ApexLog

Privacy Policy

Last updated: 18 October 2026

This policy describes what personal data ApexLog collects, how we use it, who we share it with, how long we keep it, and what rights you have — including the right to download or permanently delete your data.

Data controller

ApexLog is operated as a sole-trader project. The data controller is Marcin Sitko ([email protected]). ApexLog is hosted in the European Union (Azure Poland Central).

What we collect

  • Email address — used for account login, email verification, password reset, security notifications, and notices about material changes to the service.
  • Telemetry and session data you upload: lap times, GPS samples, car setup notes, session notes, track-day context, and metadata of uploaded files.
  • OAuth profile data (when you sign in with Google, Microsoft or Apple): email address, display name, and an opaque provider user ID. We do not request or store profile photos, contact lists, or calendar data.
  • Audio you choose to transcribe with "Notes from audio": the chosen part of your own video file's audio is sent for transcription and is not stored. The resulting notes are stored only if you save them.

How we use it

  • To create and secure your account, verify your email, and send you account-related notifications.
  • To process uploaded telemetry, build session summaries, and power all ApexLog features.
  • To investigate reported bugs and improve service reliability.

Legal basis (GDPR)

We process your data on the basis of contract performance (Art. 6(1)(b) GDPR) — processing is necessary to provide the service you signed up for. We do not sell your data and do not use it for advertising.

Sub-processors

We share data with the following processors solely to operate the service:

  • Microsoft Azure (Poland Central) — cloud hosting for the API, database, and telemetry file storage.
  • Resend — delivery of service emails (verification emails, password resets, notices about your account and the service). Only your email address is transmitted.
  • Stripe — payment processing (not yet active; will be added when paid plans launch). When enabled, billing data will be handled by Stripe under their own DPA.
  • Sentry (Functional Software) — crash reports from the ApexLog mobile app, when enabled in a store build.
  • Microsoft Azure AI Foundry (Sweden Central, EU) — speech-to-text for "Notes from audio", only for audio you choose to transcribe. ApexLog does not store the audio or the transcript; they are processed in memory.
  • OVHcloud (Gravelines, France, EU) — speech-to-text for "Notes from audio", only for audio you choose to transcribe. ApexLog does not store the audio or the transcript; they are processed in memory.

Mobile app

The ApexLog mobile app works without an account. Your notebook (sessions, pressures, notes, setup, garage) is stored on your device and is not sent to us until you connect an account.

When you connect an account, sessions you finish with a linked car and track, the photos and logger files you add, and your garage changes are sent to your ApexLog account and processed as described above.

Camera and photo access are used only when you add a photo; location metadata is removed from photos before upload. When you start a session, location is read once on your device to suggest the nearest track; that reading is not sent to us. While you record laps with the phone's GPS, the app records your location continuously, together with the phone's motion sensors (acceleration and rotation), and only while the app is open. If you connect a RaceBox logger or an OBD adapter over Bluetooth, the recording also holds the data it sends: GPS position and speed, and vehicle data such as engine speed, throttle and temperatures. The recording stays on your device. With an account connected, it is sent to your account together with the session, like a logger file.

Store builds may send crash reports and a few anonymous usage events (for example "session saved") tagged with a random per-install identifier. They never include your notes, setup text, names, email address or account ID, and are not used for advertising or tracking.

You can delete your account from the app (Cloud → ••• → Delete account) or from the account page on the web. Data stored only on your device is removed when you uninstall the app.

Data retention

We keep your data for as long as your account is active. If you delete your account, all personal data — including uploaded telemetry files — is hard-deleted immediately and cannot be recovered. We do not keep backups of deleted accounts beyond our standard infrastructure backup window (up to 30 days).

Your rights

Under GDPR you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Portability (Art. 20) — download all your data as a structured JSON file at any time from Account → Download my data. Account
  • Erasure (Art. 17) — permanently delete your account and all associated data at any time from Account → Delete my account. Account
  • Restriction — ask us to stop processing your data while a complaint is pending.
  • Object — object to processing based on legitimate interests (not applicable here as we rely on contract performance).

To exercise any right, or to lodge a complaint, email [email protected]. You also have the right to contact your national data protection authority.

Contact

Privacy questions: [email protected]