This Privacy Policy explains how we collect, use, and protect your personal data when you use the Pista mobile applications for iOS and Android (the "App"), the website www.pistaapp.com (the "Website"), and related services (together, the "Service"). We process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.

Please also read our Terms of Use and Cookie Policy, which apply together with this Privacy Policy.

The controller of your personal data is:

(hereinafter "Pista", "we", "us", or "our"). Pista is the developer and operator of the Pista race-timing and performance-tracking application.

When you register we collect your email address and a password (stored only in securely hashed form). If you sign in with Google or Apple, we receive your email address and basic profile information from that provider instead of a password. Your email address is never visible to other users.

Your public racer profile includes your username, country, and an optional profile photo and gender. Your country is initially determined automatically from the IP address you register with (using an IP geolocation service) and can be changed in your profile settings.

The core purpose of the App is measuring vehicle performance. With your device permission, we collect precise GPS location, speed, timing, and motion-sensor readings while you run a race or time trial. If you connect an external GNSS device (such as RaceBox or Dragy) via Bluetooth, we collect the positioning and speed data it provides. We also store your last known location to show you nearby racers and race locations. Location is collected only while you use the App's racing and discovery features — we do not track your location outside of that.

We store your race results and history (times, distances, top speeds), rankings and rating (Elo), race invitations, and the cars you add to your in-app garage (including optional car photos).

We collect device model, operating system and version, app version, IP address, push notification tokens (if you enable notifications), crash reports, and diagnostic and usage data as described under "Analytics and Crash Reporting" below.

When you contact us (for example via email or the Website contact options), we process the information you provide so we can respond and resolve your issue.

The Website uses cookies and similar technologies (Google Analytics) only with your consent — see our Cookie Policy.

Your username, profile photo, country, rating and rankings, race results, and garage cars are visible to other users of the App as part of its social and competitive features. Your email address, precise location history, and raw telemetry are never shown to other users.

The App uses the following tools to keep it stable and improve it:

We share personal data only with service providers (processors) who help us operate the Service, under data processing agreements, and only to the extent necessary:

We do not sell your personal data, and we do not share it with third parties for their own advertising purposes.

We store and protect personal data in accordance with EU legal requirements, including the GDPR. Some of our providers may transfer data outside the European Economic Area (EEA). Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, adequacy decisions (e.g. the EU–US Data Privacy Framework). Details on how Microsoft Azure complies with the GDPR are available at microsoft.com/trust-center/privacy/gdpr-overview.

We keep your personal data for as long as your account is active and as long as it is necessary for the purposes described in this Privacy Policy:

We may retain limited data longer where reasonably necessary to resolve disputes, enforce our agreements, protect legal rights, or comply with legal, technical, and security requirements.

You can delete your account at any time directly in the App (Settings) or by emailing us at info@pistaapp.com. When you delete your account we permanently delete your login credentials and raw telemetry archives and anonymize your profile (username, country, photo, and location are removed). Aggregate race results in which you participated (such as an opponent's recorded race time) may be retained in anonymized form because they are also part of other users' race history. Deleted accounts and data cannot be restored.

We have implemented appropriate technical and organizational measures to protect personal data. Data is stored on secure servers, passwords are stored only as cryptographic hashes, and data in transit is encrypted with HTTPS/TLS. We restrict access to personal data to personnel who have a business reason to access it, and we regularly monitor our systems for vulnerabilities.

You can exercise the following rights at any time by contacting us:

We will respond to your request within one month; this term may be extended where permitted by applicable law. We may request specific information from you to confirm your identity where necessary and reasonable. You do not need to pay a fee to exercise your rights, but we may charge a reasonable fee or refuse a request that is clearly unfounded, repetitive, or excessive.

The Service is not intended for children. We do not knowingly collect personal data of persons under the age of 16. If you believe a child under 16 has provided us with personal data, please contact us and we will delete it.

We will update this Privacy Policy from time to time. We will notify you of material changes by a notice on our home page or in the App or, where appropriate, by email. The "Last updated" date at the top indicates the latest revision.

If you have any concerns about our use of your personal data, please contact us first at info@pistaapp.com — we will do our best to resolve them. You also have the right to lodge a complaint with a supervisory authority: in Croatia, the Croatian Personal Data Protection Agency (AZOP, azop.hr), or the data protection authority of your EEA country of residence (list available at edpb.europa.eu).