Skip to content
RC Paddock
Sign in Sign up
Legal

Privacy Policy

Effective May 17, 2026 · Last updated October 16, 2026

This Privacy Policy explains how RC Paddock ("we", "us", "our") collects, uses, and shares information about you when you use rc-paddock.com (the "Service"). By using the Service you agree to the data practices described here.

Using our “RC Paddock → Facebook” browser extension? Its data practices are covered separately in the Browser Extension Privacy Policy.

1. Information we collect

1a. Information you give us

  • Account: email address, password (stored hashed), display name, handle, optional avatar.
  • Profile: bio, location, shop blurb, notification preferences, racing-scale and surface preferences.
  • Two-factor authentication: TOTP secret (if enabled).
  • Listings and content: photos, descriptions, specs, prices, setup sheets, messages, reviews, comments, Q&A.
  • Addresses: shipping and billing addresses you save for orders.
  • Reports and disputes: any information you submit when reporting a user or opening a dispute.

1b. Information we collect automatically

  • Session and authentication cookies (necessary for the Service to function).
  • Server logs: IP address, user agent, request path, timestamps. Retained for as long as needed for security and abuse-prevention purposes.
  • Error telemetry: stack traces, environment metadata, and a session ID, sent to a self-hosted error-monitoring system on infrastructure we control when something goes wrong.
  • Usage analytics: aggregate page-view data (pages visited, referrer, approximate region, device type) via a privacy-focused analytics system self-hosted on infrastructure we control. It is cookieless — no cross-site tracking and no advertising profiles.
  • Image metadata: on upload we strip EXIF data (including any GPS coordinates) from photos before they are made viewable.
  • Embedded video (YouTube): creator videos can be played without leaving the Service. We do not load the YouTube player unless you choose to play a video by clicking its thumbnail. When you do, YouTube receives your IP address and may set its own cookies, and your viewing is subject to Google's privacy policy. We never upload, copy, or re-host the videos themselves.
  • Images loaded from YouTube: separately from playback, video thumbnails and creator profile pictures on our creator pages are loaded directly from YouTube's image servers. This happens when the page loads, without any action from you, and means Google can see your IP address and which page you are viewing. No cookies are set by us in the process.

1c. Information from third parties

  • If you sign in with a third-party provider (Google, Facebook, or Apple), we receive your email, name, and avatar from that provider. If you use Sign in with Apple and choose “Hide My Email”, Apple gives us a private relay address instead of your real one — we never see your actual email address, and we email you through that relay.

1d. AI apps you connect

  • Connecting an AI app: you can connect a third-party AI app (for example Claude or ChatGPT) to your account. The app first registers with us, giving its name, website, logo and sign-in address. You then sign in to RC Paddock and choose whether to allow it, and whether it may also make changes to your garage or only read it. Nothing is connected until you approve it on our consent screen.
  • What we keep about a connection: the app's registration details, the permissions you granted, when you connected it, when it was last used, and the access tokens issued to it. Tokens are stored hashed, so they cannot be read back from our database. Access tokens expire after one hour; records of expired tokens are kept until they are cleaned up, and all of an app's tokens are deleted when you disconnect it.
  • Activity through a connection: requests an AI app makes on your behalf are handled like requests you make yourself. They are subject to the same server logs (see 1b), rate limits and moderation rules. In addition, each change an AI app successfully makes to your account is logged on our servers with the kind of change, your account, the app and the record it added or changed, never the content itself. Anything the app adds, such as a service entry or a setup sheet, is saved to your account as your content.

2. How we use information

  • Operate the Service (authentication, listings, messaging, offers, orders, notifications).
  • Communicate with you about your account, transactions, and Service updates.
  • Detect, prevent, and respond to fraud, abuse, and violations of our Acceptable Use Policy.
  • Improve the Service (debugging, performance, product decisions).
  • Comply with legal obligations.

3. Sharing

We do not sell your personal information. We share information only as follows:

  • With other Users: your handle, display name, avatar, location (if you choose to display it), public listings, public garages, reviews, comments, and Q&A are visible to other Users. When you complete a purchase, the seller receives your shipping address; when you sell, the buyer receives your shipping address.
  • With AI apps you connect: if you connect an AI app (see 1d), it can read the information you allowed: public information on the Service, and, if you granted access, your own garages, cars, setup sheets, service logs and race results, including ones you have set to private. If you also allowed changes (you can connect an app read-only), it can add entries to your garage (such as service entries, upgrades, runs, build-log posts, race results and setup sheets) but cannot delete anything, and it cannot touch your listings, offers, orders, messages or profile. Once we send information to an AI app, that provider's own terms and privacy policy govern how they handle it, not this Policy. Review them before you connect. We do not sell information to AI providers and we do not share it with them unless you connect their app.
  • “Copy for AI”: the “Copy for AI” button on garage and car pages copies a text summary of that page to your device's clipboard. We send nothing to any AI provider. Where you paste it is up to you, and that service's own terms apply.
  • Service providers: a hosting/infrastructure provider, object storage for images, and a transactional email provider. Each provider is bound by contract to use the data only to provide the service. Error monitoring and usage analytics run on self-hosted systems on infrastructure we control — not third-party vendors.
  • Legal: when required by law, subpoena, or to protect the rights, safety, or property of RC Paddock, our Users, or the public.
  • Successor entity: in the event of a merger, acquisition, or sale of substantially all assets, with notice to affected Users.

4. Your choices

  • Profile visibility: set your default garage visibility (PUBLIC / UNLISTED / PRIVATE), hide your location, and configure per-event notification preferences in Settings.
  • Connected AI apps: see and revoke the AI apps connected to your account in Settings → Connected AI apps. Revoking takes effect immediately: the app's tokens are deleted and it can no longer access your account. To remove data an AI provider already received, contact that provider.
  • Block: block another User from interacting with you.
  • Deactivate: deactivate your account to hide it without permanent deletion.
  • Delete: permanently delete your account from Settings → Delete. Account deletion is blocked while you have open orders. After deletion we retain transaction records and audit logs as required for legal, accounting, and dispute-resolution purposes.

5. Retention

  • Account, profile, listing, message, and order data: kept while your account is active.
  • We keep personal information for as long as needed to provide the Service and for the purposes described in this Policy.
  • After account deletion, we retain the minimum business records (such as transaction history and moderation audit logs) for as long as needed to meet tax, accounting, fraud-prevention, dispute-resolution, and other legal obligations, after which we delete or anonymize them.
  • Server logs are retained only as long as needed for security and abuse prevention.

6. Security

We use industry-standard measures to protect your information, including TLS in transit, hashed passwords, optional two-factor authentication, rate limiting on sensitive endpoints, EXIF stripping on image uploads, and hashed, short-lived access tokens for connected AI apps. No system is perfectly secure; you use the Service at your own risk.

7. Children

The Service is not directed to children under 18 and we do not knowingly collect information from anyone under 18. If you believe a child has provided information to us, contact [email protected] and we will delete it.

8. International users

The Service is operated from the State of Nebraska, USA. If you access the Service from outside the State of Nebraska, USA, you consent to the transfer and processing of your information in the State of Nebraska, USA, which may have data-protection laws different from those in your country.

9. Your rights

Depending on your jurisdiction, you may have rights to access, correct, port, or delete the personal information we hold about you, and to object to or restrict certain processing. To exercise these rights, contact [email protected]. We will respond within the time required by applicable law.

10. Changes

We may update this Policy from time to time. Material changes will be announced via in-app notification or email at least seven (7) days before they take effect.

11. Contact

Questions, requests, or complaints? Email [email protected].