Privacy Policy

This policy explains how Pistonhouse HQ (“Pistonhouse HQ,” “we,” “us”) handles information when you use the PITVUALT mobile app, the PITVUALT Link device, and this website (together, the “Service”). The short version: your setups are private by default, we don’t run ads, we don’t sell your data, and you can export or delete it whenever you want.

1. Information we collect

You give us

• Account details: name, email, and (optionally) phone number, collected when you sign in with Google, Apple or an email link.
• Profile photos: if you sign in with Google, the first time you sign in we copy the profile photo from your Google account as your avatar. You can replace it with a photo you take or upload, or remove it, in the app’s Me tab. You can also add a photo to a driver profile. Avatars are shown to members of your teams (including viewers). They are stored at a long, hard-to-guess web address, so anyone who is given that exact address could see the image; they are not listed or searchable.
• Racing data: cars, setups, results, lap times, notes, voice notes, photos (car photos, gear tags, setup sheets), costs and winnings, inventory, team names and logos.
• Driver hub data: safety gear types, standards and dates, track license and transponder numbers, and an emergency contact you choose to add.
• Crew data: names, phone numbers or emails of people you invite, their roles, and RSVPs. Only invite people who expect to hear from your team.
• Track reports: conditions you report, chosen from a fixed set of chips (no free-text notes), and banking you measure. These are shown to other users with your display name or anonymously, as the app indicates.
• Crew feed comments (only if your team uses the crew feed): comments you write on your team’s feed. Comments are visible to your team only.
• Pit check-ins (only if your team checks in): the track, your team name, class and car number. Others checked in at the same track see them for up to 12 hours; we keep the check-in 7 days after it ends for safety reviews, then delete it. We never use GPS for check-ins.
• Gear listings and messages (only if you use them): what you list (title, description, price, classes, condition, photos, safety gear dates, an optional serial number and car history line) and messages you send about a listing. We store only an approximate location: your pickup track or an area snapped to about 3.5 miles, never your exact address. We remove location (GPS) and other hidden photo data (EXIF) from listing photos, keeping only the rotation.
• Reports and blocks: when you report a comment, team, listing or message, we keep the reason, your note and a copy of what you saw, and send it to our moderators. People and teams you block are kept so we can hide them from you.
• Waitlist and support: your email and anything you tell us when you join the launch list or contact support.

Collected automatically

• Device and sign-in data: our servers log your app version and the requests the app makes, and Firebase Cloud Messaging holds a device token so we can send push notifications. The app does not include a crash-reporting or usage-analytics tool.
• Location: only if you allow it, to sort tracks by distance and show weather. You can turn it off in your phone’s settings.
• PITVUALT Link data: trouble codes and snapshot readings (such as battery voltage, coolant temperature, idle RPM, engine hours) when you connect the device, and logs only where the app allows logging.

On this website

• Site analytics: we count page views and a few clicks (for example which plan button or FAQ was used, and how far down a page people scroll) with Cloudflare Web Analytics and Cloudflare Zaraz. No advertising cookies, no cross-site tracking, and we never attach your email or name to these events.

From others

• Stripe tells us your plan and subscription status. Payments are processed by Stripe on our website; we never see your full card number. If we add App Store or Google Play purchases later, those stores will tell us your plan status too, and we will update this policy first.
• Weather data from the National Weather Service and backup weather providers, keyed to track locations — not to you.

2. How we use it

• To run the Service: save and sync your data, run calculators and tech checks, send gear-expiry and race-day reminders.
• To process subscriptions and device orders.
• To answer support requests and send service messages (for example, account or billing notices).
• To send the launch email if you joined the waitlist — you can unsubscribe any time.
• To keep the Service secure and fix bugs.

We do not show ads, sell your personal information, or share it for cross-context behavioral advertising.

3. AI features

Some features send information to an AI service provider to generate a response:

• AI crew chief and photo scan (cloud mode): these use Anthropic as our AI provider. To answer, they send your setup values, results, track conditions, the photo you scan (scan only) and what you type. We don’t send your name, email, phone number or driver details.
• AI logo generator: this uses Cloudflare Workers AI, part of our hosting provider. It sends the team name, style and description you enter.

The app asks for your permission before the crew chief or cloud photo scan first sends anything to Anthropic. You can turn this off at any time in the app under Me → AI data sharing; the change applies to the next request. Photo scan still works on your phone without it.

Under the terms that apply to our accounts, Anthropic and Cloudflare do not train their models on this content. Anthropic deletes it from its systems within 30 days, or longer if it is flagged for safety review, and Cloudflare does not keep it after the request is processed. AI output is a suggestion only — check your class rules.

