This policy explains what Discovery Coaching, LLC ("we", "us") collects through Track Data Coach at data.thetrackcoach.com (the "Service"), why, who sees it, and what you can do about it.
Two things worth knowing before the detail.
Session files contain precise location. A data-logger export records GPS latitude and longitude roughly twenty times a second. That is precise geolocation, and under California law it is sensitive personal information. We treat it that way.
Most people in our database never signed up. They are drivers whose data a coach uploaded. This policy is written for them too — see sections 3 and 10, and you can contact us directly whether or not you have an account.
This policy applies to account holders (coaches and drivers who sign in), drivers whose data has been uploaded by someone else, and visitors to the site. Discovery Coaching, LLC is the business responsible for the data — the "controller", if you are used to that term.
| Category | What it is | Where it comes from |
|---|---|---|
| Account | Email address, name, profile photo if you upload one, which sign-in provider you used, and the times you signed in. | You, or Google/Microsoft when you sign in with them. |
| Driver records | A driver's name, email address (optional), experience level, notes, and — for a driver aged 16 or 17 — a parent or guardian's name and email. | Typed in by a coach, or by you about yourself. |
| Vehicle records | Year, make, model, trim, colour, nickname, and optionally weight, tyres and setup notes. | Typed in by a user. |
| Session data sensitive | The uploaded logger file and everything derived from it: GPS latitude and longitude at roughly 20 samples per second, speed, acceleration, altitude, heading, satellite quality, lap times and computed metrics. Also the date and time the session was recorded. | The data-logger export you upload. |
| Track day context | Date, track, event name, organising club, air and track temperature, surface condition, notes. | Detected from the file, or typed in. |
| Usage and technical | Application log entries about actions taken (uploads, edits, sign-ins, failures) and standard server logs kept by our hosting provider, which include IP addresses. | Automatically, as you use the Service. |
What we deliberately do not collect: we do not ask for or store payment card numbers (any future payments would be handled by a payment processor, and we would only ever see a token and the last four digits), we do not collect your precise location from your phone or browser, and we do not buy personal information from data brokers.
A note on our logs. Our application log records what happened — "a session was uploaded", "an upload was rejected because it exceeded the size limit" — using record identifiers rather than content. It is written not to contain credentials, and where a credential problem needs diagnosing we log the length of the value and never the value.
Most driver records here belong to people without accounts — students at a coaching day whose instructor uploaded their session. We are relying on that coach having permission. Our Terms of Service require them to have asked you first, to have told you what this policy says, and to delete your data if you change your mind.
If you are one of those drivers, you can deal with us directly. Email dave@thetrackcoach.com and we will tell you what we hold about you, correct it, stop sharing it, or delete it — whether or not the coach who uploaded it agrees. You do not need an account, and you do not need to explain why.
We do not use session data or driver records for advertising, we do not profile anyone for marketing, and we do not use your data to train general-purpose machine-learning models for third parties.
We do not sell personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined in the California Consumer Privacy Act as amended by the CPRA. We have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for any purpose other than those permitted without an opt-out right under California law.
The Service can publish a session to a library other coaches and drivers can learn from. Everything is private by default. Publishing is a deliberate act, and the software enforces the following — it is not left to somebody remembering:
Agreeing to share does not put your name, your email address, your experience level, a coach's notes about you, or a description of your car in front of anyone. What another coach sees is:
Both codes are required before a session can be published at all, and that cuts both ways on purpose: the codes are what keeps the name out of it, and they are also what makes one shared driver distinguishable from another, so a coach can follow a set of laps across a day rather than stare at a column of identical blanks.
We are not going to call this full anonymity. An abbreviation and a car code, next to a date and a track, could let somebody who was in that paddock work out who is who. It is a deliberate trade — enough separation to protect the person, enough distinctiveness to make the data worth reading — and we would rather describe it plainly than call it anonymised and be wrong. If that trade is not one you want to make, do not share: nothing is shared unless somebody turns it on, and turning it off pulls it back.
A coach is responsible for only sharing a student's data where that student has agreed to it. The Service records the agreement and refuses to publish without one, but it cannot witness the conversation.
Un-publishing stops further distribution but cannot recall what someone has already seen or downloaded. That is a limit of the internet, not a policy choice, and we would rather say so.
The Service is not for children. Accounts are for adults aged 18 or over. We do not knowingly collect any information about a person under 16.
Data about a driver aged 16 or 17 may only be uploaded with their parent's or legal guardian's prior agreement, which the coach must record in the Service. Such data is never eligible for the Reference Library. A parent or guardian may email dave@thetrackcoach.com at any time to review, correct or delete their child's data, and we will do so promptly.
