Impressum

Angaben gemäß § 5 DDG / provider identification

Contact

hello@pacedyn.dev

Responsible for content (§ 18 Abs. 2 MStV)

Marian Bookhahn, address as above

Privacy

Datenschutzerklärung · version 2026-11-06b

The controller for everything below is the person named above. PaceDynamics is in private testing and collects as little as it can — there is no analytics, no advertising, no third-party tracker and nothing is sold or profiled. What it does process, and why:

Your account

Your email address and a hash of your password, held by our account service, Supabase (Supabase Inc.), in a project located in the European Union. They exist so that you can sign in, and so that we can reach you about the service. Accounts are by invitation, so we also keep the address on the invitation list until you have used it.

What you build

Your projects — cars, suspensions, tyres, motors, aero maps, tracks, saved results, solved laps and your settings — are stored in your account on a server we operate in Germany, so that they follow you between machines. Earlier versions are kept as a history you can go back to. Your browser keeps its own copy of the project you have open, which is what lets you work offline. Deleting a project deletes it from both.

Logs you keep for calibration

Comparing a logged session with your car in the Calibration tool happens in your browser, and the log is not sent anywhere. With a paid plan (Plus and above) you can choose to keep a log in your account, to fit many sessions together. A kept log is the file as your logger wrote it: it may name the driver, the car, the venue and the time, and with GPS it records where the car was, second by second. It is stored for you alone — not for your team — until you delete it, and you can still open and delete it if your plan ends. When you fit several kept logs together, our server reads them only for as long as the fit runs. The result and its report, which name each session by its file, logger, venue and date, stay in your account until you delete them; we keep your hundred most recent fits.

Tracks read from their authors

A few catalogue tracks, marked “linked”, are not ours to pass on, so your browser reads each one directly from where its authors publish it — today GitHub (GitHub, Inc., USA) — when you add it, and when a project that uses it loads without a stored copy. GitHub then sees your IP address and which file you asked for, under its own privacy statement. We send it nothing else, not even the page you came from. Tracks not marked “linked” come from us.

What you share with a team

If you join a team, anything you publish to its shared library — a component, a track, a result, a template — is visible to everyone in that team, together with the display name and avatar you chose. An avatar is one of our drawn designs in a colour you pick, or a picture you upload. Your browser reduces a picture to 128 × 128 pixels before it is sent, which also removes its metadata, such as where it was taken. It is stored with your profile until you remove it or delete your account. A team's admins can upload a picture as the team's avatar in the same way; its members, and the people it has invited, see it. Nothing is published until you publish it, and your own projects are never shared by joining. If you delete your account, what you published there stays with the team, without your name.

Community templates and discussion

You can choose to submit a reviewed template snapshot and description for public browsing, under the licence shown with that revision. Its public display name, your avatar and comments are visible to everyone. An uploaded picture is shown there only once a moderator has approved it; until then, or if it is declined, your drawn avatar is shown instead. A moderator sees your picture only after you have submitted a template or a comment. If you credit one of your teams, its name and avatar are shown beside yours for as long as you remain a member; a team's uploaded picture likewise only once a moderator has approved it. Private notes are visible only to you; team discussion only to current team members. Saving or sharing a template does not make those private discussions public. The public community page asks our app server for reviewed content; it does not receive your session cookie or tokens. Contributions and moderation records are held by our account service in the EU to provide the feature you requested and handle reports and abuse. Reports are private; contact details, where supplied, let us communicate their outcome. We use no external embeds or profiling. You may export your community contributions, withdraw listings and delete your comments in the app. Closing your account withdraws public listings and removes your public comment text. Kept licensed copies remain with their recipients. Team material remains without your account link, and you may contact us for an individual erasure request concerning identifying prose. Withdrawn or restricted snapshots are normally purged after 30 days, reports and moderation activity after 90 days, subject to a documented legal preservation need. The community terms explain publication rights, reporting and how to contest a restriction.

