Privacy Policy

Anyone can register for CTR[L]APS with an email address, which we confirm by sending a link before the account is made. A new account is a fan account: it can follow the championship, vote in polls and predictions, keep favourites and say whether it is coming to a race weekend. The organisers of an event (admins, coordinators, team managers and security heads) give people their role, such as racer, crew or volunteer, either by adding their email address, which sends an invite, or by promoting an existing account.

• Account details entered by the person who created your account: your email address, role, team, and who you report to.
• Your profile: for event staff and racers, completed when you first sign in: full name, date of birth, contact number and photo. For a fan account only a name is asked for; date of birth, contact number and photo are optional. Every account also has a verification code and a QR code.
• Fan activity: your favourite driver and team, the articles you save, your votes in polls and predictions (and the points they score), and whether you are coming to a race weekend, with a short note if you are on a team.
• What you send: announcements, race-weekend channel posts and private chat messages, with any edits and deletions; documents, photos, voice notes and audio files you attach; and your location, only when you choose to share it in a message.
• Message status: when a message reached a device and when it was read. Private chats show this to the sender as ticks.
• Technical data: sign-in sessions (whether web or app, and when last used), the push-notification token of your device, and, to stop password guessing, the email address and IP address of recent sign-in attempts.
• A record of account changes: who changed a profile, a status or a race time, and when.

We do not use advertising, analytics or tracking tools, and we do not sell personal data.

• Notifications, to show messages as they arrive, and an exemption from battery optimisation so they still arrive while the phone sleeps.
• Storage (older Android versions only), to save documents in Downloads/CTRLAPS.
• Microphone, only while you record a voice note; location, only when you share it; camera, only while scanning someone’s ID code.

The app keeps a copy of what it shows you (your chats, announcements, channel posts, the schedule, the people list, your account, these documents, and the photos and voice notes in them) in its own storage on your phone, so it opens quickly and without signal. You can clear it at any time under Account → Kept on this phone. It is cleared automatically if another person signs in on the same phone, or if your account is banned.

• To run the service: deliver messages, documents and schedule changes, and show the race schedule and countdown.
• To let event staff confirm who you are, by scanning your QR code or entering your verification code.
• To notify you by push notification and, for urgent messages, by email.
• To keep CTR[L]APS secure: sign-in limits, session management, and a record of account changes.

We process this data on the basis of your consent, which you give when you set up your account, and for the legitimate uses the Act allows. You may withdraw consent at any time by writing to us; your account will then be closed.

• The people you message see what you send them, your name, role and photo.
• The people above you in your event’s structure, and all admins, can see your profile and account status.
• The fan-zone leaderboard, which is public, shows your first name and the initial of your last name with your points. Who is coming to a race weekend is shown to organisers and, for team members, to their team manager; everyone else sees only the numbers.
• Anyone signed in to CTR[L]APS who scans your QR code or types your verification code sees your photo, name, role, team and account status.
• Service providers who run parts of CTR[L]APS for us: Vercel (hosting), Neon (database), Amazon Web Services (file storage, United States), Google Firebase (push notifications), Brevo (email) and GitHub (app downloads). They process data only to provide their service to us.

Some of these providers store or process data outside India, including in the United States. We may also disclose data where Indian law requires it.

• Your account and profile are kept until you delete your account (see below).
• Messages are grouped by season. Admins can archive a season (read-only) or delete it, which permanently removes that season’s messages.
• A private message you delete loses its text and attachment straight away, for both people.
• Sign-in attempt records are kept only as long as needed to limit repeated attempts.
• We keep a log of what organisers do in CTR[L]APS, for example sending an announcement, moving a session or changing someone’s role or status: who did it, to whom and when, with a short preview of announcements and channel posts. Only our support team can see it. Private chats and groups are never logged.

Emails and notifications that were already delivered cannot be recalled from the devices or inboxes that received them.

Deleting your account. You can delete your account yourself in the app (Account → Settings → Delete account) or on the website (Account → Delete account), or ask us to do it for you. You are signed out everywhere at once, and the account is deleted 7 days later; if you sign in again before then, the deletion is cancelled. When it is deleted:

• erased: your name, email, contact number, date of birth, photo, team, password, signed-in devices and notification registrations, email choices, followed categories, favourites, saved articles, poll and prediction votes, race-weekend answers, event replies, group memberships, and your support tickets with their messages;
• kept, shown as from “Deleted user”: the messages, photos and documents you sent in private chats and groups, so the people you wrote to keep their conversations whole (they can no longer see who you were), and announcements or channel posts you made as an organiser;
• race results that were published stay, as part of the championship record, on the driver profile they belong to, which is unlinked from your account and keeps no date of birth; the driver photo the organisers published stays with it. Write to us if you want the name withheld or the profile taken down;
• our records keep only that an account was deleted, and when;
• copies in our service providers’ backups are removed as those backups expire, within 30 days;
• copies we cannot reach stay where they are: messages, notifications and emails already on other people’s phones or in their inboxes, and anything they saved or forwarded.

Passwords are stored only as salted hashes. All traffic uses HTTPS, and files are only served to people who are signed in. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board of India as the Act requires.

Some people on a race weekend, such as young racers, may be under 18. Their account may only be used with the consent of a parent or lawful guardian, which the organiser creating the account must obtain. We do not track or monitor children’s behaviour or show them advertising.

You can ask us to:

• tell you what personal data we hold about you and who it has been shared with;
• correct or complete it (your profile is locked after setup, so your manager, an admin or we can change it for you);
• erase it, and close your account: you can do this yourself at any time (see section 6), or we will do it on your request;
• name someone to act for you if you die or become unable to act.

Write to arkhins@arkhins.com. We will reply within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

If we change this policy in a way that matters, we will update the date above and tell you in the app or by email before the change takes effect.

Arkhins · arkhins@arkhins.com