Personal Information Collection and Third-Party Sharing List
Version: v1.0 (overseas / English) Effective date: 2026-06-02 Scope: Race Log web at karting.hao456.pro, Android app distributed via Google Play, iOS app distributed via the App Store.
This list is a companion to the Privacy Policy and provides an at-a-glance inventory of (a) the personal information we collect and (b) the third-party processors we share it with. For users located in mainland China, please refer to the simplified Chinese version (karting.hao456.pro/privacy/data-list) which is structured for PIPL / MIIT 292 compliance.
1. Personal Information Collected
| Personal Information | Collection Scenario | Method | Purpose | Required? |
|---|---|---|---|---|
| Email address | Sign-up / sign-in | You enter it in the registration form | Account creation, sign-in, password recovery | Required (for email registration) |
| Password (hashed, never stored in plain text) | Sign-up | You enter it in the registration form; stored as a bcrypt hash | Authentication | Required (for email registration) |
| Display name | Profile setup | You enter it on the profile page | Display in reports and community views | Optional |
| Real name | Profile setup | You enter it on the profile page | Personalized report display | Optional |
| Avatar image | Profile setup | You upload via file picker | Display in reports and community views | Optional |
| City | Profile setup | You enter it on the profile page | Community filtering by region | Optional |
| Karting experience / vehicle preference | Profile setup | You enter it on the profile page | Personalizes the AI coach narrative tone | Optional |
| Uploaded telemetry data (.vbo file) | Uploading a session | You select the file via the file picker | Lap time, line, braking-point analysis | Required (when using analysis features) |
| GPS coordinates in the telemetry data | Uploading a session | Included in your uploaded .vbo file | Generates the track outline and auto-identifies the venue | Required (when using analysis features) |
| Session notes / feedback text | Editing a session / submitting feedback | You enter it in the text box | Personal memory and service improvement | Optional |
| Device model, OS version, App version | App runtime | Read from the User-Agent header | UI adaptation, crash localization | Required (for service availability) |
| Crash / page-load technical stack traces | App exception occurs | Auto-captured by the error-reporting endpoint (does not include account contents or upload data) | Defect resolution | Required (for service availability) |
| Push notification device token | When you enable push notifications | Obtained via the OS push service (Apple APNs / Google FCM) | Delivers notifications such as "coach narrative ready" or "new personal best" | Optional |
We do not integrate any third-party advertising SDK or third-party analytics tracking SDK. We do not collect click trails, page dwell time, cross-app behavior, contacts, photos library (other than files you actively pick for upload), microphone audio, or precise system-level location.
Important on video processing: GoPro / DJI video files are processed entirely on your device. We only receive the extracted GPS data (text, MB scale), not the video bytes.
2. Third-Party Processors and Sharing (including embedded SDKs / services)
The following third parties are essential to providing the Service. Each is contractually bound by data-protection terms (DPA / SCC where applicable). The Service does not share your personal information with third parties beyond this list for any commercial purpose.
2.1 Supabase (cloud database and object storage)
- Provider: Supabase, Inc. (United States)
- Personal information shared: email, hashed password, display name, uploaded .vbo data, GPS coordinates, generated analysis reports
- Purpose: account storage, cloud storage of uploaded data and analysis output
- Sharing method: transmitted via encrypted HTTPS interfaces to cloud infrastructure (involves cross-border transfer — see Privacy Policy §10)
- Hosting region: AWS us-east-1 (United States)
- Privacy policy: https://supabase.com/privacy
2.2 Vercel (web hosting + CDN)
- Provider: Vercel, Inc. (United States)
- Personal information shared: IP address from web access requests, User-Agent
- Purpose: web content delivery and hosting
- Sharing method: web requests routed through their CDN and edge servers
- Hosting region: multi-region (United States primarily)
- Privacy policy: https://vercel.com/legal/privacy-policy
2.3 Railway (backend compute)
- Provider: Railway Corp. (United States)
- Personal information shared: pending analysis jobs (containing your uploaded telemetry data references)
- Purpose: backend data-analysis computation
- Sharing method: server-side task scheduling
- Hosting region: United States
- Privacy policy: https://railway.app/legal/privacy
2.4 Volcano Engine / Doubao (AI report-coach narrative — LLM)
- Provider: Beijing Volcano Engine Technology Co., Ltd. (a ByteDance company), China (Beijing)
