Privacy
Policy.

Pitbox is a real-time sim racing companion app for iPhone and Android, developed and operated by Pitbox Racing Ltd, registered in England and Wales, headquartered in London, United Kingdom.

Pitbox is available worldwide on the App Store and Google Play. We apply the standards of the UK GDPR and EU GDPR to the personal data of all our users wherever they are located, and we comply with any additional data protection laws that apply to you in your country of residence.

By using the App, you agree to the practices described here. If you do not agree, please discontinue use of the App.

Pitbox receives data broadcast by your sim racing game over your local Wi-Fi network via UDP. The App processes this data in real time to power your driver dashboard. During an active session, telemetry data is stored locally on your device only. When a session ends, anonymised telemetry data — linked solely to a random identifier, never to your identity — is uploaded to our secure servers to power app features and improvements. This telemetry contains no personally identifiable information.

Account & sign-in data. Signing in is optional, but if you choose to create an account using Sign in with Apple or Google Sign-In, we collect and store the following so we can identify your account and sync your purchases across devices and platforms:

• A Firebase user ID — a unique account identifier generated by Firebase Authentication when you sign in.
• Sign in with Apple — the unique Apple user identifier, and your name and email address if you choose to share them (Apple lets you hide your real email behind a private relay address).
• Google Sign-In — your name, email address, and profile photo associated with the Google account you sign in with.

Purchase data. When you subscribe to Pitbox Pro, our payments partner RevenueCat records your subscription status and purchase history. If you are signed in, this is linked to your Firebase user ID so your Pro access follows you across iPhone and Android. No payment card details are ever handled or stored by us.

In addition, we collect anonymous, non-identifiable data to help us understand how the App is used and to improve the experience for all users:

• Crash reports — automatically collected via Firebase Crashlytics when the App crashes. These contain technical diagnostic information (device model, operating system version, app version, stack trace) but no personal information.
• Anonymous usage data — aggregated, non-identifiable data about how features are used, collected to help us prioritise improvements and deliver better experiences. This data cannot be traced back to you individually.

Game data received via UDP is used to power the App's real-time dashboard and, once a session ends, is uploaded in anonymised form to improve features across the platform. It is never used to identify you individually.

If you sign in, your account and purchase data is used to:

• Identify your account and keep you signed in across sessions
• Sync your Pitbox Pro subscription across your devices and between iPhone and Android
• Restore your purchases when you reinstall the App or switch devices
• Respond to support requests relating to your account

Anonymous data we collect is used to:

• Diagnose and fix crashes quickly so the App remains stable
• Understand which features are most valuable to drivers
• Inform decisions about new features and improvements
• Monitor overall App health and performance

We do not use any data for advertising, profiling, or any commercial purpose beyond building a better product.

Pitbox uses the following third-party services. Each operates under its own privacy policy and data processing terms:

• Firebase Authentication (Google) — manages Sign in with Apple and Google Sign-In and issues your account identifier. Stores your sign-in identifiers and, where shared, your name and email address. Firebase Privacy Policy →
• Apple (Sign in with Apple) — handles authentication when you sign in with your Apple ID. Apple shares a unique identifier with us, and your name and email only if you choose to provide them. Apple Privacy Policy →
• Google (Google Sign-In) — handles authentication when you sign in with your Google account, sharing your name, email address, and profile photo with us. Google Privacy Policy →
• Firebase Crashlytics (Google) — crash reporting and diagnostics. Data is anonymised and used solely to identify and fix technical issues. Firebase Privacy Policy →
• Firebase Firestore (Google) — stores your account record (linked to your Firebase user ID) along with anonymous session metadata and app state. Firebase Privacy Policy →
• Firebase Storage (Google) — stores anonymised session telemetry data linked only to a random identifier. No personal information is stored. Firebase Privacy Policy →
• RevenueCat — manages in-app subscriptions and purchase validation. RevenueCat processes transaction data such as purchase history and subscription status to verify entitlements, and links them to your Firebase user ID so your Pro access syncs across iPhone and Android. No payment card data is handled by RevenueCat directly. RevenueCat Privacy Policy →

Firebase and Google services are operated by Google LLC and may process data in the United States. RevenueCat Inc. is based in the United States. Where required, appropriate safeguards under UK GDPR and EU GDPR — including Standard Contractual Clauses — are in place.

We do not sell, rent, or share personally identifiable data with third parties.

Your account data is processed by our authentication and payments providers (Firebase, Apple, Google and RevenueCat) strictly to provide sign-in and purchase-sync functionality, as described above. Anonymous diagnostic and usage data is shared with Firebase (Google). Beyond this, data may be disclosed only in the following circumstances:

• Legal obligation — where required by law, court order, or regulatory authority
• Business transfers — in the event of a merger or acquisition, you will be notified before any data transfer occurs

During an active session, telemetry data is held locally on your device only. Once a session ends and data is uploaded, anonymised telemetry is retained on our servers for as long as it is needed to power app features and improvements. Because this data is linked only to a random identifier and cannot be traced back to you, erasure requests for telemetry data cannot be fulfilled on a per-user basis.

If you sign in, your account data (your Firebase user ID, sign-in identifiers, and any name or email shared) and your linked purchase records are retained for as long as your account remains active. When you delete your account, this data is permanently erased from our systems — see Delete Your Account & Data.

Anonymous crash and usage data held by Firebase is retained in accordance with Google's standard retention policies, typically no longer than 90 days for crash reports.

If you contact us for support and share personal information such as your email address, we retain that correspondence for up to 24 months, after which it is deleted.

Depending on where you live, you have rights under the data protection law that applies to you — including the UK GDPR (United Kingdom), the EU GDPR (European Union), and similar laws in other regions. We extend the following core rights to all of our users, wherever they are located:

• Access — request a copy of personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your personal data
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests

These rights apply to the personal data we hold about you — your account and purchase information if you have signed in, and any personal information you have shared with us directly (such as support emails). The quickest way to exercise your right to erasure is to delete your account in-app (see Delete Your Account & Data); to exercise any other right, contact us at the address below.

UK users may lodge a complaint with the Information Commissioner's Office (ICO).
EU users may contact the data protection authority in their EU member state.
Users elsewhere may have the right to complain to their local data protection regulator.

You can delete your Pitbox account and all the personal data associated with it at any time. There are two ways to request deletion:

• In the App — go to Settings → Account → Delete Account and confirm. This is the fastest method and is available on both iPhone and Android.
• By email — if you can't access the App, email us at soufiane@pitboxapp.com from the address linked to your account, or tell us which sign-in method you used, and we will verify and process your request.

We complete deletion requests within 30 days, and usually much sooner. Note that deleting your account does not automatically cancel an active subscription — manage or cancel subscriptions through your Apple App Store or Google Play account. Anonymous telemetry and diagnostic data, which is not linked to your identity, cannot be tied back to you and is therefore not affected by account deletion.

Pitbox is not directed at children under 13 and we do not knowingly collect personal data from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

We may update this policy from time to time. When we do, we will update the date above and, where changes are significant, notify you via the App. Continued use of the App after changes are posted constitutes acceptance of the updated policy.

For privacy questions or to exercise your data rights:

• Company  Pitbox Racing Ltd
• Registered in  England & Wales
• Location  London, United Kingdom
• Email  soufiane@pitboxapp.com
• Website  pitboxapp.com

We aim to respond to all privacy enquiries within 30 days.