Privacy

_Last updated: 13 November 2026_

This policy explains what personal information fpv-race-pits collects, why, who we share it with and the choices you have. It applies to fpv-race-pits.com, every club site we host (including club subdomains and clubs' own domains), the desktop app, the Discord bot and our APIs (the "Service"). It should be read with our Terms of Service.

Who we are

The Service is operated by Three Digital Llamas Pty Ltd, Queensland, Australia ("we", "us"). We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles, and we give visitors from the EU and UK the rights described below. You can contact us through the contact options at fpv-race-pits.com.

Clubs. Each club decides what it collects from its members and pilots (for example membership details and entry forms) and is responsible for that information as its own controller. We process it on the club's behalf to run the club's site. For questions about a club's use of your details, contact the club first.

Your data on fpv-race-pits

We keep what is needed to run race days: your account, your pilot profile and your results. Clubs you join see your membership details.

What we collect

• Account: name, email address, password hash or passkey, two-factor settings, language and time zone, and the sign-in method (including Google or Discord if you sign in with them).
• Pilot profile: pilot name, photo, country, clubs, gear and anything else you choose to add.
• Racing: entries, heats, laps, results and the video moments linked to them.
• Club and membership: the clubs you belong to, your role, membership details the club collects, and messages you send through club forms.
• Payments: a record of entries, memberships and subscriptions you pay for (amount, currency, status). Card details go straight to Stripe; we never see or store your full card number.
• Supporters: if you are a Crew member, your tier, status and wall choice. If you supported us on Buy Me a Coffee, we import your name, email, amount and message from it to thank you and to give members their Crew perks; your email is never shown publicly, and deleting your account erases it here.
• Technical: IP address, browser and device details, and security logs (sign-ins, audit entries), used to keep the Service secure and to stop abuse.
• Desktop app: the timing station's name, app version and the race data it syncs.

Why we use it

• to provide the Service you ask for — accounts, club sites, entries, live timing and results (performing our agreement with you);
• to take payments and run subscriptions (performing our agreement, and the club's agreement with you);
• to keep the Service secure, prevent fraud and enforce our Terms (our legitimate interests);
• to send service email such as sign-in links, receipts and race-day notices (performing our agreement); marketing email is off unless you opt in, and you can opt out at any time;
• to understand how the Service is used and improve it — only with your consent where analytics cookies are involved;
• to meet legal obligations, such as tax and accounting records.

Your choices

• Profile visibility: public, members only or private.
• Marketing email is off unless you opt in.
• Export everything about you, or delete your account, from your account page.
• Cookie settings: accept or reject analytics at any time from the "Cookie settings" link in the footer.

Results

Published results stay so that standings remain correct. If you delete your account, your results remain under "Former pilot" with no link to you.

Cookies and analytics

Essential cookies (always on)

These are needed for the Service to work and are not used for tracking:

• Session cookie — keeps you signed in.
• rp_anon — a random token that binds security (CSRF) checks to your browser before you sign in; kept for 30 days.
• Two-factor and trusted-device cookies — remember a two-factor step in progress and, if you choose, a trusted device.
• Passkey cookie — holds a passkey sign-in or set-up for a few minutes.
• frp_consent — remembers your analytics choice; kept for 6 months.

Google Analytics (only with your consent)

We use Google Analytics 4 to understand how the platform and club sites are used — but only after you accept analytics in the cookie banner. Until then Google's Consent Mode v2 is set to "denied" and no analytics cookies are set. If your browser sends Do Not Track or Global Privacy Control, we treat it as a rejection.

When you accept, Google sets the `_ga` and `_ga_<id>` cookies, and we set `frp_cid`, a random pseudonymous identifier (kept up to two years) that lets us report a purchase you complete — such as an entry or a subscription — to Google Analytics from our server, so it is counted once even if a browser extension blocks Google's script. Purchases by visitors who did not accept are never sent to Google. We never send your name, email address or account IDs to Google. We do send the page, the kind of event (for example "entry started" or "video played"), approximate amounts for purchases, and which club site and plan the page belongs to. You can change your mind at any time from "Cookie settings" in the footer; withdrawing consent stops further collection.

Our own analytics log

We keep our own first-party record of key events (such as sign-ups, entries and purchases) so we can see how the Service is doing independently of Google. It contains the event, time, club and plan and amounts, but no names or email addresses, and it is deleted after 90 days.

Who we share information with

We do not sell personal information. We share it only as needed to run the Service:

• Clubs you join or enter, which see your membership and entry details and your results.
• Stripe — payments. Club payments are processed on the club's own Stripe account (Stripe Connect), so the club and Stripe also handle that information as separate controllers. Our subscriptions and Crew memberships are processed on our own Stripe account.
• Amazon Web Services (Amazon SES) — sending email. SES tells us when an email bounces or is marked as spam; we then add that address to a suppression list so we stop emailing it.
• Discord — if a club connects the Discord bot, it posts race information (pilot names as shown on results) to the club's server; if you link your Discord account, we store your Discord ID so the club can give you roles.
• Buy Me a Coffee — we import supporters' details from it as described above.
• YouTube (Google) — race videos are embedded from YouTube (using the privacy-enhanced youtube-nocookie.com where we can). YouTube may set its own cookies when you play a video.
• Google (Gemini) — AI features send the text and images you submit to Google to produce the result. Don't include other people's personal information.
• Google Analytics — only with your consent, as above.
• Cloudflare — hosting, content delivery and security; it handles your IP address and requests on the way to our servers.
• Professional advisers, and authorities where the law requires it.

International transfers

Our providers may store and process information outside Australia, including in the United States and the European Union. We choose providers with appropriate safeguards (such as standard contractual clauses) and take reasonable steps to make sure your information is protected.

How long we keep information

• Account and profile: until you delete your account.
• Results: kept so standings stay correct, but unlinked from you when you delete your account ("Former pilot").
• Payment records: as long as tax and accounting law requires (usually 5–7 years).
• Analytics event log: 90 days.
• Security logs: as long as needed to protect the Service.
• Backups: kept for 14 days, then overwritten; deleted information disappears from backups within that time.

Security

We protect information with encryption in transit (HTTPS), hashed passwords, passkeys and optional two-factor sign-in, encrypted storage of third-party secrets, rate limits, access controls and regular backups. No system is perfectly secure; if a breach is likely to cause you serious harm we will tell you and the regulator as the law requires.

Your rights

You can:

• access and export your information from your account page;
• correct it in your profile and account settings;
• delete your account from your account page;
• withdraw consent to analytics from "Cookie settings" and to marketing email from any email or your account;
• ask us any question about your information, or ask for access or correction we don't offer on screen.

If you are in the EU or UK you also have the right to object to or restrict processing, to data portability, and to complain to your local data protection authority.

Children

You must be at least 16 to hold your own account. Younger pilots take part through a parent's or guardian's account as household pilots; the adult manages their details. Junior pilots' photos are not shown until a parent or club admin allows it.

Complaints

If you have a concern, contact us first through the contact options at fpv-race-pits.com and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or to your local data protection authority.

Changes to this policy

We may update this policy. We will post the new version here with a new date and, for material changes, tell you by email or on the Service before they take effect.