Privacy Policy

Sly Paddock is operated by Sly Trunk, LLC, which is the data controller for the personal data described in this policy.

Account data: email address and display name (via Firebase Authentication, email/password or Google sign-in).

Steam data (if you link your Steam account): your Steam ID, public display name, and avatar image URL, retrieved via the Steam Web API.

Payment data: if you subscribe to a paid tier, Stripe processes and stores your payment card details directly — we never see or store your full card number. We store your Stripe customer ID and subscription status to know which tier you're on. For usage-billed tiers (Community), we also report your metered server-hours to Stripe to calculate your charges.

Race and server data: session results, lap times, car/track selections, and server configuration you create, stored in Firestore and BigQuery so leaderboards and history work.

In-game driver data: when a driver joins a server hosted through the Service, we record their in-game name, Steam ID, lap times, and session results — including for drivers who don't have a Sly Paddock account. This data is displayed on leaderboards visible to other signed-in users. If you've driven on a hosted server and want this data removed, submit a request through our contact form at https://slypaddock.com/contact.

Contact form data: if you use the contact form, the name, email address, and message you submit. We also briefly process your IP address to rate-limit submissions and prevent abuse.

Technical/log data: IP addresses and request logs are captured automatically by Google Cloud Platform as part of standard infrastructure operation (not for tracking or advertising purposes).

We use Google Analytics 4 to understand how the site is used, and Google Ads to measure ad conversions. Once you accept, both collect usage data (pages visited, approximate location derived from your IP address) and device/browser information, and set cookies to distinguish visitors. Google processes this data on our behalf as an analytics/advertising provider, governed by Google's own privacy policy.

We use Google Consent Mode. On your first visit we show a consent banner; until you choose "Accept", Google Analytics and Google Ads receive only an anonymized, cookieless signal — no cookies are set and you are not individually identified — which Google uses for aggregate statistical modeling of traffic and conversions. Choosing "Accept" enables the full cookie-based tracking described above. Choosing "Decline", or simply never choosing, keeps you on the anonymized, cookieless signal only.

To withdraw consent after accepting, clear this site's cookies and site data in your browser — that removes both the analytics cookies and your stored choice, and the banner will ask again on your next visit. You can also opt out of Google Analytics across all sites by installing Google's browser opt-out add-on at https://tools.google.com/dlpage/gaoptout, or by using a browser or extension that blocks analytics scripts.

We do not use ad pixels or session-replay tools, and we do not sell your personal data to third parties.

- Account data: to authenticate you and associate your servers/results with your account.

- Steam data: to display your racing identity consistently across servers and leaderboards, if you choose to link it.

- Payment data: to bill paid subscriptions and manage upgrades/downgrades/cancellations.

- Race and server data: this is the core function of the Service — recording and displaying your race results and leaderboards.

- Technical/log data: security, abuse prevention, and debugging infrastructure issues.

- Stripe (payment processing) — receives what's needed to bill you, including metered server-hours for usage-billed tiers; governed by Stripe's own privacy policy.

- Valve/Steam — receives your Steam ID when you initiate account linking, per Steam's own OpenID sign-in flow; we don't share additional data with Valve beyond what the Steam login flow itself requires.

- Google Cloud Platform — our infrastructure provider (Firebase Auth, Firestore, BigQuery, Cloud Functions, Compute Engine). Data is stored and processed on Google Cloud infrastructure, not shared with Google for advertising purposes.

- Google (analytics and ads) — receives an anonymized, cookieless signal from Google Analytics and Google Ads at all times, used only for aggregate statistical modeling; if you accept analytics, it additionally receives the full usage data described in the analytics section above.

- Resend (email delivery) — contact form submissions (your name, email address, and message) are delivered to us via Resend, our email service provider.

- Cloudflare (abuse prevention) — the contact form uses Cloudflare Turnstile to block automated abuse; when you use the form, technical signals (including your IP address and browser characteristics) are sent to Cloudflare for verification.

- Webhook endpoints configured by server owners — a server owner can configure a webhook URL that receives race results from their servers (including driver names and lap times) after each session. Where those results are sent is chosen by the server owner, not by us.

Beyond the services listed above, we do not share your data with other third parties.

Account and race/session data is retained for as long as your account is active.

Deleting your account (Profile → Delete account) immediately deletes your personal data: your Firebase Authentication account, your email and display name, your Steam link, your API key, and the configuration of any servers you created. Any servers still running are stopped and any active subscription is canceled as part of the same action.

Race results and lap times recorded under your linked Steam ID are not deleted — they are anonymized in place: your in-game name and Steam ID are replaced with a non-identifying placeholder, so the race classifications and lap records other drivers appear in stay intact. Anonymized race statistics (which no longer identify you personally) may be retained indefinitely for leaderboard/historical purposes.

Payment and server-usage records are retained after deletion where required for legal/tax record-keeping (for example, Stripe invoices and the server-hours those invoices were calculated from).

Depending on where you live, you may have rights to access, correct, export, or delete your personal data (for example, under GDPR in the EU/UK or CCPA in California). To exercise these rights, submit a request through our contact form at https://slypaddock.com/contact and we will respond within a reasonable timeframe.

You can unlink your Steam account at any time from your Profile page, and you can delete your account yourself from the same page (Profile → Delete account) — see "How long we keep it" above for exactly what that deletes and what is retained.

Signing in sets a strictly necessary session cookie ("__session", httpOnly) that keeps you signed in for up to 14 days. This cookie is required for the Service to function and is not covered by the consent banner.

If — and only if — you accept analytics, Google Analytics and Google Ads set cookies to distinguish visitors, as described in the analytics section above. Before you accept (or if you decline), Google sets no cookies at all — only the anonymized, cookieless signal described in the analytics section above is sent.

The Service also uses browser local storage for your cookie-consent choice (so we don't ask again on every visit) and for interface preferences (for example, remembering which servers you've hidden in your dashboard).

The session cookie and local-storage preferences are strictly necessary for the Service to function and are not used for advertising or cross-site tracking.

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact us through our contact form at https://slypaddock.com/contact and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date on this page.

Questions about this Privacy Policy, or a data access/deletion request? Reach us through our contact form at https://slypaddock.com/contact.