RaceSlot is software that somebody runs. The person or organisation running this deployment decides what it does with your data, which makes them its controller under the GDPR, and this policy is theirs.

Operator

Ricardo Silva

Contact

[email protected]

Write to that address to ask anything in this policy. If it says it is not set, the operator has not finished setting the service up, and you should ask whoever gave you your invite before creating an account.

RaceSlot registers you for an iRacing practice session, withdraws you again, and queues a session for later -- from your phone, from a series list, or from an overlay over the running sim. It is invite-only and free of charge.

RaceSlot never registers, withdraws or joins from a server. Every one of those happens on your own PC, in the iRacing client you signed in to yourself, carried out by a small Windows helper (RaceSlot Agent) that clicks through that client for you when you ask. To show you the series list and the session times, the server signs in to the iRacing website with a read-only sign-in and does nothing there but read.

Your account

• Your email address, which is your identity here, and your password as an argon2id hash with its salt. The hash cannot be turned back into the password, and nobody, the operator included, can read it.
• Optionally a display name (at most 80 characters) and a picture (a PNG of at most 64 KB). Both are shown on your own screens and in the desktop helper's account menu, and nowhere else.
• Which invite code you used, and when you signed up. The code is marked as spent against your account so it cannot be used twice.

Signing in, and the one cookie

• A session: an id, the hash of a random secret, and an expiry. Your browser holds the id and the secret in a cookie named irs_session, which lasts 30 days from the moment you sign in and is not extended by use. The server keeps only the hash, so a copy of the database cannot forge a session.
• Failed sign-in attempts, recorded against your email address and against the network address the request came from, so a wrong password cannot be tried without limit. They count for 15 minutes, and a row more than 24 hours old goes the next time an attempt is recorded -- see “How long it is kept” below, which says what that means when no further attempt ever is. Sign-up attempts are recorded by network address alone, the same way, to stop invite codes being guessed.

Your racing setup, and what RaceSlot did for you

• The names you give your iRacing logins (labels of at most 80 characters), your favourite series and their order, and the car you chose for each. An iRacing customer id is kept beside a stored iRacing sign-in -- recorded when that sign-in is verified, and again on every later check. It is what tells us an ownership answer belongs to the account that asked for it rather than to somebody else's login.
• What you are registered for, as RaceSlot last recorded it: the series, whether it is a practice or a race, and since when. This is what stops a second registration being made on top of the first.
• Your queue: each session you asked for in advance, when it is due, what happened to it, and the trail of decisions the queue took about it (fired, deferred because the PC was off, missed, cancelled).
• Every registration attempt and how it ended -- the series, the kind, the outcome and the guard that refused it, if one did. The last hour of these is what enforces the ceiling of 20 actions an hour. They are kept for the life of your account.
• Every command sent to your PC and the helper's own words about what it saw when it carried it out -- including the text of the controls and rows the iRacing client showed it, which is how a failed click is diagnosed.
• Which cars and tracks you own, once you press “Check what I own”. This is a record of content you have bought from iRacing, so it is worth being plain about what that means here: what is kept is the list of numeric package and content ids iRacing answers with, your customer id, and when the check was made. Not what anything cost, not when you bought it, and no payment detail of any kind -- iRacing does not tell us those and RaceSlot never asks. It is used to mark which rounds of the season you can race, on the calendar and the planner, and for nothing else. iRacing's own catalogue of every car and track it sells is kept separately and belongs to nobody: it is the same list for every driver here and says nothing about you.

What you plan, log and name yourself

Four screens keep something you made or chose to keep, rather than something RaceSlot read -- except stints the desktop helper sends, which the server builds from your telemetry file with no press of yours. None of what they keep is expired on a timer but the copy of that file, which is deleted on one if it is never finished (below), and each goes a different way, so they are listed separately rather than together.

