Privacy Policy

1. Controller

Martin Naglmayr (“SimDeckOS”), Sportplatzstraße 22d, 5303 Thalgau, Austria — email: support@simdeckos.com (see the imprint). No data protection officer is appointed, as none is required.

This policy covers the website simdeckos.com, the user account, the Studio (studio.simdeckos.com) and the SimDeckOS software (SimHub plugin and Stream Deck plugin).

2. Visiting the website

The website and the Studio are served by Vercel Inc. (USA). When you visit, technically necessary data is processed — IP address, date and time, requested address and browser identifier — to deliver the pages and fend off attacks. Legal basis: our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

We set no cookies and use no analytics or advertising services; fonts are served from our own server. When you sign in, your browser keeps the session in local storage so that you stay signed in. This is strictly necessary for the service you asked for (§ 165(3) Austrian Telecommunications Act 2021); signing out removes it.

The pricing page loads the Lemon Squeezy checkout; Lemon Squeezy then receives your IP address and browser data (see section 7).

3. User account

The Content Library, the Studio, cloud backup and Premium need an account. We process your email address, your password (only as a hash), an optional display name, your account role, the time of sign-up and confirmation, and your consents (section 4). Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Accounts and the database are run by Supabase Inc. (USA) as our processor; the data is stored in a data centre in Ireland (EU). The SimDeckOS software signs in through the same interface and keeps your email address and an encrypted sign-in token in its local settings file on your PC.

SimDeckOS administrators can access account data where needed for support, moderation and abuse prevention. New sign-ups are announced to administrators by push notification showing the name or email address.

4. Emails

Account emails

Sign-up confirmation, sign-in codes, password resets and notices about changes to your account are part of the contract and are always sent (Art. 6(1)(b) GDPR). Sent via Resend Inc. (USA).

Release news

Only if you switch it on at sign-up or in your account do we email you about new versions. The consent takes effect only once you confirm your address (double opt-in); we keep the time and the wording as proof. Legal basis: consent (Art. 6(1)(a) GDPR, § 174 Austrian Telecommunications Act 2021). You can withdraw it at any time via the unsubscribe link in every message or in your account.

You can also sign up for this news without an account, on the download page (“Notify me”). We then store your email address, the wording and time of your consent, and the time you confirmed it. The consent takes effect only once you click and confirm the link in our confirmation email (double opt-in); until then we send you nothing else. To prevent abuse we keep a hashed form of your IP address and email address for one day to limit the number of sign-up attempts. Legal basis: consent (Art. 6(1)(a) GDPR, § 174 Austrian Telecommunications Act 2021), and for the abuse limit our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The emails are sent through Resend Inc. (USA) as our processor. You can withdraw your consent at any time, with effect for the future, via the unsubscribe link in every message.

Replies

Replies to bug reports and enquiries are sent through Resend Inc. (USA); the reply's content and recipient are stored for our records.

5. Content Library and Studio

Content you publish (e.g. cars, looks, layouts, laps) is shown publicly with your display name; without one it shows “Community” — your email address is never published. Ratings, including their text, are public; favourites are visible only to you. Drafts stay private until you publish them. Legal basis: the contract (Art. 6(1)(b) GDPR).

6. SimDeckOS software

SimDeckOS runs locally on your PC. Game data (telemetry) is processed there and not transmitted — except by the features below, which you trigger or switch on yourself:

• Update check and content packs: at start-up and at intervals the software fetches version information and content packs (themes, car and telemetry data) from simdeckos.com or Supabase. This transmits your IP address and no other personal data. Legal basis: legitimate interest in secure, up-to-date software (Art. 6(1)(f) GDPR).
• Premium: whether Premium is active is checked against your account; no device or hardware identifier is used.
• Cloud backup (Premium, on request only): stores your settings — without sign-in data, licence fields or your Windows user name in file paths — your rig's name, the Windows computer name and the app version. The last five backups per rig are kept; you can delete rigs in your account.
• Lap sharing (only when switched on): when enabled, your reference laps (car, track, lap time, speed/throttle/brake traces and TC/ABS/brake bias) are uploaded to your account as a private draft. They become public only if you publish them in the Studio.
• Bug reports (on request only): title, description, email address (editable), app version, Windows version, game, device models and — if you choose so after a preview — the last part of the log file. The log may contain file paths with your Windows user name. To prevent abuse we store a keyed hash of your IP address, not the address itself.
• Studio connection: the software offers a local interface on your PC so the Studio in your browser can show live data. That data does not leave your PC.

Unless stated otherwise, the legal basis is the contract (Art. 6(1)(b) GDPR).

7. Payments

Premium purchases are handled by Lemon Squeezy LLC (USA) as reseller (merchant of record). For payment and invoice data Lemon Squeezy is itself the controller and processes it under its own privacy policy. We only receive which subscription belongs to which account, its status and term — no payment details.

8. Recipients and transfers outside the EU

Processors are bound by contracts under Art. 28 GDPR. These providers are based in the USA; where personal data is transferred there or can be accessed from there, this relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework (for certified providers) or on the Commission's Standard Contractual Clauses (Art. 46 GDPR).

9. Retention

• Account data: until the account is deleted; deletion also removes cloud backups, drafts, ratings, favourites, and your bug reports with our replies.
• Consent records: until withdrawal, then up to three years as proof.
• Release-news sign-ups without an account: until you unsubscribe, then up to three years as proof; unconfirmed sign-ups are deleted after 30 days, and the hashes used to limit abuse after one day.
• Cloud backups: the latest five per rig; older ones are deleted daily.
• Bug reports and our replies: 24 months from receipt, then deleted automatically.
• Vercel server logs: briefly, per the provider.
• Invoice data at Lemon Squeezy: per statutory retention duties.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Write to support@simdeckos.com. You can delete your account yourself at any time: Account ▸ “Delete account”; you choose whether what you published is removed or stays without your name.

If you believe the processing of your data breaches data protection law, you can lodge a complaint with a supervisory authority — in Austria the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Account data is required to use the account features; you can use the free core of the software without an account. There is no automated decision-making, including profiling.