Privacy Policy

01The short version

We collect the least we can get away with, we do not sell it, and we do not run advertising. The specifics differ by product, so the sections below are split by product rather than blended into one vague list.

• The Speedshift website has no accounts and no login. It records privacy-preserving, aggregate visit statistics and nothing else.
• Track Evolution stores the logbook you build — events, sessions, lap times, notes, cars. Telemetry files you import are parsed inside your browser and the source video or data file is never uploaded to us.
• Orbit Rings stores the people you deliberately place into a circle and the interactions you log by hand. It never reads your call or message history, and it does not upload your whole address book.
• We never sell personal information, share it for cross-context behavioural advertising, or use your content to train machine-learning models.
• You can delete your account, and everything in it, at any time.

02Who we are and what this covers

Speedshift LLC is a North Carolina limited liability company. In this policy, "we", "us" and "our" mean Speedshift LLC, and "you" means the person using one of our products.

This policy applies to the Speedshift website, Track Evolution and Orbit Rings — described together as the "Services". It does not apply to anything else we link out to, including GitHub, LinkedIn, the App Store, Google Play, or a self-hosted copy of our open-source code run by someone else.

We are the controller of the personal information described here. You can reach us about anything in this policy at eric@speedshift.io.

03The Speedshift website

speedshift.com is a set of static pages. There is no account, no login, no comment form and no tracking cookie.

We use Vercel Analytics to count page views. It records the page visited, the referring site, and coarse device and country information derived from your request. It does not set cookies, does not use a persistent visitor identifier, and does not follow you across other websites. We see aggregate counts, not individual browsing histories.

Our hosting provider also keeps standard server logs — IP address, timestamp, requested URL, user agent — for a short period to operate the site and defend against abuse. If you email an address published on the site, we receive whatever you put in that email and keep the correspondence so we can reply.

04Track Evolution

Track Evolution is a logbook, so nearly everything it holds is something you typed in or imported on purpose.

The hosted service runs on Cloudflare Workers and Cloudflare D1, in the United States. Your logbook is private to your account unless you publish a share link, described below.

05Orbit Rings

Orbit Rings is about the people in your life, which makes it the most sensitive thing we build. It is designed so that the app only ever knows what you deliberately tell it.

Orbit Rings stores this in Firebase Authentication and Cloud Firestore, operated by Google, so your circles sync across your devices and keep working offline. The app also keeps a local copy on your device for offline use.

A note about other people: the people in your circles have not agreed to this policy, and they are in the app because you put them there. Only add and store what you would be comfortable holding on their behalf, and remove them when they ask.

Orbit Rings is in development and has no store listing yet. If its data practices change materially before release, this policy will be updated before the app ships.

06How we use information

We use the information described above to:

• Provide the Services — store your logbook or your circles, sync them across your devices, compute lap statistics, warmth and cadence, and render the charts and views you asked for.
• Send the notifications and reminders the product exists to send, and any service messages about your account.
• Keep the Services running and secure — diagnose faults, investigate abuse, prevent fraud, and maintain backups.
• Answer you when you write to us.
• Understand, in aggregate, which pages and features are used, so we know what to build next.
• Comply with the law, and enforce our Terms of Service.

We do not use your content to train machine-learning models, and we do not profile you or make automated decisions that produce legal or similarly significant effects.

If you are in the European Economic Area or the United Kingdom, our legal bases are: performance of a contract with you, for everything needed to run the Services; our legitimate interests in operating, securing and improving them; your consent, for device permissions such as contacts, location and notifications, which you may withdraw at any time in your device settings; and compliance with legal obligations where they apply.

07Who we share information with

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we run no advertising in any of our products. We disclose information only in these situations:

08Sharing you control

Track Evolution lets you publish a read-only page of your stats and times under a slug you choose. This is off by default and only exists if you turn it on.

A share link deliberately strips your notes, your email address, per-lap detail and your garage — it shows the pace, not the diary. Even so, a share link is a public web page: anyone with the URL can open it, and search engines or others may copy or cache what it shows. Treat it as public. You can revoke a share link at any time, which takes the page down, though we cannot force third parties to forget a copy they already made.

09Keeping and deleting your data

We keep your account and its contents for as long as your account exists, because that content is the product — a logbook you cannot look back on is not worth much.

You can delete your account from within Track Evolution and Orbit Rings, or by writing to eric@speedshift.io. Deleting your account removes your logbook or your circles, takes down any share links, and closes the account. Deletion completes in our live systems within 30 days and works its way out of encrypted backups within 90 days. We may keep a minimal record of the deletion itself, and anything we are legally required to retain.

You can also delete individual items — an event, a session, a person, an interaction — without deleting your account. Aggregate analytics and server logs, which are not tied to your identity, are kept on their own short schedules.

10Security

Traffic to our Services is encrypted in transit with TLS, and data is encrypted at rest by our infrastructure providers. Authentication is delegated to Google, Apple and Firebase, so we never hold your password. Access to production systems is limited to those who need it.

No system is perfectly secure, and we cannot guarantee absolute security. Protect your sign-in account with your provider, since anyone with access to it has access to your data here. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law.

11Children

Our Services are not directed to children. You must be at least 13 to use them, or 16 if you are in a country where 16 is the minimum age for consent to processing. We do not knowingly collect personal information from children below that age. If you believe a child has provided us information, write to eric@speedshift.io and we will delete it.

12Where your information is processed

We operate from the United States, and our service providers process and store information in the United States and other countries where they run infrastructure. Privacy laws in those countries may differ from the ones where you live.

Where personal information moves out of the European Economic Area or the United Kingdom, it is transferred under the European Commission’s Standard Contractual Clauses, and the UK Addendum where applicable, as incorporated into our providers’ terms.

13Your rights

Whoever and wherever you are, you can ask us to show you what we hold, correct it, export it, or delete it. Most of it you can do yourself inside the app; for the rest, write to us.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the rights to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests, along with the right to withdraw consent at any time. You also have the right to complain to your local supervisory authority, though we would appreciate the chance to sort it out first.

If you are in California, you have the rights to know, delete, correct and, where applicable, to opt out of sale or sharing and to limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. We will not discriminate against you for exercising any of these rights. Residents of other US states with comparable laws — including Colorado, Connecticut, Virginia, Texas and Oregon — have equivalent rights, and we honour them on the same terms.

To make a request, email eric@speedshift.io from the address on your account, or tell us which account it concerns. We will respond within the time the applicable law allows — 45 days under US state laws and one month under the GDPR, each extendable where the law permits. An authorised agent may make a request on your behalf with written proof of authorisation.

14Open source and self-hosted instances

Track Evolution is open source under the Apache 2.0 licence, and anyone may deploy their own instance or point the mobile app at it. This policy covers only the instances we run. If you use an instance operated by someone else, that operator is the one handling your data, and you should ask them for their policy — we have no access to and no responsibility for it.

15Changes to this policy

We will update this policy when our products change. The effective date at the top always reflects the current version. If a change materially reduces your privacy — new categories of data, a new purpose you would not expect — we will give you notice in the app or by email before it takes effect, and where the law requires consent, we will ask for it.

16Contact us

Questions, requests and complaints about privacy all go to the same place: eric@speedshift.io. Please say which product you are writing about — it makes the answer faster.