• Your season plan, if you save one on the planner: which series you picked for which week of a season, held as the same short code the planner puts in the address bar, plus the season it belongs to. One plan per season -- replaced each time you save. A plan you only ever share as a link is not stored at all: it lives in the link.
• Lap times logged before 2026-09-21 on the pace tool: a lap time in seconds, with the season, week, series and car class it belongs to, and when you logged it. One per series, week and class. The pace tool stopped logging on that date and nothing writes new ones, but the rows already there are still held, and there is no way to remove a single lap on a screen. A telemetry file you open there never leaves your browser: the laps are read out of the file on your own machine and are gone when the tab closes.
• The stints you save on the stint tool: the name you give it, the car, the track, the session date and the run number -- from your Garage 61 export, or from the telemetry file for a stint the desktop helper sent -- and for each lap its time and when it began, sector times, fuel in the tank, fuel used and added, whether it was an in-lap, an out-lap or clean, and the conditions it was driven in: track and air temperature, humidity, air density, wind speed and direction, and how wet and how rubbered-in the track was. At most 300 of them, each named in at most 80 characters, and you delete one on the same screen. The export itself never leaves your browser: it is read on your own machine, and your name in it is never sent -- from the browser, only a stint you press Save on reaches the server, and stints from the desktop helper are saved without a press, as described below. A telemetry file you attach to a stint (an iRacing .ibt, where this is switched on for your account) is matched to the stint's laps in your browser, and when you save, a reduced copy of its laps is stored with the stint: per lap, speed, throttle, brake, gear, steering, RPM, ride heights, wheel speeds, shock movement, tyre temperatures and pressures, the car's position on the circuit map and the lap clock, at about one point every 2.5 m, plus the file's name, the car and track it names, the track's length and sector splits, and the car setup in it. At most 150 laps of one stint and 2000 MB in all. A telemetry file you attach in the browser stays in it, and nothing in it about anybody else -- names, other cars -- is sent. It goes with the stint, or when you press Remove telemetry. The desktop helper has a Send my telemetry switch, shown only to an account allowed to use it -- for now only the operator's own -- and on by default there. While it is on, the helper sends a cut-down copy of each new telemetry file in the iRacing telemetry folder, or in a folder you choose in its Settings, and of any older one you pick with its Send older sessions button. A file last written before the switch was first on is sent only if you pick it with that button; turning the switch off pauses sending, and a file recorded meanwhile goes once it is back on. The copy holds your car's channels -- those listed above, plus fuel level, pit lane and incident count -- with the lap clock and the session's weather and track conditions, the track, the car's name, iRacing's sector splits and the car setup. That copy never holds the other drivers in the session, your own name or customer id, or where the file was on your PC. Sent with it are the file's name, size, start time and length. The server builds the stints from it, keeps what is described above, and deletes the copy as soon as it has; an unfinished copy is deleted within 25 hours of the last piece to arrive or the last attempt to read it. For each file sent it keeps the file's name, size and start time, so a file it has finished reading is not sent again.
• Car groups you name -- a list of car names under a label such as GT3, kept to fill a series' car list in one go. At most 50 of them, each named in at most 60 characters. Only an administrator of this deployment has the screen that writes them, and whoever wrote one can remove it there.

The desktop helper on your PC

RaceSlot Agent reads the iRacing client's own window through Windows UI Automation, the interface a screen reader uses, and clicks through it. It types nothing into that client but series names and car names. It never reads or sends your iRacing password, and it has no field for one. What it sends to the server is:

• The result of each command, with the evidence described above.
• Its own log, every few seconds, one line at a time (each at most 2000 characters). The log carries what the helper did, what the client showed, and the path of its own settings file -- which includes your Windows user name. Lines are deleted after 7 days, plus at most the 10 minutes between clean-ups.
• Calibration runs, if you press Calibrate: where the client's controls sat at several window sizes, as one document of at most 512 KB. Kept for the life of your account.
• A crash excerpt, if the helper ever ends without warning: the last forty lines of the fault report Python wrote, shipped once on the next start. Those lines carry file paths, and a file path on Windows carries your Windows user name.
• Cut-down copies of your telemetry files, while Send my telemetry is on -- its default where it is offered. Which files, and what each copy holds, are in the stint tool's paragraph above; nothing else of them is sent.
• Your questions to Pitwall, when you ask one: the recording of the question and live facts from the sim, with the cars directly ahead and behind you named. What they hold and where they go is under Pitwall, below.
• Your PC's computer name, sent once when you sign the helper in and kept as the label on its token, so a second PC can be told apart from the first.

