it posts your car’s state to your room: position, lap, fuel, energy, tire wear, and the standings the game reports. That’s what lets everyone watching see the same thing at the same time.

None of it is written to disk. The server keeps the most recent packet per room so a browser opening the page has something to show, and each new packet overwrites the last. There is no history of it and it doesn’t survive a restart. Deleting the room clears it straight away.

Saved rates and teams

Rates you save for a car and track come back next time you race that combination. A team stores its name, its owner, its members, and the rates those members chose to share with it.

Race results and ratings

Upload LMU results files (from the Account page, or a paired companion after a race) and the Safety Score and Pace Rating are worked out from them. A results file covers the whole field, so only your own rows are kept, matched by your in-game name: your class, car, finish, laps, stints, lap times, incidents, spins, track-limits entries and penalties. The other drivers’ names, laps and incidents, and all chat, are dropped as the file is read; an incident with another car keeps only its time and how hard it was, not who it was with. The file itself is not kept, only a fingerprint of it so the same file isn’t counted twice. Only multiplayer race and qualifying files are taken.

Bug reports and suggestions

Report a bug or suggest a feature and it keeps your message, the room code and page you were on, your browser’s version string, and the time. The version string is there because “it looks wrong on my phone” is hard to chase without knowing which browser.

If you’re signed in, the report also keeps your account, so you can see our replies under My reports. If your account is linked to Discord, a bug report is also posted publicly in the bug forum on the StintLab Discord, mentioning you, so we can follow up there.

If a page hits an error, your browser sends us an anonymous error report (the error message, the script and line, the page address without its room code, the site and browser version and the window size) that is kept for 7 days and never includes your account or anything you typed.

If you click Send log to StintLab in the companion, it sends its recent log (the last 2 MB) with your Windows user name, emails, IP addresses and tokens removed. We keep the last 5 logs per account for 7 days, and attach the log to your open bug report in Discord.

Your IP address isn’t recorded. It used to be, out of habit. Nothing ever read it and it was removed in version 2.7.3.

What never gets stored

• Your email. The sign-in scope doesn’t include it.
• Passwords. There aren’t any.
• Payment details. The Buy me a coffee link takes you to Buy Me a Coffee, who handle all of it under their own terms. StintLab isn’t told who paid and never sees a card number.
• Your IP address, beyond the moment it takes any web server to send a reply back to you.
• Anything else off your computer, other than the game telemetry the companion reads while you have it open, and results files you or your paired companion upload.

Who else sees it

Nobody, apart from three things you choose and one that never identifies you:

• Discord, when you sign in, and when you set up a webhook that sends your stint reports to a channel.
• Anyone with your room code. That’s the point of a room code. Treat it like a password for the plan: whoever has it can see the plan and the live telemetry while a session is running.
• Your teammates, for rates you share with a team.
• Partner sites, through a read-only API: anonymous combined lap statistics per car and track (tire wear, fuel and energy use, pace through a stint, wet pace), each a median from at least five drivers. Never names, accounts or any single driver’s values.

Compare cars shows lap statistics from saved runs, grouped by pace: each number is the median of the drivers in that pace group, shown without names or accounts. A group can hold a single driver, and then its numbers are that driver’s.

Leaderboards show your in-game name (or Discord name), car, lap times, lap count and date for each track and class you have clean laps at. Every paired account shows.

Your Safety Score and Pace Rating (the tier, score, band and km counted, never the incident list) can show next to your name on leaderboards.

Your Discord avatar and rating badges show next to your name where it appears on the site: leaderboards, teams, room rosters, the live timing and relative tables when your in-game name is in the session, and notifications you send (an invite). Other drivers in a session who have no StintLab account never get an avatar or badge. The avatar image loads from Discord’s image server (cdn.discordapp.com), so the browser showing it contacts Discord for the picture.

The rating charts on the Account page show how many drivers fall in each score range: aggregate counts only, with no names or single drivers’ values. Until enough accounts have a rating, the charts use counts per range worked out once from the race files of recent lobbies; only those counts are kept, never the drivers’ names or results.

Nothing is sold, and no advertiser, data broker or analytics provider is involved in any part of this.

Deleting it

Your account page has Delete my account under Account settings. It removes your user record, your sign-in sessions on every device, your saved rates, your saved room list, your paired companions, your race results and ratings, and your team memberships. A team you own passes to another member, or is deleted if you’re the only one in it.

Rooms are separate, because a room belongs to whoever has the code rather than to an account. Delete a room from the room itself, or leave it and it ages out after 60 days.

If something won’t delete, or you want to know what’s held against your account, ask in the Discord. That’s the contact route for this project and it reaches a person.

Where it lives

StintLab runs on one rented server. Traffic to the site is encrypted in transit. The data above sits in files on that server.

There is very little here worth stealing: no emails, no passwords, no payment details, no addresses. Even so, don’t put anything in a roster or a room name you would mind seeing elsewhere, and share your room code deliberately.

Children

StintLab isn’t aimed at children and doesn’t knowingly hold data from anyone under 13. Signing in needs a Discord account, which has its own minimum age.

EU, UK and California

Those laws give you rights over your data: to see it, correct it, take it elsewhere and have it deleted. Account deletion covers the last one. For the rest, ask in the Discord and it gets done by hand.

The basis for holding any of it is that you asked for the thing it’s for. An account exists because you signed in. A plan exists because you made one. Delete it and it’s gone.

When this changes

Anything that changes what’s collected, or who sees it, gets written up in What’s new, and the date at the top moves. There is no mailing list, because there are no email addresses.