Privacy Policy

GTelemetry dashboard, GTelemetry Recorder app and gtelemetry CLI · Last updated 18 October 2026

The short version

We collect what's needed to run your account and analyse your laps: your email, username, password (stored hashed), and the telemetry you record or upload.
If you register interest before you have an account, we keep only your email and the platforms you picked, and use them only to send your invite.
No adverts, no analytics, no tracking, no cookies. We don't sell or share your data.
The Recorder app only records the telemetry your PlayStation®5 sends. It never records your screen, video or voice.
You can delete your account at any time from the dashboard. If you do, your recorded laps are kept only in anonymised form, to help improve GTelemetry. See Deleting your account.

Who we are

GTelemetry is run by Steve Cavanagh (“we”, “us”), the data controller for the personal data described here. Contact us about privacy at privacy@trackandsim.com.

This policy covers the dashboard at app.trackandsim.com, this website, the GTelemetry Recorder app for Android, iPhone and iPad, and the gtelemetry command-line tool.

What we collect and why

Data	Why	Legal basis (UK/EU GDPR)
Account details: email address, username, optional display name, password (stored only as a salted scrypt hash), sign-up date	To create your account and sign you in. Your username and display name are shown to people you add as friends. Your email isn't shown to anyone.	Contract
Age: your date of birth, asked at sign-up	To check you're 13 or over and give under-18s safer settings. We use it once and don't store it. If you're under 18 we keep only the date you turn 18.	Legal obligation and legitimate interests (protecting children)
Telemetry you record or upload: Gran Turismo® 7 and Project CARS 2 data (car position, speed, inputs, lap times, car and track), RaceBox GPS files (track position, speed, G-forces, the RaceBox device's serial number and the session date and time)	To store your sessions in your Library and show you the analysis, maps and replays.	Contract
Paired devices: the name you give each phone or computer, its platform, when it was paired and last used	So you can see and remove the devices that can upload to your account.	Contract
Friends, messages and shared sessions	To deliver messages and shared sessions to the friends you choose. A shared session is a copy that goes into your friend's Library once they open it.	Contract
Blocks and reports: who you've blocked or declined, and any report you make (the reason, your comments and a copy of your recent messages with that person)	To stop unwanted contact, and so we can review reports and act on them, for example by disabling an account. The person you block or report isn't told.	Legitimate interests (keeping users safe)
Your preferences: theme, display settings, which sessions were open	To restore the dashboard the way you left it.	Contract
Interest list: your email address, the platforms you'd like to record with, when you registered and when you confirmed. If you register interest before you have an account, we ask you to tick “I'm 13 or older”; we don't ask for a date of birth until you sign up.	To confirm your request and email you an invite when an account is ready. Your platform choices help us decide which recorder to release first.	Consent (you can withdraw it at any time with the link in our emails)
Server logs: IP address, time, and the address of each request	To keep the service secure and working (abuse prevention, rate limiting, fault finding).	Legitimate interests

We don't collect your contacts, photos, location, advertising identifiers or payment details. We don't use your data for advertising or profiling.

Emails. We only email you about your account or a request you made: if you register interest, a link to confirm it and your invite when your account is ready; a link to confirm your address when you sign up, password-reset links, a notice when your password changes, and confirmation when your account is deleted. There's no marketing and no newsletter. They come from noreply@trackandsim.com.

The Recorder app and the CLI

Camera: only to scan the pairing QR code on the dashboard. No images are stored or sent.
Local network: to find your PlayStation®5 on your home Wi-Fi and receive its telemetry. That traffic stays on your network until the recording is uploaded to your account.
Notifications and background running (Android): to keep recording while the screen is off and show that a recording is in progress.
On your device: your sign-in token (in the Android Keystore or iOS Keychain), the server address, your PlayStation®5's IP address, recordings waiting to upload (removed once uploaded, unless you turn on keeping a copy), and a diagnostics log that never leaves the phone unless you send it to us yourself.
The gtelemetry CLI stores its sign-in token on your computer and uploads only the sessions you record or choose to upload.