- Personal information shared: your session's analysis summary (lap-time and line metrics; does not include account identifiers, raw GPS coordinate streams, or contact information)
- Purpose: generation of the AI report-coach driving narrative (Doubao model)
- Sharing method: server-side API call
- Hosting region: China (Beijing)
- Privacy policy: https://www.volcengine.com/docs/6256/64902
2.5 DeepSeek (AI in-video commentary + internal analysis audit — LLM)
- Provider: Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China
- Personal information shared: your session's analysis summary (same scope as §2.4; used for the in-video coach/companion commentary text and an internal automated quality check of the analysis)
- Purpose: in-video narration text generation + internal analysis audit
- Sharing method: server-side API call
- Hosting region: China
- Privacy policy: https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html
2.6 MiniMax (voice synthesis for narration audio)
- Provider: MiniMax (Shanghai Xiyu Technology Co., Ltd.), China (Shanghai)
- Personal information shared: the AI coach narration text generated for your session (text only; does not include account identifiers)
- Purpose: text-to-speech synthesis of the coach narration into an audio file
- Sharing method: server-side API call
- Hosting region: China (Shanghai)
- Privacy policy: https://www.minimaxi.com/protocol/privacy-policy
2.7 Google (push notifications — Android)
- Provider: Google LLC (United States)
- Personal information shared: FCM device token; notification payload (title + body text such as "Your coach narrative is ready")
- Purpose: delivery of push notifications via Firebase Cloud Messaging
- Sharing method: HTTPS API call to FCM
- Hosting region: United States
- Privacy policy: https://policies.google.com/privacy
2.8 Sentry (error tracking)
- Provider: Functional Software, Inc. dba Sentry (United States)
- Personal information shared: anonymized crash logs (stack traces, device model, OS version, app version; does not include account identifiers or upload contents)
- Purpose: error tracking and defect monitoring
- Sharing method: SDK telemetry
- Hosting region: United States
- Privacy policy: https://sentry.io/privacy/
2.9 Apple (push notifications — iOS only)
- Provider: Apple Inc. (United States)
- Personal information shared: APNs device token; notification payload (title + body)
- Purpose: delivery of push notifications via Apple Push Notification service
- Sharing method: HTTPS API call to APNs
- Hosting region: United States
- Privacy policy: https://www.apple.com/legal/privacy/
3. Sharing With Other Users (only with your explicit action)
| Sharing Scenario | Information Shared | Purpose | Your Control |
|---|---|---|---|
| You mark a session as public | Session GPS track, lap times, sector analysis, display name | Same-track community leaderboards and public report pages | You can switch a session back to private at any time, or email 207319@qq.com to request withdrawal |
We never make a session public without your explicit action. Default visibility for new sessions is private.
4. Cross-Border Transfers
Storage of your account, uploaded data, and reports is on cloud infrastructure located in the United States (Supabase, Vercel, Railway, Sentry).
The AI features, however, are processed in mainland China. To generate the AI report-coach narrative, the in-video commentary text, and the synthesized voice, your session analysis summary and the generated narration text are transferred to and processed by AI providers located in mainland China — Volcano Engine / Doubao (ByteDance), DeepSeek, and MiniMax (see §2.4–2.6). These transfers do not include your account identifiers, raw GPS coordinate streams, or contact information.
If you access the Service from outside China, this means part of your personal information (the analysis summary and the narration text) is transferred to China for AI processing. China is not the subject of an EU adequacy decision; for EEA / UK users we rely on your explicit consent (GDPR Art. 49(1)(a)) and on the transfer being necessary to provide the AI service you requested (Art. 49(1)(b)). By using the AI coach / narration features you consent to this processing. You can use the Service's data reports without the AI coach / narration features if you prefer no data to be processed in China — contact us at 207319@qq.com. For EEA / UK users, transfers to US storage providers above rely on the European Commission's Standard Contractual Clauses (SCCs); see Privacy Policy §10 for full details.
5. Updates and Contact
We will update this list whenever a collection item or sub-processor is added or changed. Material changes will be notified in the Privacy Policy and within the App.
For questions or to exercise data-subject rights:
- Email: 207319@qq.com
- In-app: Me → About → Contact Us
- Web form: karting.hao456.pro/account/delete (for deletion requests)
Response SLA: We respond to data-protection requests within 15 business days of receipt (up to 30 days for complex requests, with notification of any extension).
Operator: Wang Yufeng (individual) Country of registration: China Service primary infrastructure region: United States