Privacy policy

1. Introduction

This Privacy Policy explains how King of the Touge ("KOTT",
"we", "us", or "our") collects, uses, and shares your
personal data when you use our competitive Assetto Corsa racing
service (the "Service").

We are committed to handling your data lawfully, fairly, and
transparently. We comply with the
EU General Data Protection Regulation (GDPR)
and the UK GDPR as well as analogous
data-protection laws in other jurisdictions where the Service is
available.

This Privacy Policy is incorporated by reference into the
Terms of Service.

2. Data Controller

King of the Touge is operated by Nackware LLC, a Nevada limited liability
company, which is the data controller for the purposes of GDPR and is
contactable at nack@kingofthetouge.com.

<!-- GAP CLOSED 2026-08-03 — Nackware LLC's Nevada filing went Active, so Art.
13(1)(a)'s controller identity is now a real legal person rather than a first
name. The interim position this replaced is described in git history; it was
accepted knowingly and is no longer load-bearing.

⚠️ THIS FILE IS NOT WHAT USERS READ. The live text is the row in tos_versions
(kind='privacy'), served from the DB and versioned by CurrentTosVersion — prod
was on v4 when this was written, whose §2 still reads "operated by an individual,
Nick". Editing this markdown changes NOTHING for a visitor until someone
publishes a v5 through Admin -> Legal. That publish is deliberately left to the
owner: it is a legal document, and §16 governing law still carries unfilled
<JURISDICTION> markers that are worth resolving in the same version bump rather
than shipping two changes to the same clause.

It stops being tenable the moment KOTT charges for anything — consumer and
e-commerce disclosure rules are stricter than GDPR on trader identity. Treat
the first paid tier or paid operator licence as the hard deadline. -->

Data Protection Officer. We have not designated a DPO, and are not required
to. Article 37(1) mandates one only where processing is carried out by a public
authority, where core activities require large-scale regular and systematic
monitoring of data subjects, or where core activities involve large-scale
processing of special-category data under Article 9. None applies: KOTT is a
private hobbyist service with a few hundred players, processes no
special-category data, and its monitoring is limited to gameplay within the
Service. Direct all data-protection enquiries to nack@kingofthetouge.com;
they are handled by the operator personally. We will designate a DPO and update
this section if that assessment ever changes.

3. Data We Collect

3.1. Steam account data (required)

When you sign in via Steam OpenID we collect:

• Your Steam ID (64-bit integer; the canonical KOTT identity).
• Your public Steam display name.
• Your public Steam avatar URL.

Steam never shares your email, password, real name, or private
profile data with us. The Steam ID is treated as personal data under
GDPR.

3.2. Discord account data (optional)

If you choose to link a Discord account, we collect via Discord
OAuth2:

• Your Discord user ID (snowflake).
• Your Discord display name (global username and per-server

nickname).

We use this data to recognise you when you run the KOTT Discord bot's
commands — /profile, /stats, /recent and the like — so they can
answer for your account without your supplying a Steam ID. You can unlink
your Discord account at any time using the /unlink command in the KOTT
Discord.

(Until 2026-09-14 this section also declared direct-message notifications
about matches, queue events and season announcements, and rank-role
assignment. Those features were withdrawn with ranked Matchmaking; we do
not process your Discord data for them.)

3.3. Race and lap data (server-authoritative)

For every race or timed lap you complete on the Service we record:

• Lap times including sector splits and finish times.
• Server-authoritative telemetry — top speed, average speed,

off-track and collision counts, position trace samples used for
lap validation and anti-cheat.

• Race results — winner, loser, rating change, dispute status.
• Community ladder standing — your Glicko-2 rating, deviation,

win/loss record and peak rating, held separately for each community
you race in.

We no longer keep a global ladder or a per-race rating history: the
ratings and rating_history tables were dropped on 2026-09-14 with
ranked Matchmaking, and a community's ladder holds only your current
standing in that community, not a timeline of it.

This data is tied to your Steam ID.