Cookies and browser storage

The dashboard uses no cookies. It keeps your sign-in token and display settings in your browser's local storage, and, if a sign-up is refused because of age, a note of that for 24 hours. These are strictly necessary for the dashboard to work and are never used for tracking. Signing out removes the token. The website and dashboard load no third-party scripts, fonts or trackers.

We don't sell your data or share it with advertisers or data brokers. It's only handled by:

Our hosting provider, Namecheap, Inc., whose servers in the United States store the service and its data on our behalf, and whose Private Email service sends our account emails.
Apple and Google, when you download the app from the App Store or Google Play, under their own privacy policies. We receive no personal data from them about you.
Friends you choose: your username and display name, and the messages and sessions you send them.
Authorities, only if the law requires it.

Where data is processed outside the UK or EEA, we rely on the safeguards the law requires, such as adequacy regulations or standard contractual clauses.

How long we keep it

Account, sessions, devices, friends and messages: until you delete them or your account.
Unopened shared sessions: removed after 14 days.
Unconfirmed interest: deleted after 7 days.
Confirmed interest: until we send your invite, then until you create your account or 30 days after the invite, whichever is first. If we haven't invited you within 12 months, we delete it. You can remove yourself at any time with the link in any of our emails, or by emailing privacy@trackandsim.com.
Reports: deleted automatically 2 years after they're resolved, so repeated problems can be spotted in the meantime, including after an account is deleted. A report that's part of a police or child-safety case is kept until that case no longer needs it.
Server logs: kept short-term for security and fault finding, typically no more than 30 days.
Backups: deleted data can remain in our backups for up to 90 days, until they are deleted.
Anonymised laps kept after account deletion (below): indefinitely, because they no longer identify you.

Deleting your account

Sign in at app.trackandsim.com, open the account menu (your name, top right) and choose Delete account…. You'll be asked for your password and your username to confirm. If you can't sign in, email privacy@trackandsim.com from your account's email address and we'll do it for you.

When you delete your account:

Your account details, preferences, paired devices, friendships, blocks, messages and share records are deleted, and you're signed out everywhere. Your paired apps stop working.
Sessions you shared that a friend has already opened stay in their Library, because they're their copies, but they no longer show your name. They show “Deleted user”.
Your username stays reserved so nobody else can take it and pretend to be you.
Your recorded laps are kept in anonymised form to help us develop and improve GTelemetry, for example its lap analysis and coaching. Before we keep them, we remove everything that links them to you: they are taken out of your account, and we strip the recording date and time, the RaceBox device serial number and the app or device details. What's left is the driving data itself: the track, car, lap times and the line driven. You can't recover anonymised laps, and they can't be linked back to you.

If you'd prefer your laps not to be kept even anonymised, delete your sessions from your Library first (each delete is permanent), then delete your account. Want your own copy? Download your sessions from the Library before you delete anything.

Your rights

Under UK and EU data-protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. You can download your recordings from the dashboard at any time. For anything else, email privacy@trackandsim.com and we'll reply within one month.

If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data-protection authority, though we'd appreciate the chance to sort it out first.

Security

All connections use HTTPS. Passwords are stored only as salted hashes. Each paired device has its own token that you can revoke from Devices…. Access to the servers is restricted to the operator.

Children

You must be 13 or over to use GTelemetry. Sign-up asks for your date of birth to check this. We don't store it, and we don't knowingly collect data from children under 13. If you think a child under 13 has an account, contact us and we'll delete it.

For 13–17-year-olds, friend requests from other people start switched off (you can still add people yourself, and switch requests on under Friends). Conversations that include someone under 18 are for sharing laps only: no typed messages or notes in either direction. Everyone can block and report other users.

Changes to this policy

If we change this policy we'll update the date at the top. If it's a significant change, we'll tell you in the dashboard before it takes effect.