Privacy notice

Who is responsible

Marino Poropat, a private person in Rovinj, Croatia, is the controller of your data. Write to privacy@marinoporopat.com with anything about it.

What is kept

• Your email address, and the language you signed up in.
• What you asked for: the email the day the site opens (always), and race news after that (only if you ticked the second box).
• When you signed up, when you confirmed, and the version of this notice you agreed to — the record that you consented.

Nothing else with it. No name, no tracking, no profile.

Why, and on what basis

To send you what you asked for. The legal basis is your consent (GDPR, Article 6(1)(a)). The record of your consent is kept so that it can be shown you gave it (Article 7(1)).

How signing up works

Until you click the link in the confirmation email, nothing comes to you but that one email (double opt-in). If you never click it, the request is deleted within 7 days.

Who else handles it

• Vercel Inc. (USA) hosts the site; its servers for this site run in Frankfurt, Germany. Vercel is certified under the EU-U.S. Data Privacy Framework and also uses the EU Standard Contractual Clauses.
• Neon (USA) runs the database, which is kept in the EU (Frankfurt, Germany), under the EU Standard Contractual Clauses.
• Resend, Inc. (USA) delivers the emails — the confirmations, and what Marino sends to the list. They go out from Ireland (EU); Resend keeps its records of them in the USA, under the EU Standard Contractual Clauses.
• Cloudflare, Inc. (USA) — only if you pair your phone as a controller: it helps the two devices find each other, and relays their encrypted connection when they cannot connect directly. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

Your address is never sold, shared or used for advertising.

For how long

• Unconfirmed requests: deleted after 7 days.
• The launch email only: deleted within 30 days of the site opening and that email going out.
• Race news: until you unsubscribe.
• Unsubscribing deletes your address at once. It is not kept on a “do not mail” list.
• Protection against abuse: a keyed hash of your IP address and of your email address, kept for up to 48 hours to stop repeated sign-ups — and of your IP address alone when you pair a phone, to stop repeated pairings. Neither can be turned back into the original.
• Like any website, the hosting keeps technical request logs (IP addresses included) for a short time, for security.

Your rights

You can ask to see your data, to have it corrected or deleted, to restrict or object to its use, or to take it with you. You can withdraw your consent at any time; that does not change what was sent before.

Unsubscribe in one click at marinoporopat.com/unsubscribe, or write to privacy@marinoporopat.com.

You can also complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr) or to the authority where you live.

Your phone as a controller

If you pair your phone with the QR code, the two devices exchange connection details — including their network (IP) addresses — through this site's database, and then talk to each other directly. Those details are deleted the moment the devices connect, and after ten minutes at most if they never do. To help two devices on different networks find each other, Cloudflare's STUN server sees their IP addresses during the handshake; and when they cannot reach each other directly — a phone on mobile data, say — Cloudflare's TURN server relays the connection between them. The relay sees the two IP addresses but not what passes through it: the connection is encrypted end to end, and the relay's access expires after two hours. What you press on the phone goes to your screen and is not kept anywhere.

The leaderboard

If you save a lap to the leaderboard, the name you type for it, the lap time and when you saved it are kept, and the name and the time are shown to everyone who visits — that is what a leaderboard is for, and saving is your choice (your consent). Use a nickname if you would rather not show your own name. It stays on the board for as long as the board is on this site; write to privacy@marinoporopat.com and it is taken off. Names that break the board's rules are deleted.

So that nobody can flood the board, each save is also counted against your network (IP) address — as a keyed one-way hash, never the address itself, deleted after 2 days.

Cookies and browser storage

This site sets no cookies. In your own browser it keeps a few small things, and none of them ever leaves your device: whether you turned the sound on (local storage); whether it has already shown you what the buttons at the top do, so it shows you once (local storage); the name you last saved a lap under, so it is ready next time (local storage); for this tab only, whether you have already signed up or chosen how to drive, so it does not ask again, and on a phone paired as the controller, the token that lets it reconnect after it locks (session storage); and, if you open its hidden tuning panel, whether that panel is folded (local storage).

Security

Connections are encrypted (HTTPS), the database is in the EU, the links in the emails carry one-time tokens that are stored only as hashes, and the list is Marino’s alone to open, behind a password.

Changes

If this notice changes in substance, the version date below changes with it — and nobody is held to anything new without being told.