3.4. Client-side rich telemetry

For laps that qualify (a solo timed lap or a 1v1 touge race in which you crossed at least one
sector; cat-and-mouse rounds never qualify), your game client uploads a detailed recording of the
lap to us. It comprises:

• 20 Hz samples across 55 channels for the duration of that one lap: your car's world

position, velocity and g-forces; your control inputs (throttle, brake, clutch, steering,
handbrake); engine RPM, gear and fuel; and per-wheel tyre temperature, pressure, wear, slip
angle, surface grip and suspension travel.

This is the most detailed data we hold about you. It exists so that your own lap page can show
you your driving — track map, sector breakdown, speed trace, inputs, friction circle and tyre
temperatures — and so that we can detect manipulation of the game's physics (see §4).

How you agree. We only accept a telemetry upload from a client that has recorded your
agreement to the current version of these Terms and this Privacy Policy. You agree in one of
two places, and either is enough:

• In-game. The first time you join a KOTT server after a new version is published, the KOTT

HUD shows a short notice ("KOTT terms") with Accept and Not now. Accept records the
version you agreed to on your own machine; the upload then carries that version number with it.
Choosing Not now changes nothing about your ability to cruise, race or set laps — it only
means your lap telemetry is not uploaded until you accept.

• On the website. Signing in with Steam (or completing a Discord link) on kingofthetouge.com

is agreement to the version in force at that moment; the sign-in button says so.

What we record about your agreement. Your Steam ID, the version number you agreed to, and
the time we first saw that agreement (tos_accepted_version, tos_accepted_at). The time is
kept from your first agreement to a version; a later upload carrying the same version does not
overwrite it. An upload that names an older version than the one currently in force is refused
and nothing is recorded. You can never agree to a version that has not been published.

When a new version is published, the notice appears again in-game and telemetry upload
pauses until you accept the new version; your laps and lap times continue to be recorded as
described in §3.3.

Who can see it. Rich telemetry is visible only to you on your own lap pages; it is never
shown to other players. KOTT staff can open it when investigating a suspected physics
manipulation (§4) or a support request you raise.

How long we keep it. The raw recording is deleted automatically once it is older than the
retention window set by KOTT (currently 90 days). Lap
times, sector splits, top speed and the small personal-best reference used for the in-game delta
bar are kept as part of your lap record (§3.3 / §6) — only the raw trace ages out. Deletion is
irreversible.

Erasure. Requesting erasure of your account from /me removes every recording together with
the rest of your data after the 30-day grace period (§8); the erasure sweep does not wait for the
retention window.

3.4a. In-game chat

Messages you send in chat on a KOTT server are recorded, together with your
Steam ID, the display name you were using, the server, and the timestamp. This
is used for moderation — investigating abuse reports and resolving disputes.

Chat is content of your communications, so treat anything you type on a KOTT
server as recorded. Do not share personal or sensitive information in chat.

3.4b. Live position broadcast

While you are connected to a KOTT server, your car's position on track is
broadcast publicly and in real time on the live server map on our website,
alongside your display name, crew tag, rank and best time. Anyone visiting the
site can see it — no account needed.

This is limited to your position within the game world for as long as you are
connected. It is not stored as a location history, and it says nothing about
your physical location. If you do not want this, do not join a server while the
live map is enabled.

3.4c. Crews, badges and community standings

If you join or create a crew we store your membership, the crew's name and tag,
and your role in it. Crews may upload a sticker image, which is reviewed by a
human before it appears. We also store any badges awarded to you and your
per-community skill rating. All of this is public on the site.

3.5. Technical and security data

When you visit the Service we briefly process:

• IP address — used for rate limiting, anomaly detection

(API-key fingerprint binding, Tier 1 fleet operator anti-
abuse), and short-term server logs (typically rotated within
30 days). IP addresses are redacted from public APIs and
never displayed publicly.

• Browser user-agent — used for technical diagnostics and

abuse detection.

• Cookies — see Section 9 below.

3.6. Bans and moderation

If you are banned, suspended, or appeal a moderation action, we
record:

• The action taken, the issuing admin, the public reason, the

internal note (admin-only), and any appeal URL or transcript.

• Tenant scope (whether the action applies Service-wide or to a

specific Operator's servers only).

This data persists in the moderation log for as long as required to
operate the moderation system effectively.

