Privacy Policy.
Updated October 13, 2026
Cyber Thunder Racing League uses this website to manage driver accounts, registrations, racing records and league operations. This policy explains the information handled by the website and who can access it. It describes the current website implementation; it does not promise that information is anonymous, automatically deleted or completely secure.
Information collected
| Area | Information |
|---|---|
| Driver accounts | Username, display name, email address, iRacing ID, car number, account role/status, account creation and login dates, and links to league driver records. Recovery records include pending and verified email addresses and verification dates. |
| Registrations | Driver name, iRacing identity, requested car number, Discord username and supplied eligibility information such as iRating, oval starts and incident history. Event registrations include selected sessions, review decisions, Race Control clearance, guaranteed-entry and provisional designations, and administrative notes. |
| League participation | Race results, statistics, standings, penalties, caution records, provisional requests, achievements and historical driver records. Profile information, photos, car images and social links are collected when submitted. |
| Support & surveys | Ticket subjects, messages, replies and status; survey responses and participation records. Follow the privacy notice displayed on each survey. A confidential survey hides identity in ordinary results, but the database still links responses to a driver to enforce eligibility and one response per driver. |
| Usage analytics | On pages running the usage script, page path, visit time and a random visitor identifier held in browser session storage. When signed in, the visit can also be linked to your account ID. Logged-out visits can be recorded. This is separate from the activity audit log. |
| Activity & audit logs | Authenticated visits to supported major pages, account access, profile changes, provisional requests, survey completion, tickets and administrator actions. Records can include account ID/name/role, action, time, page, driver/race/season context, outcome, record changes and administrative reasons. Authentication security records can include IP address and browser/device information when supplied, plus a non-secret session identifier. Driver View records identify the administrator and the driver being viewed. |
How information is used
Information supports account access and recovery, driver identity matching, registration review, roster and event management, publishing racing records, answering support requests, collecting feedback and administering league rules. Analytics help administrators understand website usage. Activity and audit records help investigate account issues, trace changes and protect league data integrity.
The authenticated page-view logger suppresses repeated views of the same page within 30 seconds under its deduplication rules. It does not reconstruct past browsing. Closing a browser or tab is not treated as an explicit logout. Survey-completion audit events do not contain survey answers; the answers are stored separately.
Administrator access, public information & sharing
Public pages display league information such as driver names, car numbers, racing statistics, results, profile content and event registration/status indicators. Email addresses, recovery details, support messages and internal notes are not intended as public driver-profile or registration fields.
Administrative access is controlled by roles and permission grants. The League Director has broad access; other administrators receive access appropriate to their assigned permissions. Detailed activity/authentication history requires dedicated activity permission, and additional security details require security permission. Drivers do not receive access to other users’ private activity history. Authorized administrators can use Driver View and permitted exports; those actions can be audited. Hosting/database operators and people holding authorized backups may have access beyond the website’s ordinary screens.
The website uses the Sites hosting platform and Cloudflare Workers, D1 database and R2 file storage. When account-recovery email delivery is configured, messages are sent through Resend with the recipient address and verification/reset link. When Discord notifications are enabled, selected league announcements, applicant details and support-ticket summaries can be sent to configured Discord channels. Ticket summaries include the subject, category and submitting driver, rather than the full ticket conversation. External links and services, including Discord and iRacing, have their own privacy practices.
Authentication, browser storage & security
Local account passwords are stored as salted PBKDF2-SHA256 hashes. Session tokens and reset/verification tokens are stored as hashes rather than reusable plaintext tokens in their authentication tables. The local sign-in cookie is marked Secure, HttpOnly and SameSite=Lax and normally lasts up to seven days; logging out revokes that session. Reset links expire after 60 minutes and email-verification links after 24 hours, and successful use consumes the link.
The implementation includes login lockouts, recovery rate limits, permission checks and request-origin checks on protected actions. Authentication logging excludes entered passwords and secret tokens. Browser session/local storage is also used for usage identifiers and interface preferences. Clearing browser storage does not delete records already stored on the server. These controls reduce risk; they are not a guarantee against unauthorized access or data loss.
Account and operational records are stored in the database; uploaded files are stored separately in object storage. The website has an administrative backup/export facility that can include database records and files. Its encrypted backup workflow requires a configured public key, and restore access depends on the corresponding private key. This policy does not claim that scheduled backups are enabled or that every copy or external export is encrypted.
Data retention
Routine page-view events in the activity audit log have a default retention setting of 90 days, configurable by authorized administrators from 7 to 730 days. Cleanup runs in bounded batches, so deletion is not guaranteed exactly at the cutoff. Security records, administrative history and meaningful user actions are preserved by that cleanup.
The separate usage-analytics page_views records are not covered by that 90-day cleanup. The current website does not define automatic deletion periods for those analytics, general account records, registrations, support records, survey responses or historical racing records. They remain stored until an authorized process removes them. Inactivating a driver or logging out does not erase those records.
Backup jobs use a configurable expiry period, with a default of 30 days. Downloaded exports, restored copies and hosting-provider copies may have different retention. Removing a live record does not by itself remove copies already exported or backed up.
Retention periods for analytics and general records, handling of exported copies, and individual deletion requests require review by league management. This page does not promise an automatic account-deletion service or a fixed response deadline.
Questions, corrections & deletion requests
Contact Race Control through a support ticket in the Driver Portal. If you cannot access your account, contact league management through the Cyber Thunder Discord. Identify the account and information involved, but do not send your password or recovery link. You can request a correction, an explanation of stored information or deletion review. Management must consider the request alongside league history, audit integrity and any applicable obligations; this policy does not guarantee removal of every racing record or backup.
Update editable account/profile details through your Driver Portal. Future changes to website data practices should be reflected here with an updated date.