Legal
Privacy policy.
Plain-English summary of what we collect, why, who sees it, and how to get it deleted.
At a glance
The short version. GrandPrixHQ is a tool that helps Cub Scout packs, schools, and similar groups run pinewood derby races. Parents register their kids, pack leaders run the event, and we store the data needed to make that work — names, email addresses, car photos, race times, results.
We don’t sell your information. We don’t sell information about your kids. We don’t advertise to children. We use the data you give us to run the race, send you the emails you signed up for, and improve the product.
Who we are
Grand Prix HQ LLC (“GrandPrixHQ,” “we,” “us”) operates the website at grandprixhq.com and related services (the “Service”). This policy describes how we collect and use information when you use the Service, whether as a parent registering a racer, a pack admin or staff running an event, or a member of the public viewing a public race page.
Mailing address: Grand Prix HQ LLC, PO Box 702116, San Antonio, TX 78270.
Information we collect
You give it to us
- Account info. Email address (required for our magic-link login), first and last name, optional phone number, and your pack affiliation. We do not store passwords because we don’t use them.
- Racer info. For each child you register: first name, last name (used only inside the platform), rank or grade, and an optional photo of the car they built. We display only the first name and last initial on public surfaces.
- Pack and event content. If you are a pack admin or staff: event names, schedules, rules text, class definitions, and roster details.
- Race data. Heat assignments, lane times, finish positions, and event results.
- Payment info. When you subscribe to a paid plan, payment details (card number, billing address) are collected and stored by our payment processor, Stripe — we never see or store full card numbers ourselves. We receive only the metadata needed to manage the subscription (customer ID, subscription status, last four digits, billing email).
- Support correspondence. Anything you send us by email or contact form.
We collect it automatically
- Log data. IP address, user agent, referring URL, and pages requested — standard web-server logs, used to diagnose problems and detect abuse.
- Cookies and local storage. A session cookie (so you stay logged in) and a small theme preference cookie (light / dark / system). See the Cookies and local storage section below.
- Email engagement. When we send you transactional email through Resend, we record delivery, bounce, complaint, and open events to confirm the email reached you.
- Affiliate clicks. If you click an affiliate link to a partner store, the destination site may receive a referral identifier so we can be credited for any resulting purchase. See Third-party service providers.
Information from others
If a pack admin invites you to a pack (as a helper, parent, or co-admin), we receive the email address they sent the invitation to so we can deliver the invite and recognize you when you accept.
How we use it
We use information to:
- Run the Service — create accounts, schedule heats, record results, host pages.
- Authenticate you. The magic-link flow sends a short-lived, single-use sign-in link to your email each time you log in.
- Send transactional email — magic-link sign-ins, registration confirmations, results notifications, helper invitations. These are tied to your account and cannot be opted out of while you have an active account.
- Send announcements from your pack — opt-in announcement messages from the pack admin. You can unsubscribe from any pack’s announcements without losing transactional mail.
- Diagnose bugs, prevent abuse, and improve reliability.
- Power affiliate disclosure and reporting where we earn commission from partner vendor links.
- Comply with legal obligations.
We do not:
- Sell, rent, or trade personal information.
- Sell, rent, or trade information about your children.
- Share personal information for cross-context behavioral advertising.
- Show third-party advertising to you or your kids.
- Use any information from accounts or racer records to train machine-learning or generative-AI models, whether our own or a third party’s.
- Use automated decision-making technology (ADMT) to make significant decisions about you or your child. Race results come from physical timer hardware or operator entry — not from algorithmic ranking, profiling, or scoring.
- Share data with data brokers.
- Embed third-party analytics, advertising, or retargeting trackers.
Children's privacy
GrandPrixHQ is built for racing leagues whose racers are typically children under 13. The service is child-directed in the sense that children are the ultimate subject of much of the data — but children themselves never interact with it. We comply with the U.S. Children’s Online Privacy Protection Act (COPPA), as amended in 2025, by following the practices below.
No accounts for kids
Children do not have accounts on GrandPrixHQ. They cannot log in, sign up, register themselves, post content, or send messages. Only parents (or guardians acting in that role) and adult pack volunteers hold accounts.