4. Sharing

• Your team: people you invite see team data according to their role. Viewers can read but not edit.
• Other events the same day: if you are a member of more than one team, a team’s owner and crew chief may see a yes/no “Another event that day” on you when you are Going or Maybe for another team’s event on the same day. They do not see which team, track or event. You can turn this off in the app’s Me tab.
• Teams at the same track: if your team checks in at a track, teams checked in there at the same time see your team name, class and car number. Teams with a minor driver profile are never listed.
• Gear listings: a listing is shown to other signed-in users with your first name and last initial, the month you joined, how many items you’ve sold and its approximate area. Messages are seen only by you and the other person in the thread. We never show your email, phone number or team.
• Moderators: reports, and the content they’re about, go to the people who review reports for us.
• Links you create: a read-only share link or QR code lets anyone with the link see that one setup until it expires or you turn it off.
• Service providers: hosting and storage (Cloudflare, Google Cloud), sign-in and push notifications (Firebase Authentication and Cloud Messaging), payments (Stripe), email delivery (Mailgun), PDF rendering (KapturePDF), text messages (Twilio, only if text reminders launch) and AI providers (Anthropic; Cloudflare Workers AI for logos) — each only to provide their service to us.
• Pistonhouse HQ shops: only if you choose to connect a shop, and only what you choose to share.
• Legal: if required by law, or to protect the safety and rights of users and others.
• Business transfer: if Pistonhouse HQ is sold or merged, this policy continues to apply to your data.

Text messages (SMS)

Text reminders are not live yet. When they launch on Crew, we will only text numbers that opted in to texts from that team. They will be transactional messages about race days you were invited to, sent from a PITVUALT number. Message frequency will vary with your team’s schedule. Message and data rates may apply. Reply STOP to opt out, or HELP for help, or email support@pitvault.io. Carriers are not liable for delayed or undelivered messages. We do not sell or share mobile numbers or SMS consent with third parties or affiliates for their marketing.

5. Minors

PITVUALT accounts are for adults (18+). Young drivers race too, so a parent or guardian can add a minor driver as a parent-managed profile inside their own account. Minor profiles have no login of their own, are never public, and contain only what the parent adds (such as name, car number, class and gear dates). We do not knowingly collect personal information directly from children under 13. If you think a child has given us information, contact privacy@pitvault.io and we will delete it.

6. Your choices and rights

• Export: export your data from the app at any time, on any plan.
• Delete: delete your account in the app (Me → Account → Delete account) or follow the steps on our delete your account page. We export your data first, then permanently delete it within 30 days, except where we must keep limited records (such as billing records) by law.
• Comments, check-ins, listings and messages: your crew feed comments, the check-ins you made, your listings, your message threads and the reports and blocks you made are included in your export. They are deleted when you delete your account, and so are the crew feed, comments and check-ins of any team you own.
• Correct: edit your information in the app, or ask us.
• Notifications: turn push or email reminders on or off in settings. If text reminders launch, reply STOP to any text.
• Location and Bluetooth: control these in your phone settings.

Depending on where you live (including California, Oregon and Nevada), you may have rights to know, access, correct, delete and port your personal information, and to opt out of sale or sharing — which we don’t do. Email privacy@pitvault.io to make a request. We won’t discriminate against you for using these rights. We may need to verify your identity first.

7. Retention

We keep your data while your account is open. Downgrading never deletes data. Shared links expire when you set them to or when you revoke them. Track condition reports expire from public view after a few hours. Waitlist emails are kept until launch plus 12 months or until you unsubscribe. If you link a computer, we keep a record of that sign-in (browser type, times and a scrambled network identifier) for up to 7 days after it ends.

If you use these features: crew feed items are kept for 180 days. Pit check-ins are visible for up to 12 hours and deleted 7 days after they end. Sold listings and their messages are deleted 12 months after the sale is marked. Deleted, expired or removed listings and their messages are deleted 90 days after they end, and a message thread is deleted 12 months after its last message. Listing photos that were uploaded but never used in a listing are deleted after 7 days. Resolved reports are kept for up to a year for moderation records. [Counsel review before these features are turned on.]

8. Security

Data is encrypted in transit and at rest with our hosting providers. Access is limited to people who need it to run the Service. No system is perfectly secure; if a breach affects you, we will tell you as required by law.

9. Where data is stored

We store data in the United States using our providers’ infrastructure. If you use the Service from outside the U.S., your data will be transferred to the U.S.

10. Changes

If we make material changes, we’ll tell you in the app or by email before they take effect.

11. Contact

Pistonhouse HQ · Privacy · privacy@pitvault.io
[Mailing address — to be added]