Privacy policy

seasonr.app is run by an individual, not a company. For the purposes of the GDPR they are the data controller, and for Quebec’s Law 25 they are the person responsible for the protection of personal information.

Reach them at [email protected] for any question about this policy or any request below.

The only way to create an account is Discord. seasonr.app asks Discord for two permissions, identify and email, and stores what they return:

• Your Discord display name — shown to the owner and admins of a league you join or ask to join. Results and standings do not use it: they show the driver name the league’s admins entered.
• Your email address — the unique identifier for your account. It is not displayed to other users and no marketing is sent to it.
• Your Discord avatar — stored as the image URL Discord provides, not a copy of the image.
• Discord access and refresh tokens — issued by Discord so the sign-in can be completed and renewed. They are never shown to anyone, including you.

No password is ever collected, because email and password sign-in is deliberately disabled. seasonr.app cannot read your Discord messages, servers or friends list; the two permissions above do not grant that.

Created by using the site:

• Session records — a session token, its expiry, and the IP address and browser user-agent recorded at sign-in. These exist so you stay signed in and so suspicious sign-ins can be investigated.
• League content you enter — league names, acronyms, descriptions, a league’s Discord invite link, the games it races and its time zone.
• Your membership in a league — your role (owner, admin or member) and the date you joined.
• Requests to join — when you ask to join a private league, a record that you asked and when.
• Bans — if a league’s admins ban you, a record of the ban, your Discord user ID, which admin made it, when, and an optional note they write. You can ask for a copy of anything written about you, like any other data.
• Rate limit counters — counts of recent actions keyed to an account or an IP address, used to stop automated abuse.

There is no analytics service, no advertising network, no tracking pixel and no third-party script running on this site. Fonts are served from seasonr.app itself rather than from Google, so loading a page does not tell anyone else that you visited.

Two cookies are used, both strictly necessary: the one that keeps you signed in, and, when JavaScript is off, one that carries a confirmation message (“Division deleted”) to the next page and expires within seconds. Neither tracks you, which is why there is no cookie banner asking for consent.

Your account data is used to identify you inside a league, to keep you signed in, and to keep the service running and free of abuse. It is not used for anything else.

Under the GDPR the legal basis is contract for everything needed to give you an account and a league, and legitimate interest for security measures such as session records, rate limiting and keeping a league’s bans in force after the banned account is deleted. No processing here relies on consent, and none of it involves automated decision-making or profiling.

A league is public, unlisted or private, and the person who creates it chooses which. A public league is listed in the directory and can be found by search engines. Anyone who can see a league sees its results and standings, which show driver names (the names the league’s admins entered, often a gamertag), not your Discord name or avatar.

Your Discord display name and avatar are visible only to the owner and admins of the leagues you are in. They also see, for each member, their role, the date they joined and roughly when they were last active on seasonr.app (the day of their latest sign-in activity, not what they did). When you ask to join a private league, its admins see your name and avatar with the request. Ban records, including any note, are visible to that league’s admins only.

Your email address is never shown to other users, in any league visibility.

Your data is not sold, rented or shared for anyone else’s marketing. It reaches exactly three parties, each because the site cannot run without them:

• Discord — the sign-in provider. Discord’s own privacy policy governs what it does with your account there.
• Hetzner — the hosting provider whose server, in Helsinki, Finland, runs the site and holds the database.
• Cloudflare — sits in front of the site to handle encryption and block attacks, so it processes the traffic in transit.

Data may also be disclosed where the law requires it, for example a valid order from a court.

The database is hosted in Helsinki, Finland, inside the European Union. If you are in Quebec or elsewhere in Canada, that means your personal information is stored outside the province. The EU offers a level of protection comparable to Quebec’s, and the amount of information held is small — a name, an email address and your place in the leagues you use.

• Account data — until you delete your account. Deletion is immediate and cannot be undone: your account, sessions, Discord tokens, memberships and join requests are deleted at once, and seasonr.app asks Discord to revoke its access. Bans you issued as an admin stay in their league without your name.
• Leagues you own — when you delete your account, each league you own passes to its longest-standing admin. A league with no admin is deleted with your account, along with its divisions, seasons, memberships and invite link. Settings lists which is which before you confirm.
• Join requests — until an admin approves or declines them. Declining deletes the request.
• Bans — until an admin lifts the ban or the league is deleted. Deleting your account does not end a ban: the ban keeps your Discord user ID (and any note the admins wrote), but not your name, avatar or email, so that signing in again with the same Discord account cannot be used to get around it.
• Sessions — expire after seven days without use and are deleted within about an hour of expiring, or outright when you sign out.
• Rate limit counters — deleted within about a day of the last action they counted.
• League results — kept as long as the league exists, since a championship table is the record the league is for. Deleting your account removes your membership, but your driver name stays on the league’s results, unlinked from your account, so past standings stay intact. That name is what the league’s admins entered, often your gamertag. If you want it changed, ask the league’s admins: renaming a driver changes it on every past result.

Traffic is encrypted end to end. Session cookies cannot be read by JavaScript in your browser, every action that changes data checks who you are before it runs, and sign-in attempts are rate limited. No system is perfect, and any breach affecting your data will be reported to you and to the relevant authority as the law requires.

Whether you are covered by the GDPR, by Law 25, or by neither, the same requests are honoured:

• Get a copy of everything held about you.
• Correct anything that is wrong.
• Have your account and its data deleted. You can do this yourself in Settings, or ask by email.
• Receive your data in a portable, machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw from the service at any time by deleting your account in Settings.

Email [email protected] from the address on your account. Requests are answered within 30 days.

If you are in the EU or the UK and are not satisfied, you may complain to your national data protection authority. In Quebec you may complain to the Commission d’accès à l’information.

seasonr.app is not intended for children under 13, and Discord requires its own users to be at least 13. If you believe a child has created an account, email the address above and it will be removed.

When this policy changes the date at the top changes with it. A change that materially affects how your data is used will be announced on the site rather than made quietly.