Privacy Policy
Last updated: November 12, 2026
1. Information We Collect
We collect only what the product needs to work. Specifically:
- Account details — your email address, username, display name, and anything optional you choose to add to your profile, such as a bio, country, or home layout.
- Session data — the GPS traces recorded while you are driving, along with the lap and sector times derived from them, any vehicle details you enter, and any photos you attach to a session. Recording continues in the background while your screen is locked, so a lap is captured end to end; this is the app's most sensitive collection, and it happens only while a session is running.
- App and device build information — the app version, build number, platform (iOS or Android), and, on Android, a coarse model name such as “Pixel 7”. This is used to reproduce bugs.
- Diagnostic logs — sent when you report a bug or upload logs yourself, and sent automatically when a recording lost GPS signal so the dropout can be diagnosed. They describe GPS gap windows, battery and charging state, and app-state transitions. After the app crashes or freezes, the next launch also sends a crash report automatically: the error message and stack trace, the screen you were on, and the app's own recent log lines. On iOS the stack is read on your device from Apple's MetricKit and sent only to us. A bug report also records the screens you visited in the app before sending it, and any screenshots you choose to attach to a bug report.
- IP address — your IP address appears in our server access logs for every request the app makes, as it does for any web service. It is additionally recorded in a longer-lived security record when you create an account, confirm your email, request a new confirmation code, or reset your password. Retention for both is set out below.
We do not read any identifier that would follow you across installs. Advertising identifiers, the iOS vendor identifier, the Android device ID, hardware serial numbers, and the name you gave your device are all deliberately left untouched.
2. How We Use Your Information
To operate the Service — recording sessions, timing laps, comparing them, and showing them to whoever you have chosen to share them with. To diagnose defects, which is what the build information and diagnostic logs exist for. To keep accounts secure and to investigate abuse of sign-up and password-reset flows. We do not use your data to build advertising profiles.
4. Data Retention
Different kinds of data are kept for different lengths of time:
- Your sessions, laps, traces and photos are kept until you delete them or your account is erased. They do not expire on their own — they are the product, not exhaust.
- Diagnostic logs are deleted after 30 days, both the log itself and the record of it. They are useful only while a bug is open.
- Security records are kept for two years (730 days). These are the entries covering account creation, password resets, and administrative actions, including the IP addresses described above — long enough to investigate an incident, and no longer.
- Server access logs are kept for 30 days. These record the IP address, time, and endpoint of each request, and are used to operate and debug the Service.
- Rate-limiting counters, which briefly record the IP address requesting a verification code, expire within hours.
- Archived accounts are kept for at least 30 days before they are eligible for permanent erasure, so that archiving can be undone. See the next section.
5. Archiving and Deleting Your Account
You can delete your account without the app. Either sign in at sektorapp.com/you/settings and choose Delete account, or email privacy@sektorapp.com from the address on your account and ask us to delete it. In the app, the same option is under You › Settings › Account. Whichever route you use, the account is archived straight away and permanently erased 30 days later, as described below; if you want it erased sooner, say so and we will do it.
You can archive your account from within the app at any time. Archiving takes effect immediately: your account is disabled, you are signed out everywhere, and your sessions and your private tracks are archived along with it. A sign-in token already issued to your device may keep working for up to about an hour until it expires.
Archiving is reversible for a period of at least 30 days. Because an archived account cannot sign in, undoing it is not something you can do yourself — contact us before the 30 days are up and we will restore it. An account you archive yourself is permanently erased automatically once its 30-day window has elapsed; you do not need to ask. If you want your data erased sooner, tell us and we will do it.
When an account is erased, the following are permanently deleted: your profile and sign-in account, including your email address; your vehicles, sessions, laps, GPS traces and photos; your diagnostic logs; and your reactions, follows, invitations, group and team memberships, event attendance, bookmarks, and any reports you filed. GPS traces are always deleted outright and never anonymised, because a trace of where you drove is identifying no matter whose name is on it.
Two categories are anonymised rather than deleted. Comments you left on other people's content keep their text and their place in the conversation so that other people's discussions stay readable, but are no longer linked to you or to any live account. Your lap and sector times on a leaderboard keep their position, so that a leaderboard does not silently rewrite itself when someone leaves, but the surviving entry is just a time: it carries no name, no username, no account, and no link to the lap or the trace it came from — those are deleted. A lap time on its own says nothing about where you were, which is why it can be anonymised and a GPS trace cannot.
The record that an erasure was performed is itself retained as a security record for up to two years.
6. Security
We implement reasonable technical and organizational measures to protect your information. Your sign-in credentials are handled by Amazon Cognito and are never stored by us directly; on your device, the token that keeps you signed in is held in the operating system's secure storage. No method of transmission or storage is completely secure, and we do not claim otherwise.
8. Your Rights
Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal data. You can view and correct your profile in the app, and archive your account there. For access, export, restoration, or permanent erasure, contact us using the address below and we will action it.
9. Children's Privacy
The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page, with a revised date at the top.
11. Contact
Questions about this Privacy Policy, or a request about your data? Contact us at privacy@sektorapp.com.