Privacy Policy for Backseat Driver

Operated by Backseat Media

Last updated: 30 October 2026

Backseat Driver (“the App”) is developed and operated by Backseat Media (“we”, “us”, “our”). This Privacy Policy explains what information the App collects, how it is used, where it is stored, and the choices you have. It reflects how the App actually works today — please read it in full.

1. The App has no accounts

There is no sign-up, no sign-in and no user account of any kind. You download the App and use it. Everything you set — your favourite series, your bookmarked events, your reminder settings, your units and time preferences — is stored locally on your device and is never uploaded to us or attached to an identity.

Earlier versions of the App offered an optional “organiser” account so series and venue organisers could publish events, along with event updates channels. Those features have been removed, and the organiser account data held under the previous version has been deleted.

2. Information We Collect

2.1 Your settings and preferences — on your device only

Favourites, bookmarks, reminder choices, temperature and distance units, clock format and time mode, and simple local usage counters (for example how many times a series screen has been opened) are stored in the App’s own storage on your device. None of it is transmitted to us. Uninstalling the App or clearing its data removes all of it.

2.2 Push notifications

If you turn on session reminders, the App registers with Firebase Cloud Messaging (FCM) so it can receive them. Reminders are delivered by topic subscription — your device subscribes to the series you follow, and we send one message per session to everyone subscribed. We do not upload, store or hold a list of device tokens, and a reminder we send cannot be traced by us to a particular user or device.

Registering with FCM does create a device-level installation identifier, generated and held by Firebase — that is what allows a notification to reach your device at all. It is not tied to a name, an email address or an account, we do not use it to identify or profile you, and it is discarded when you uninstall the App.

On iPhone and iPad, reminders work differently and more privately still: the App builds your reminder schedule on the device and the operating system fires each one locally at the right moment. Those reminders involve no server at all — nothing is sent to us and nothing is broadcast when one appears.

Notification permission is never requested on launch. It is asked for only when you opt in, from the welcome flow or from Settings, and you can turn reminders off at any time.

Reminders may include a “chance of rain” line. That figure comes from the forecast for the race venue, not for wherever you are.

2.3 Location

If you use location-based features (for example “events near you”, reached from the pin in Bookmarks), the App accesses your device’s location with your permission to calculate distances to events. This calculation happens entirely on your device. Your location is never transmitted off your device — we do not send it to our servers or to any third party, we do not store it, and we do not use it for advertising or tracking. You can decline or revoke the location permission at any time in your device settings; the feature still works if you pick a location manually instead.

Like notification permission, location permission is asked for either from the welcome flow or from the pin in Bookmarks — never on launch. Declining it at either point costs you nothing but the ability to sort events by how far away they are, and you are not asked a second time. The App requests only approximate location, which is all that sorting events by distance needs.

The App does request weather forecasts from our weather service, but the coordinates in those requests are the coordinates of the race venue you are looking at — never yours.

The Atlas globe draws every circuit from map data bundled inside the App. It makes no map-tile requests and no location requests, and works offline.

2.4 Diagnostics

We collect limited, non-advertising technical data to keep the App stable:

• Crash reports and performance data (via Firebase Crashlytics), including the device model and operating-system version, so we can reproduce and fix faults. These carry a randomly generated installation identifier, not a name or an account, so that the several reports from one faulty install can be recognised as the same fault

The App contains no analytics SDK and no advertising SDK. We do not track which screens you view, how long you use the App, or your behaviour within it. The usage counters described in 2.1 stay on your device.

3. What We Do NOT Collect

We do not ask for or collect your name, email address, phone number, postal address, payment card details, contacts, or hardware identifiers such as IMEI/IMSI/SIM data. The App does not access your photo library or camera. We do not record or receive your location. We do not sell your data, and we do not share it with third-party advertisers. The App contains no advertising, no in-app purchases and no user accounts.

4. How We Use Your Data, and Our Legal Bases

Where UK/EU data protection law applies, we rely on the following legal bases:

We do not use your data for advertising or sell it to anyone.

5. Where Data Is Stored & Third-Party Processors

The schedule data the App downloads is public information about race meetings — it contains nothing about you. It is served to the App as static files from Cloudflare R2; the App holds no access to our database at all, which is locked to server-side jobs only. The services we use are:

• Google Firebase / Google Cloud — Cloud Firestore (our own store of schedule and standings data, hosted in the europe-west2 (London) region and readable only by our server-side jobs, never by the App), Cloud Functions (the scheduled job that sends session reminders, which runs in the United States), Cloud Messaging (notifications), Crashlytics (crash reporting) and App Check (app attestation)
• Cloudflare — hosting of the public schedule data the App downloads (Cloudflare R2), and a Cloudflare Worker that serves weather forecasts
• WeatherAPI.com — the upstream source of forecast data, reached only through our Cloudflare Worker and only ever asked about race-venue coordinates. WeatherAPI.com receives no information about you or your device

These providers process data on our behalf under their own security and privacy commitments.

If you follow the optional “buy me a coffee” link you leave the App and are handed to that platform, which is a separate controller under its own privacy policy. We receive no payment details from it.

The same is true of the other links that leave the App: Directions opens your phone’s maps app (Apple Maps on iPhone, Google Maps elsewhere) with the circuit’s location filled in; Tickets and Where to watch open a Google search in your browser; and Official site opens the championship’s own website. The App sends nothing about you to any of them — they only receive what your maps app or browser sends when you use them, under their own privacy policies.

6. International Transfers

Some of our providers are based in, or process data in, the United States. Where personal data is transferred outside the UK/EEA, that transfer is covered by the providers’ standard contractual clauses and equivalent safeguards under their data processing terms.

7. Data Retention & Deletion

There is no account to delete. Your favourites, bookmarks and settings live only on your device — uninstalling the App, or clearing its data from your device settings, removes them permanently. Turning reminders off, or revoking notification permission, ends your topic subscriptions.

Crash reports are not linked to any identity and are automatically deleted by Firebase Crashlytics after 90 days.

If you have emailed us, we keep that correspondence only as long as needed to deal with it. For any privacy request, contact backseatdriverdevs@gmail.com; we action verified requests within 30 days.

8. Children’s Privacy

The App is intended for a general audience aged 13 and over. On first launch the App shows an age confirmation screen; users who indicate they are under 13 are not able to continue. This is a self-certification — we do not collect a date of birth at that screen. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Security

• All data in transit is encrypted using HTTPS/TLS
• Our database is closed to the App entirely: the security rules deny it every read and every write, so the only thing the App can reach is the public schedule data published as static files. There is no path from the App to anything else we hold
• App attestation (Firebase App Check) is used to limit access to our backend to genuine app instances

10. Your Rights (GDPR / UK GDPR / CCPA)

Depending on where you live, you may have the right to access, correct, delete, export or object to the processing of your personal data, and to withdraw consent. Because the App keeps your data on your own device and we operate no accounts, most of these you can exercise directly — by clearing the App’s data or uninstalling it. To exercise any right against us, contact backseatdriverdevs@gmail.com. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office, ico.org.uk).

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a revised “Last updated” date.

12. Contact

Backseat Media
Email: backseatdriverdevs@gmail.com