On the PC itself the helper keeps a settings file (the server address, your email, the dry-run, tray and overlay preferences, the Send my telemetry switch, the telemetry folder you chose instead of iRacing's, if you chose one, when that switch was first on, and its polling token, and Pitwall's: whether it is on, whether it wakes to Hey Pitwall, the wheel button or key you picked, whether callouts are muted, and where its card sits), the web session it uses for the Series and account panes -- encrypted with Windows DPAPI so only your Windows account on that machine can open it -- its calibration record, the crash log, a record of each telemetry file it has sent, and of each it could not send, with the reason, and, while it is sending one, the cut-down copy, in a telemetry-cut folder beside its settings, deleted when each try at sending it ends, or at the helper's next start. Nothing of the server's is written there; nothing on the PC is read but the iRacing client's window and, while Send my telemetry is on -- its default where it is offered -- the one flag in the sim's live data that says whether it is running, the iRacing telemetry folder or the one you chose instead, any older file you pick to send, and, while Pitwall is on (its default where it is offered), the sim's live telemetry and the microphone, as described under Pitwall below. A recording made for Pitwall is held in memory for the request and is not written to your PC.

Pitwall, the race engineer

Pitwall is a part of the desktop helper that answers spoken questions about your session. It is an Experimental tool: Pitwall is shown only to an account allowed to use it -- for now only the operator's own -- and on by default there. While it is on, the helper reads iRacing's live telemetry on your PC (the sim's shared memory, not a file) and works out facts from it. Nothing is recorded until you press your button or say Hey Pitwall. The phrase is a switch that is off until you turn it on; while it is on, Windows' own speech recogniser listens on your PC, offline, for that phrase only, and what it hears is neither kept nor sent. Nothing recorded is kept on your PC.

Pitwall can set your pit service. When you ask it to, it reads the plan back and, only when you press the pit confirm button, sends iRacing's own pit-command message to the sim on your PC: fuel, which tyres to change, the windscreen, a fast repair. It does nothing else in the sim. A moment later it reads the pit box back and sends those few figures -- the litres and how many tyres are set -- to the RaceSlot server, to be spoken to you.

When you ask, what leaves your PC is:

• Your recorded question, as a sound file of at most ten seconds.
• Facts from the sim's live data: your fuel, the laps and time left, your lap and position, the weather and the track, and the flags -- and the cars directly ahead and behind you, with their driver names, car numbers, gaps, last lap times and pit stops. Those are other people's names, as iRacing shows them to everyone in the session. A line Pitwall says unprompted -- fuel running short, the lap to box, a change of weather, a penalty flag -- sends only the few facts that line rests on.

Both go to the RaceSlot server, which sends them on to the two companies named under “Who sees your data”, in the United States, outside the European Union. That is a transfer of personal data out of the Union, made each time Pitwall answers or speaks a line unprompted; what each company does with what it receives is under its own terms, not the operator's. What comes back to your PC is the transcript of your question, the answer text and a few short labels (chips) that can name the cars ahead and behind you, and the spoken audio. They are shown on the card for ten seconds and played; none of it is saved on your PC.

What RaceSlot itself stores:

• A usage count: one row for each answer or unprompted line -- who, which kind, when, and nothing of what was said. It is what enforces at most 200 answers and 100 unprompted lines a day for each person.
• Your chosen language and voice, from the Pitwall page.
• The helper's usual Activity-log lines about Pitwall -- that it started, that callouts were turned off or on, why a press could not be answered -- shipped with the rest of its log and deleted after 7 days like the others (above). The log names no driver.
• One log line per answer, with how long it took and whether its checks passed -- no question text and no names. The preview on the Pitwall page sends ElevenLabs a fixed sample sentence and nothing about you.

The recording, the transcript, the facts and the answer are not stored by RaceSlot: they exist for the length of the request. The two companies may keep them under their own terms, which the operator does not control and cannot delete.

The server's own read-only iRacing sign-in

The series list and each favourite's practice and race times are printed on the iRacing members site and in no API this product can reach, so the server reads them there with a headless browser, about every 10 minutes. Whose sign-in it uses is the operator's choice, and there are two shapes:

• The operator's own iRacing account, the default. Its email and password live only in the server's environment, are never written to the database, are returned by no page and appear in no log. Your data is not involved: what is stored for you is the series list and the timers it read, the same facts for everybody.
• Your own iRacing sign-in, if you add one. You may enter your iRacing email and password on Account or from the calendar's “Can I race it?” card, and remove them there at any time; removing them stops every use of them. This is stored whether or not the operator has set one of their own, because the one thing it is needed for -- checking which cars and tracks you own -- is the most account-specific thing iRacing knows, and the operator's login could only ever answer for the operator. Where the operator has set none, the same sign-in is also what reads your session timers. The email is stored in clear so the card can show which login it holds. The password is stored as an AES-256-GCM ciphertext under a key that lives in the server's environment and never in the database, so a copy of the database alone yields nothing -- but a copy of the database plus the environment yields the password. That is weaker than a password sealed under your own RaceSlot password, and it is the price of reading on a timer with nobody signed in. It is stated here rather than hidden.

