Privacy policy

Pit Wall (this site) is a small app run by Stewart Motorsports that sends pit-wall alerts about car #29, AKA SparkleFarts, to anyone who wants to subscribe. This page explains what data we collect when you tap Enable notifications, what we do with it, and how to remove it.

What we collect

When you tap Enable notifications, your browser creates a push subscription. We store the following on our server:

• Endpoint URL — the URL of your browser’s push service (e.g. https://web.push.apple.com/… on iOS, https://fcm.googleapis.com/… on Android Chrome). It lets us deliver notifications to your device.
• Encryption keys (p256dh and auth) — two short public values used to encrypt push payloads so only your device can read them.
• User-Agent string — whatever your browser sent in the request header (e.g. “Mozilla/5.0 (iPhone; …)”). We use it to label devices in the subscriber list.
• Notification preferences — which categories of alerts you’ve opted into (positions, pit state, timer, session, info).
• Your IP address — recorded against an hourly counter so we can rate-limit subscribe requests (max 5 per IP per hour). It is not stored alongside your subscription record and is pruned automatically after a few hours.

We do not collect your name, email address, account info, precise location, browsing history, third-party analytics identifiers, or advertising IDs. The public-facing pages set no tracking cookies; the only cookie this site uses is the admin panel’s signed session cookie, and that’s only set if you sign in as administrator.

How we use it

• The endpoint and encryption keys are used solely to deliver the notifications you opted into.
• The User-Agent helps us recognise which device a subscription belongs to in our administration view.
• Notification preferences control which categories you receive.
• IP address counters are used only to slow down abuse of the subscribe endpoint.

Who we share it with

No one. Pit Wall does not sell, rent, or share your data with advertisers, analytics companies, or any third party. Notifications are encrypted on our server and delivered through your browser’s push service (operated by Apple, Google, Mozilla, or Microsoft depending on your browser) — we hand the encrypted blob to that service and your device decrypts it locally.

Where it lives

All subscription data is stored on a single VPS we operate, in a local SQLite database. The site is served behind a Cloudflare Tunnel that terminates HTTPS. No data is replicated to other providers.

Retention

• Push subscriptions persist until you unsubscribe or your browser’s push service tells us your endpoint is no longer valid (e.g. you cleared site data, switched devices, or revoked permission). In that case we delete the record automatically.
• IP rate-limiting records are pruned after a few hours.
• The notification history (the messages that were sent) is retained on the server but contains no personal data — only the message contents themselves.

How to unsubscribe or delete your data

1. Open the Settings page on the device you subscribed from.
2. Tap Unsubscribe this device at the bottom.

Your endpoint, encryption keys, preferences, and User-Agent are deleted from our server immediately. You can also revoke notification permission entirely in your browser’s site settings to stop the flow even if our server still has a record.

Children

This site is not directed at children under 13 and we don’t knowingly collect data from them.

Changes

If we update this policy, the Last updated date at the top of this page will change.

Contact

This app was developed by Josh Lambeth Design Studio. For any questions about this policy, the app, or your data, please contact [email protected].