A session cookie

After you sign in, one cookie (__session) tells the server that you are signed in, and your browser keeps the matching tokens. Both are technically necessary to serve you the app, contain no tracking identifier, and go when you sign out. Because they are necessary, we do not ask for consent for them — and we set nothing else.

A check that you are not a script

Every account comes with free computing time, so the sign-in page checks that a person, not a script, is creating an account, signing in with a password or asking for a reset link. The check is Cloudflare Turnstile, from Cloudflare, Inc. in the United States: it runs in a frame on that page, loaded from Cloudflare, which receives your IP address and technical characteristics of your browser and connection (such as its user agent), and may use cookies of its own that it counts as strictly necessary. Our account service has Cloudflare confirm the one-time answer, and we keep nothing from the check. Cloudflare processes these signals for us, and as its own controller to improve its bot detection; its Turnstile privacy addendum says how. The transfer rests on Cloudflare's certification under the EU–US Data Privacy Framework. The check loads only when one of those forms is in front of you — not when you are already signed in, and nowhere in the app itself.

Compute jobs

When you ask for a time-optimal lap or a study, we record against your account the CPU time it took, which tool ran, whether it succeeded and the lap time it found, so that everybody's allowance is fair and a charge can be explained. The car and track you submit are held only while the solve runs and are deleted with it. The lap it finds — its line, speeds and controls, over the track's curve and width — is kept on that server for up to a day, for your account alone, so that your next solve of the same track starts from it and costs less.

Studies run on our server

With a Professional plan you can send a design study to run on our server rather than in your browser. While it runs we keep, in your account, a copy of the project as you sent it, so that the run can carry on if the server restarts; the copy is deleted when the run ends. What the run found — which project, study and car it was about, each design it tried and how it scored, and what it cost — stays in your account until you delete it. We keep your hundred most recent runs.

An assistant you connect

You can authorise an AI assistant to drive PaceDynamics for you. If you do, the project that assistant opens is sent to whoever operates it, under their terms and not ours. Only applications we have named in advance can be authorised, you are asked each time, and you can revoke it. If you would rather nobody else saw your work, do not connect one.

Email we send

Confirming your address and resetting your password are links we email you, through our mail provider. If you asked for an invitation, one mail tells you that you may now create an account. We send nothing else — no newsletter, no product mail.

Server logs

Requests are logged, including IP addresses, to keep the service running and secure: these pages by Firebase Hosting (Google Ireland Limited), the app by our own server. The connection to the app is terminated by the reverse proxy of the network that server sits in, which therefore handles this traffic for us. Logs are kept for 30 days and then deleted.

Why we are allowed to

Your account, your projects, the emails above, reading a linked track you added, running a study you sent to our server, and keeping and fitting the logs you chose to keep are what it takes to give you the service you asked for — Art. 6(1)(b) GDPR. Server logs, the compute meter, the check that you are not a script and keeping the thing secure rest on our legitimate interest in running a service that works and is not abused — Art. 6(1)(f). Nothing here relies on consent, because nothing here is optional to the service; there is accordingly nothing to withdraw and no cookie banner to click.

How long we keep it

Your account and its contents stay until you delete them or delete the account (in the app's account menu, or by asking us), and go with it — except what you published to a team, which stays with the team without your name. Deleting is immediate and cannot be undone. Server logs go after 30 days. We keep nothing from the check at sign-in; what Cloudflare keeps is set out in its addendum. Compute records are kept while the account exists, because they are what an allowance is counted from. The copy of a project sent to run a study on our server goes when that run ends. A log you kept stays until you delete it, also after a paid plan ends. Invitations expire after fourteen days.

Your rights

You can ask what we hold about you (Art. 15), have it corrected (Art. 16), have your account and its data deleted (Art. 17), have processing restricted (Art. 18), object to what rests on legitimate interest (Art. 21), and take your data elsewhere (Art. 20) — the app deletes the account itself, and exports any project as a file, without asking us. Write to hello@pacedyn.dev and we will answer within a month. You may also complain to a supervisory authority — for us that is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Changes

If this notice changes in substance we will date the new version here and ask you to read it. The version you were shown when you created your account is recorded with it.