Whichever sign-in is used, it reads and nothing else. No part of RaceSlot registers, withdraws, joins, buys or changes anything on iRacing through it; the code says so at the boundary, and it does nothing there but read.

Server logs

The server writes an operational log that Railway collects: boot lines, one line per read of the iRacing site, one line per Pitwall answer (how long it took and whether its checks passed), and the reason a read failed. It is written so as not to carry your data -- it names series, never people -- and the helper's shipped log is stored in the database, not printed there. Railway's own edge keeps request logs (addresses, paths, times) under its own retention, which the operator does not control.

• To provide what you asked for (contract, GDPR article 6(1)(b)): your account, your sessions, your favourites and cars, the commands to your PC, the queue, and the series list and timers shown to you, and what Pitwall says when you ask it.
• To keep the service safe and working (legitimate interest, article 6(1)(f)): the sign-in rate limits, the record of attempts behind the hourly ceiling, the helper's log, calibration runs and crash excerpts. The interest is diagnosing a failed click on a machine nobody else can see; you can end the log by stopping or uninstalling the helper.
• Your own iRacing sign-in, when you add one (consent, article 6(1)(a)), withdrawn by removing it on Account.

RaceSlot sets exactly one cookie, irs_session, and only once you sign in. It is strictly necessary -- it is what makes you signed in -- and it is marked HttpOnly, Secure and SameSite=Strict, so no script can read it, it never travels over plain http, and no other site can send it.

There is no analytics, no advertising, no tracking pixel and no third-party script of any kind; the fonts are served from this site. Because nothing optional is ever set, there is no cookie banner to click through: the law asks for consent only for what is not strictly necessary, and here there is nothing of that sort.

• The operator, who runs the server and can read its database and the helper's shipped log -- which they do to diagnose a problem you report.
• Railway, which hosts the server and its database as the operator's processor, in europe-west4 (the Netherlands, in the European Union). The database is one file on a volume there.
• iRacing receives what your own client sends when the helper clicks, exactly as if you had clicked -- from your PC, never from this server. The server's read-only sign-in sends iRacing the operator's credentials (or, in the fallback shape, yours) and reads pages.
• Cloudflare, which answers the domain name and, when the operator has its proxy switched on, also carries your requests to and from Railway as the operator's processor. Carrying them, it sees what any carrier sees -- your IP address and each request's headers, which it keeps in its own security logs under its own retention -- and handles the rest only in passing; it stores no page and no form you send. It never holds the database, your password hash or the stored iRacing sign-in. With the proxy off, the name resolves straight to Railway and Cloudflare sees only the lookup.
• ElevenLabs receives your recorded question, to turn it into text, and the text of the answer, to speak it. The answer text can name the cars directly ahead and behind you. The recording does not go from your PC to ElevenLabs: it passes through the RaceSlot server, which sends it on. ElevenLabs is in the United States, outside the European Union.
• Anthropic receives the text of your question and the facts, to word the answer with its Claude model. The facts can include the driver names and car numbers of the cars directly ahead and behind you. Anthropic is in the United States, outside the European Union.

Both of those receive what the helper sends only when Pitwall answers you or speaks a line unprompted (which Callouts off stops). Two other things reach them, and they carry nothing about you: the voice preview on the Pitwall page, which sends ElevenLabs a fixed sample sentence, and the lists of voices and languages the server fetches to fill that page. Nobody else. Nothing is sold, shared for advertising, or sent to anyone not named here.