If we learn we have collected data about a person under 16, we will delete it.
| What | Kept for |
|---|---|
| Account and driver records | While the account is active, and for up to 30 days after deletion so an accidental deletion can be undone. |
| Session files and derived data | Until you delete them or your account. Historical sessions are the point of the product, so we do not expire them on our own initiative. |
| Backups | Up to 90 days, then overwritten on their ordinary cycle. |
| Application logs | Up to 12 months. |
| Records of a consent decision | For as long as we hold the related data, plus a reasonable period afterwards — the record of a "no" is what proves we honoured it. |
We may keep data longer where we must to comply with law or to defend a legal claim.
Wherever you live, you can ask us to:
Email dave@thetrackcoach.com. We aim to respond within 30 days and will tell you if we need longer. We will not discriminate against you for exercising any of these rights — you will not lose access or get a worse service for asking.
We may need to verify who you are before acting, usually by confirming control of the email address on the record. An authorised agent may act for you with written permission we can verify.
If you are a California resident, the CCPA as amended by the CPRA gives you the rights to know, delete, correct, and to opt out of sale or sharing — and to limit the use of sensitive personal information. As stated in section 5, we do not sell or share personal information, so there is nothing to opt out of, and we do not use sensitive personal information for purposes that trigger the right to limit.
The categories in section 2 map to the statute's categories as follows:
| CPRA category | Collected? | What |
|---|---|---|
| Identifiers | Yes | Name, email address, account identifier, IP address. |
| Customer records (Civ. Code §1798.80) | Yes | Name and email address in a driver record. |
| Internet or network activity | Yes | Application and server logs of your use of the Service. |
| Precise geolocation — sensitive | Yes | GPS coordinates within a session file, and the track they identify. |
| Commercial information | Limited | Records of your use of the Service. No purchase history while the Service is free. |
| Audio, electronic, visual | Limited | A profile photo, if you upload one. |
| Biometric, health, genetic; racial or ethnic origin; religion; union membership; contents of mail; immigration status; sexual orientation | No | We do not collect any of these. |
| Inferences used to create a profile | No | We derive driving metrics from your data; we do not profile you as a consumer. |
We collect these for the business purposes in section 4, and disclose them only as described in section 6. Under California's "Shine the Light" law (Civ. Code §1798.83) you may ask what personal information we disclosed to third parties for their direct marketing purposes; the answer is none, because we do not do that.
We are a small business in the United States and the Service is aimed at a US audience, but drivers travel. If the GDPR or UK GDPR applies to you, our legal bases are: contract (running the Service you signed up for), legitimate interests (keeping it secure, improving it, defending claims), consent (publishing to the Reference Library, and any marketing email — withdrawable at any time), and legal obligation where one applies.
Precise location data is not special-category data under the GDPR, but we treat it with the same care. You also have the rights to object, to restrict processing, and to lodge a complaint with your supervisory authority. Where a coach uploaded your data, we act as controller for it and you may contact us directly.
We use one strictly necessary cookie: a session cookie that keeps you signed in. It is marked HttpOnly, Secure and SameSite=Lax, and it is deleted when you sign out.
We use no advertising cookies, no analytics cookies and no third-party trackers. If that ever changes we will update this policy and, where required, ask for your consent first. We honour Global Privacy Control signals; since we do not sell or share personal information, there is nothing for such a signal to switch off.
Signing in with Google or Microsoft sends you to their site, where their own privacy policies apply.
We take reasonable measures to protect your data: transport encryption (HTTPS), sign-in through established identity providers rather than passwords we store, session data files held outside the web-accessible directory so they cannot be fetched by URL, database access scoped so one account cannot read another's records, and sharing rules enforced in the server rather than in a form.
No system is perfectly secure and we will not claim otherwise. If a breach affects your personal information we will notify you and any regulator as required by law, without unreasonable delay.
We store and process data in the United States. If you are outside the US, using the Service means your data is transferred there, where privacy laws differ from your own. Where a recognised transfer mechanism is required, we rely on the European Commission's Standard Contractual Clauses or an equivalent.
We may update this policy. The "Last updated" date at the top will change, and if a change materially affects how we handle your data we will give notice by email or in the Service before it takes effect. Material changes to how we use existing data will not be applied retroactively without your agreement.
Questions, requests, or a complaint — including from someone who never signed up:
Discovery Coaching, LLC
550 Keats Ct., Discovery Bay, CA 94505
dave@thetrackcoach.com