Privacy policy for the Racetipp app

Last updated: October 31, 2026

1. Controller
2. Overview
3. Account and sign-in
4. Profile, groups and predictions
5. Race data and results
6. Notifications
7. Profile picture and clipboard
8. Storage on your device and widget
9. Server and log data
10. Service providers and third countries
11. Retention and deletion
12. Your rights
13. Changes

1. Controller

2. Overview

Racetipp is a prediction game: you predict the results of race weekends and compare yourself with others in groups. So that all members of a group see the same leaderboard, the app stores data on a server. We only process what is needed for that:

• no ads, no tracking, no analytics or crash reporting services,
• no selling or sharing of your data for advertising,
• no location data, no contacts, no camera access; the app only accesses your photos when you choose a profile picture yourself,
• no stakes and no payment data.

3. Account and sign-in

Racetipp requires an account. Depending on how you sign in, we process:

• Sign in with Apple: a user identifier issued by Apple, your email address (or, if you choose, a relay address created by Apple) and your name if you share it. Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.
• Sign in with Google: a user identifier issued by Google, your email address, your name and, if applicable, a link to your profile picture, as provided by Google. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Email and password: your email address and password. The password is only stored as an encrypted hash.
• Sign-in link by email (magic link): your email address. We send you a link that signs you in without a password.

When you first sign in, we create a username from the name provided by Apple or Google, or from the part of your email address before the @. You can change your username in the app. We also store technical account data such as your user ID, the time of registration and last sign-in, and the IP address used to sign in (to protect against abuse).

Sign-in and password emails are sent through the email delivery service Resend (Plus Five Five, Inc., USA) as our processor. Resend receives your email address and the content of the email for this purpose.

The legal basis is Art. 6(1)(b) GDPR (providing the app under our terms of use). Storing the IP address is based on Art. 6(1)(f) GDPR; our legitimate interest is keeping accounts secure.

4. Profile, groups and predictions

When you use the app, we store:

• your profile: username and, if you upload one, your profile picture,
• groups: name, invite code, settings (e.g. public or private, bonus and chaos tips on or off), members, their role and the date they joined,
• your predictions: orders for qualifying, sprint qualifying, sprint and race, bonus and chaos tips, and your season predictions for the drivers’ and constructors’ standings,
• scoring: points per session, total points and your rank in the group,
• when the app asked you for an App Store rating, so that it does not ask too often.

Who sees what: members of your groups see your username, profile picture, points and rank. They only see your predictions once the deadline of the respective session (or of the season predictions) has passed. Other members do not see your email address. Anyone with a Racetipp account can join a public group, so people you do not know will see this information there. Choose your username and profile picture accordingly.

The legal basis is Art. 6(1)(b) GDPR. Storing rating requests is based on Art. 6(1)(f) GDPR; our legitimate interest is not bothering you with repeated requests.

5. Race data and results

Our server fetches race calendars, grids, results and championship standings from publicly available data sources (OpenF1, API-Sports and the f1db database). No data about you is transmitted in the process. The app loads this data, as well as driver and team images, only from our own server.

6. Notifications

Racetipp can remind you before tips close and tell you about new results, but only if you allow notifications in iOS. For this we store:

• a push token for your device, the platform (e.g. iOS) and the app language,
• your settings (reminders before the race weekend, before each session, skip reminders when you have already predicted, result notifications),
• which notifications we have already sent you, so that none arrives twice.

Our server regularly checks upcoming deadlines and whether you have already predicted. Notifications are delivered through Expo’s push service (650 Industries, Inc., USA) and the Apple Push Notification service (Apple Inc., USA), and on Android devices through Firebase Cloud Messaging (Google).

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give in iOS and can withdraw there or in the app’s settings at any time.

7. Profile picture and clipboard

Profile picture: if you want to set a profile picture, the app opens your photo library. Only the one picture you select is transferred. Our server resizes it and stores it in Supabase’s storage service. So that the app can display it, the picture is available at a web address; anyone who knows that address can see the picture. A profile picture is optional. The legal basis is Art. 6(1)(b) GDPR.

Clipboard: the app only reads the clipboard when you tap “Paste” while joining a group, and only copies an invite code when you copy it yourself. This content is not sent to us, except for the invite code you use to join a group.

8. Storage on your device and widget

The app stores your sign-in session (so you stay signed in), your push token, your app settings and cached data such as predictions, results and leaderboards on your iPhone so that the app starts quickly. The widget receives the data of the next race weekend (race, session times, countdown) through a shared storage area on your device. This is strictly necessary for the app to work (Section 25(2) no. 2 TDDDG). Signing out removes your session.

9. Server and log data

When the app calls our server, the server necessarily processes your IP address, the time and the endpoint called. Our hosting provider may store this information briefly in logs to detect errors and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.

10. Service providers and third countries

We use the following service providers as processors (Art. 28 GDPR):

• Supabase, Inc. operates our database, sign-in and the storage for profile pictures. The data is stored in a data centre in Frankfurt am Main, Germany.
• Railway Corporation (USA) operates our application server in the EU West region (Netherlands).
• the sign-in, email and push services named above.

Some of these providers are based in the USA or may access data from there. We base such transfers on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We do not share your data with any other third parties unless we are legally required to.

11. Retention and deletion

We keep your data for as long as you use your account. You can delete your account at any time in the app under Settings → Delete account. This immediately removes your profile, your race and season predictions, your group memberships, your push tokens and settings, and the list of notifications sent.

Groups you created remain available to the other members; administration passes to the member who joined earliest. If you were the only member, the group is deleted. We delete your sign-in account with the sign-in service and any uploaded profile picture no later than 30 days after you delete your account. If you would like this done sooner, email us at contact@markantsoftware.de.

Our providers’ backups are overwritten automatically according to their retention periods.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

For any request, an email to contact@markantsoftware.de is enough. You may also lodge a complaint with a supervisory authority, for example Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.

13. Changes

When the app changes, we update this policy. The version published here applies. We will inform you about material changes in the app.