• Your account and everything filed under it: until you delete the account.
• A session: 30 days from sign-in, or until you sign out.
• Failed sign-in and sign-up attempts: counted for 15 minutes, and deleted once they are more than 24 hours old the next time an attempt is recorded. There is no timer behind that: if nobody mistypes a password or tries an invite code again, the last rows stay. They hold the email address that was typed and the network address it came from -- or, for the attempts at signing in to the iRacing website with a login you stored, yourRaceSlot account id -- and nothing else. Deleting your account removes the ones carrying its email or its id at once.
• The helper's log lines: 7 days, plus at most the 10 minutes between clean-ups.
• Registration attempts: the life of the account. They are the record of what this app asked iRacing to do, and the basis of the 20-an-hour ceiling, so they are not expired on a timer.
• Commands sent to your PC: 30 days after they finish. One still waiting or in progress is never expired.
• Queued sessions and the queue's trail: 30 days after they finish, are missed or are cancelled. One still queued or running is never expired.
• Calibration runs from the helper: the newest 100 are kept, and older ones are dropped as new ones arrive.
• Pitwall's usage counts: 48 hours, then deleted -- the next time anybody's answer is counted. There is no timer behind that: if nobody asks Pitwall anything again, the last rows stay. They say that you asked, which kind, and when, and nothing else.
• Your chosen Pitwall language and voice: until you change it or delete the account.
• A Pitwall recording, its transcript, the facts and the answer are not kept by RaceSlot at all, so there is nothing to expire.
• Four of those are swept when the next row of their own kind is written -- the helper's log, the commands to your PC, the queue and the calibration runs -- so a row can outlive its window by up to the 10 minutes between sweeps, and if nothing new is ever written, the last rows stay. Registration attempts are not swept at all, for the reason given above.
• Your saved season plan: not expired on a timer. One per season, replaced each time you save, and removed with your account.
• The lap times logged before 2026-09-21: kept until you delete your account, not expired on a timer. Nothing writes new ones, and there is no way to remove a single lap on a screen -- deleting your account removes them all.
• The stints you save, with any telemetry saved with them: not expired on a timer. Each stays until you delete it on the stint tool, or the account goes.
• A telemetry file the desktop helper sends: the copy is deleted as soon as the server has read it, and one left unfinished within 25 hours of the last piece to arrive or the last attempt to read it -- on a timer of the server's own, so that holds even if the PC never comes back. What stays is the record of each file it sent -- the file's name, size and start time, and the line saying how it went -- not expired on a timer: it is kept until you delete the account, so a file the server has finished reading is not sent again.
• Car groups: not expired on a timer. They stay until whoever wrote one removes it on the screen that made it, or the account goes.
• The series list and the timers: replaced by each new read.
• Which cars and tracks you own: not expired on a timer, and deliberately so. What you own changes when you buy something, which RaceSlot has no way to notice, so an expiry date here would be a promise about freshness it cannot keep -- and re-checking costs a real sign-in to iRacing. Instead the screen always shows when the answer was last checked and offers to check again. It is replaced by the next check, and removing that sign-in deletes it along with the sign-in itself. Deleting your account removes it with everything else. iRacing's shared catalogue is not yours and is not removed with your account, the same way the circuit information the calendar draws is not.

Under the GDPR you may ask to see the data held about you, to have it corrected, to have it deleted, to receive a copy in a portable form, to have its processing restricted, and to object to processing based on legitimate interest. Where you gave consent, you may withdraw it.

• See and correct: your name, picture and labels are on Account; your favourites and the cars you take in each are on Favourites. Your email cannot be changed on a screen; write to the operator.
• Delete: Account has a Delete your account control. It asks you to type your email, and it removes the account and everything filed under it at once -- labels, favourites, cars, sessions, the helper's tokens and log, the queue, every recorded attempt and command, any stored iRacing sign-in, the record of which cars and tracks you own, the record of which telemetry files the helper sent, with any copy it was still sending, and Pitwall's usage counts and your chosen language and voice. It refuses while you are still registered for a session (withdraw first; deleting the record would not take you out of the session on iRacing) and while your PC is in the middle of a command. The invite code you used stays spent.
• Anything else, or a deletion you cannot do yourself: write to [email protected]. The operator answers within a month.
• Complain: to the supervisory authority where you live. For Portugal that is the CNPD, the Comissão Nacional de Proteção de Dados (cnpd.pt).

Passwords are hashed with argon2id. Sessions and the helper's tokens are stored hashed, so a stolen database is not a stolen sign-in. Everything travels over https, with HSTS, and every page carries a content security policy that lets only this site's own scripts run. Sign-in and sign-up are rate-limited. The operator's own iRacing credentials are held in the server's environment only. The helper refuses to talk to any server address that does not begin with https://, and on the PC it keeps its web session under Windows DPAPI.

What that does not cover, said plainly: the fallback iRacing password can be recovered by somebody holding both the database and the server's environment; the helper's polling token sits in a plain settings file on your PC, readable by anything running as you there; and the helper's log ships automatically while it runs.

RaceSlot is not for anyone under 16, and no account should be created for them.

The version and the date at the top change whenever a promise in this policy changes. The operator will tell account holders about a change that matters before it takes effect.