Verifiable parental consent
The parent provides the child’s information by creating a Racer record on the child’s behalf and entering it into an event. Submitting that information acts as verifiable parental consent for the internal uses described in this policy, under COPPA’s “support for internal operations” framework. For walk-in registration at an event, a pack admin may enter racer information on behalf of a family that is physically present; the parent claims the resulting record via a follow-up magic-link email and confirms consent at that time.
What we collect about a child, and why
- First name — to identify the racer to their pack and on race pages.
- Last name — used internally to disambiguate within a pack. Visible only to authenticated members of the racer’s pack and to the parent. The last name is never shown on public race pages.
- Rank or grade — to assign the racer to the correct class.
- Car photo (optional) — a photo of the pinewood derby car the child built. The photo is framed by a silhouette overlay at capture time to keep children out of frame. We do not collect photographs of the child.
- Race results — heat times and finish positions generated during the event.
We do not collect a child’s email address, phone number, home address, precise geolocation, biometric identifiers (voiceprints, faceprints), government ID, or any persistent identifier intended for tracking across services.
The public-disclosure boundary
When you register a child for an event, you are consenting to a specific, limited public disclosure on that event’s public race pages: car number, car name, the racer’s first name and last initial, an optional car photo, and heat times / finish positions. Nothing beyond that boundary is published. This disclosure is revocable: a parent or pack admin can remove a racer from public display at any time without affecting historical heat-time records, which are anonymized in place.
Third parties that touch a child’s information
Racer data is processed only by the operational service providers required to run the Service. Specifically:
- Railway hosts the database that stores Racer records (name, rank, results).
- Cloudflare R2 stores car photos as object files.
- Resend delivers transactional emails to parents (magic-link sign-in, registration confirmation, results). It does not receive racer names in most cases; where a results email summarizes a racer, only the first name and last initial appear.
Racer data is never disclosed to advertisers, analytics vendors, data brokers, or AI / machine-learning training pipelines (ours or a third party’s). We do not monetize child data.
Retention
Racer records are retained for as long as the parent’s account is active and the racer continues to participate, plus a reasonable grace period for historical race pages. Specifically: a Racer record is deleted within 30 days of the earliest of (a) a parent’s deletion request, (b) closure of the parent’s account, or (c) the racer aging past the upper Cub Scout rank threshold without re-registration for three consecutive years. Heat-time records on event pages are anonymized rather than deleted, so the event’s public results page remains accurate.
Parental rights
A parent may, at any time:
- Review the information collected about their child by signing in at
/my. - Correct any racer information directly in the dashboard.
- Refuse further collection or use by deleting the Racer or closing their account.
- Request a copy of the information we hold about their child by emailing [email protected]. We respond within 30 days.
- Request removal of the racer from public pages while leaving heat-time records anonymized in place, by emailing the same address.
If you believe a child’s information has been collected without proper consent, or you have any other concern about how we handle children’s data, please contact us at [email protected]. We will respond and act promptly.
How we share
We share information only as follows:
- Within your pack. Pack admins and helpers in your pack can see roster details (parent name and email, racer first and last name, rank, car) as needed to run events. District admins (a pack admin flag granting cross-pack visibility) can see roster details for the packs they administer.
- On public race pages. Anyone can view a public event landing page, public results, the crowd-view live race screen, and shareable replay URLs. These show car number, car name, the racer’s first name and last initial, an optional car photo, and heat times. They do not show the racer’s last name, address, parent contact info, or any login state.
- With our service providers. See Third-party service providers.
- For legal reasons. If required by law, subpoena, or court order, or to protect the safety of users or the public.
- In a business transfer. If GrandPrixHQ is acquired, merged, or sells substantially all its assets, your information may transfer to the successor, subject to this policy (or a successor policy you have a chance to review).
Third-party service providers
We use a small set of operational service providers. Each acts as a processor on our behalf under written agreements (data processing addenda where applicable) and receives only the data needed for its function. None of them are authorized to use the data for their own marketing or to disclose it further except as required to perform their service.
| Vendor | Purpose | Categories of data |
|---|---|---|
| Railway (US) | Application hosting and Postgres database. | All account, pack, event, and racer data. IP addresses in server logs. |
| Cloudflare R2 | Object storage for uploaded files. | Car photos and other uploaded media. |
| Resend | Transactional and announcement email delivery. | Recipient email addresses, message contents (which may include a racer’s first name and last initial in results notifications), delivery / bounce / open events. |
| Stripe | Payment processing and subscription management for paid plans. We use Stripe Checkout (hosted checkout pages) and the Stripe Customer Portal — no card data ever touches our servers. | Name, email, billing address, payment-card details (collected directly by Stripe through their hosted checkout; we never see full card numbers). On our side we store only the Stripe customer ID, subscription ID, and plan status. |
| Affiliate partners | Vendor referral tracking (currently Pinewood Pro). | Referral identifier appended to a link you click. No account information is transmitted. See the affiliate disclosure shown wherever partner links appear. |
We do not use third-party advertising networks, behavioral advertising trackers, retargeting pixels, session-replay tools, or data-broker integrations anywhere on the Service.
