Privacy policy
This policy covers the Gapline website (gapline-app.com), the web app (app.gapline-app.com) and the Gapline apps for iPhone and Android. Gapline collects as little as it can: you can follow every session without an account, and there is no advertising, analytics or tracking.
Who is responsible
The data controller is Thomas Singerlé-Florus, 120 Avenue du Bac, 94210 Saint-Maur-des-Fossés, France. For any question about your data, write to contact@gapline-app.com.
Without an account
Gapline shows public timing data. Live timing, standings and the calendar are fetched from OpenF1 through Gapline's own servers and a live relay; these requests carry no personal data, only the session being followed.
Your choices (driver, team, widget settings) are stored on your device only. The app reads your device's region to decide which purchase options to show; it stays on the device.
With a Gapline account
An account is optional. It lets your Pro access, driver and team follow you on every device. We store:
- Email address and password, handled by Firebase Authentication. We never see your password in plain text. Firebase sends the verification and password-reset emails.
- Your profile: email, favourite driver and team, and when the profile was created and updated.
- Your Pro status: the plan, its status, renewal or end date, your Stripe customer identifier and, for Lifetime, the reference of the purchase.
When you open the website from the app already signed in, a one-time code is created on our servers. It is valid for two minutes and deleted as soon as it is used.
Payments
Gapline Pro is sold on the website through Stripe. Stripe collects your payment details, billing name and address, and issues receipts and invoices. Gapline never sees or stores your card number. We keep only your Stripe customer identifier and what is needed to know whether Pro is active.
Live Activity on iPhone
When you follow your driver on the Lock Screen, the app sends our live relay the Live Activity's push token, the session and your driver's number, so the card stays current through Apple's push service. This is not linked to your account and is kept in memory only, for the duration of the session.
Why and on what basis
- Providing the service you ask for (account, sync across devices, Pro, Live Activity): performance of our contract with you.
- Payments, invoices and accounting: performance of the contract and our legal obligations.
- Security and preventing fraud or abuse, including server logs: our legitimate interest in keeping Gapline running safely.
We do not sell your data, use it for advertising or profile you.
Who processes it
- Google Firebase (Authentication and Cloud Firestore): accounts and profiles.
- Stripe: payments, subscriptions, receipts and the customer portal.
- Vercel: hosting of the website, the web app and their server functions, including technical request logs.
- Render: hosting of the live relay.
- Apple: delivery of Live Activity updates on iPhone.
- OpenF1: source of the timing data; it receives no personal data from Gapline.
Some of these providers process data outside the European Union, notably in the United States. These transfers rely on the safeguards the providers offer, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep it
- Account and profile: until you delete your account.
- One-time sign-in codes: deleted when used, unusable after two minutes.
- Live Activity tokens: in memory for the session, lost when the relay restarts.
- Payment records and invoices: kept by Stripe and by us for as long as accounting and tax law require (up to ten years in France).
- Server logs: kept for a limited time by our hosting providers.
Deleting your account
You can delete your account at any time, in the app (Account) or on the website (your account, then Delete account). This deletes your login, your profile and your saved driver and team, and stops any running subscription right away. Stripe keeps the payment records it is required to keep; they are no longer linked to a Gapline account.
Your rights
Under the GDPR you can access, correct, delete or export your data, object to or restrict its use, and withdraw any consent. Write to contact@gapline-app.com. You can also lodge a complaint with the French data protection authority, the CNIL, or the authority in your country.
Children
Gapline is not directed at children. You must be old enough to consent to data processing in your country (15 in France) to create an account.
Changes
If this policy changes, the new version is published on this page with its date. Significant changes will also be announced on the website or in the app.