Security and data
Your recordings and settings stay on your machine. Our server only holds what you upload to a team yourself.
What stays on your machine
The app transfers nothing in the background. Every upload is a single action that asks you first.
What PaceGuru does not transfer
- Telemetry or driving data, unless you upload a lap to a team yourself
- Recordings (.ibt) as a whole
- Setups
- iRacing names and iRacing IDs, neither yours nor those of other drivers
- Settings or layouts
- Usage statistics — there is no analytics tool and no crash reporting service
What gets uploaded when you share
In the app you pick a recording and, within it, a stint or a single lap. The app cuts out only that excerpt and builds a new file from it on your machine. Before the upload it shows you what goes to which team, and asks.
In the uploaded file
- Position on track, speed, throttle, brake, steering angle and gear
- Coordinates on the track and orientation of the car
- Lateral and longitudinal acceleration
- Lap number, times and whether the car is in the pit lane
- Track, car name, time of the recording and sample rate
- Plus, as plain numbers: weather and track conditions during the drive (temperatures, wetness, cloud cover, wind, humidity, rubber)
Not in the uploaded file
- Setup and setup values such as suspension, aerodynamics, tyre pressures, gearbox or differential
- iRacing name, iRacing ID, team name from iRacing, licence or rating data
- Information about other drivers in the session
- Tyre, fuel or engine data
- File name, folder path and Windows user name
The server checks too. Every uploaded file is validated against exactly this format. Anything beyond it is rejected — including appended data.
-
Only your team
Only members of a team see its member list and laps. There are no public teams and no team search.
-
Your display name
You choose it yourself; it is not your iRacing name. Once you have saved one, the members of every team you are in see it. If you empty the field, you appear anonymous everywhere at once.
-
Deleting
A lap stays stored until you delete it, someone in the team who is allowed to deletes it, or the team is deleted. If you delete your account, your laps in all teams are deleted immediately.
Your account
-
Password
At least 12 characters. It is only stored in a scrambled form; we cannot see your password itself.
-
Check against known data breaches
When you choose a password we check whether it has appeared in known data breaches. Only the first five characters of a check value are transmitted, never the password itself.
-
Two-factor sign-in
You can turn it on in your account. Signing in then also needs a code from your authenticator app.
-
Devices
You can see your devices in your account and sign them out individually.
-
Payment
Payments are handled by Stripe. You enter your payment details on a page run by Stripe; we never see your full card details.
-
Deleting your account
You can delete your account yourself at any time. The account, the licence link and all sign-in data are then deleted without delay.
The app
-
Signed updates
Every update is cryptographically verified (ECDSA-P256 + SHA-256) before anything is downloaded or executed.
-
Offline grace period
If the license server is ever unreachable, PaceGuru keeps running for 7 days.
-
Encrypted key
Your license key is stored encrypted on disk (Windows DPAPI), never in plain text.
-
iRacing interface (SDK)
PaceGuru reads your iRacing telemetry only through the interface iRacing provides for add-on software. It does not make any deep system changes.
The website
-
No tracking cookies
We set no cookies for advertising, tracking or analytics. There is no cookie banner because there is nothing to consent to.
-
Nothing from third-party servers
Scripts, stylesheets and fonts come exclusively from our own server. No connection is made to Google Fonts or any other external provider.
-
Servers in Germany
The website and all related services run on a server at Hetzner in Germany. Access goes through Cloudflare's network, which distributes delivery and fends off attacks.
-
Encrypted backups
The database is backed up every night. Backups are end-to-end encrypted and deleted after 90 days.
-
Short-lived logs
Server logs serve delivery and defence against attacks and are deleted automatically after 14 days at the latest.
Report a security vulnerability
Found a vulnerability? Write to us, in German or English, before you publish it.
All details on data processing are in the privacy policy.
Try it free for 7 days
Create an account, confirm your email address, sign in to the app. No payment details, and the trial ends by itself.