Do not sell or share, and opt-out signals
We do not “sell” personal information, and we do not “share” personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA / CPRA) and similar U.S. state privacy laws in Colorado, Connecticut, Texas, Virginia, Oregon, Montana, Delaware, New Jersey, New Hampshire, Maryland, Minnesota, and Nebraska. We do not engage in targeted advertising or profiling that would produce legal or similarly significant effects about you.
We honor the Global Privacy Control (GPC) browser signal and other universal opt-out preference signals. Because we do not sell or share personal information in the first place, there is no sale or sharing for a GPC signal to opt you out of — but if our practices ever change, we will treat a recognized signal as a valid opt-out request.
You can also request opt-out, deletion, or other rights directly by emailing [email protected]. We will not discriminate against you for exercising any privacy right.
Cookies and local storage
Data retention
- Account data. Kept for as long as your account is active. Closed accounts are anonymized within 90 days of closure, except where retention is required by law (e.g., tax or fraud-prevention records related to payments).
- Racer data. Kept for as long as the parent’s account exists or the racer’s pack continues to use the Service. Parents can request deletion at any time.
- Race results. Public results pages remain available indefinitely unless a pack admin or parent requests removal of an individual racer’s data. Removing a racer leaves heat times intact (anonymized) so historical records of an event remain accurate.
- Logs. Server logs are retained for up to 90 days for operational purposes.
- Email events. Delivery / bounce / open events are retained for up to 18 months for deliverability diagnostics.
Security
We maintain a written information-security program covering administrative, technical, and physical safeguards reasonably designed to protect the information we hold. In practice that includes: HTTPS for all traffic; storage encryption at rest provided by our database and object-storage vendors; magic-link authentication with single-use, short-lived tokens (no passwords to steal); role-based access controls scoped to a single pack by default; least-privilege access for our staff; and audit logging on sensitive actions.
No system is perfectly secure, and we cannot guarantee absolute security. If we experience a breach affecting your personal information, we will notify you and the relevant regulators in accordance with applicable law and without unreasonable delay.
Your choices and rights
Regardless of jurisdiction, you can:
- Access your data — sign in and view your profile, your racers, and your registration history at any time.
- Correct inaccurate data — edit your profile and racer records directly, or email us if you need help.
- Delete your account, racer records, or specific photos. Email [email protected] if a self-serve option isn’t available for what you need.
- Unsubscribe from announcement emails from any specific pack without losing transactional notifications (results, magic-link sign-ins).
- Export your data — contact us and we will provide a machine- readable export of the personal information associated with your account.
California residents (CCPA / CPRA): you have additional rights to know, delete, correct, and limit use of “sensitive personal information.” You can exercise these by emailing [email protected]. We do not sell or share personal information as those terms are defined under California law.
EU / UK / EEA residents: where GDPR or UK GDPR applies to you, you have rights of access, rectification, erasure, restriction, portability, and objection. Our lawful basis for processing is generally (a) the contract between you and us to provide the Service, (b) your consent for optional features like announcement email, and (c) our legitimate interest in operating, securing, and improving the Service.
International users
GrandPrixHQ is operated from the United States. If you access the Service from outside the U.S., you understand that your data will be transferred to and processed in the U.S., where data-protection laws may differ from those in your country. By using the Service you consent to that transfer. Where required by law (e.g., for EU residents), we will rely on appropriate safeguards such as standard contractual clauses with our processors.
Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top and, where the change is significant, notify account holders by email. Continued use of the Service after a change means you accept the updated policy.
Contact
Questions, requests, or complaints about this policy or how we handle your data:
Email: [email protected]
Mailing address: Grand Prix HQ LLC, PO Box 702116, San Antonio, TX 78270.