3.7. Feedback and disputes

If you submit a feedback report or open a match dispute we record
your message text, attachments, and the corresponding Steam ID and
match context.

4. How We Use Your Data

We process your data for the following purposes and on the
following GDPR Article 6 legal bases:

• Authenticate you on the Service — Steam ID, Discord ID (if linked) · Contract (Article 6(1)(b))
• Display your public profile, rating, and match history — Steam ID, display name, lap data, rating · Contract (Article 6(1)(b))
• Provide scoring, community ladders, and leaderboards — Lap and race data, community ladder standing · Contract (Article 6(1)(b))
• Answer the Discord bot's commands for your account — Discord ID · Contract (Article 6(1)(b))
• Detect cheating, manipulate-rating attempts, abuse — Telemetry, IP, lap data · Legitimate interest (Article 6(1)(f))
• Show you your own lap analysis (track map, inputs, friction circle) — Rich client telemetry · Contract (Article 6(1)(b))
• Show live on-track positions on the public server map — In-game position, display name, crew tag · Legitimate interest (Article 6(1)(f))
• Moderate servers and resolve disputes — In-game chat messages · Legitimate interest (Article 6(1)(f))
• Operate crews, badges and community standings — Crew membership, badges, community rating · Contract (Article 6(1)(b))
• Operate, maintain, and improve the Service — All of the above · Legitimate interest (Article 6(1)(f))
• Comply with legal obligations (e.g. court order) — As required · Legal obligation (Article 6(1)(c))
• Operate the moderation and appeals system — Bans, dispute messages, audit log · Legitimate interest (Article 6(1)(f))

You can withdraw consent for Discord notifications at any time from
your notification settings page.

5. Data Sharing

We do not sell, rent, or otherwise commercially share your
personal data with third parties.

We share data only with:

5.1. You

Everything tied to your Steam ID is visible on your public profile
and accessible via your /me page.

5.2. Other players (publicly)

The following data is publicly visible on leaderboards, profile
pages, and match-history pages:

• Your Steam display name and avatar.
• Your Glicko-2 standing on each community ladder you race in, and your race record.
• Your lap times, sector splits, and personal-best history.
• The fact that you have raced specific players.

This is the inherent point of a public competitive racing
leaderboard.

5.3. Service providers

• Steam (Valve Corporation) — Steam OpenID for authentication.
• Discord (Discord Inc.) — Discord OAuth2 for account linking

and bot API for notifications, role sync.

• Our hosting provider — VPS infrastructure for the central

Service.

• Assetto Corsa lobby service — server registration only; no

player data flows to the lobby.

We require these providers to safeguard your data and to use it only
for the purposes for which it was disclosed.

5.4. Operator-run servers (tenants)

When you race on a third-party Operator's server, the Operator can
see — within the scope of their tenant — your in-game activity:

• Your in-game player name (broadcast by the AssettoServer protocol).
• Your race history on their servers.
• Tenant-scoped moderation context (bans they have applied).

Operators do NOT see your IP address (Tier 1 fleet IP data is
held centrally), your Discord ID (unless you separately share it),
or your full cross-tenant rating history.

KOTT-central staff have administrative access to all data for
moderation, support, and fraud-prevention purposes.

5.5. Legal authorities

We may disclose data when required to comply with a valid legal
process, court order, or governmental request, when we believe in
good faith that disclosure is necessary to protect the rights or
safety of users or the public, or to comply with applicable law.

6. Data Retention

• Account data (Steam ID, Discord link) — Until you request erasure
• Race results and community ladder standing — Indefinite (historical competitive record)
• Lap times and sector splits — Indefinite (leaderboards / records)
• Server-authoritative race position traces — 90 days, then automatically deleted
• Rich client telemetry traces (§3.4) — the retention window set by KOTT, currently 90 days, then automatically deleted (set to "keep forever" only by an explicit KOTT decision)
• Your agreement record (§3.4: version + time) — Kept with your account until you request erasure, so we can show which version you agreed to
• In-game chat messages (§3.4a) — 90 days, then automatically deleted
• Live position broadcast (§3.4b) — Not stored — transient, discarded when you disconnect
• Crew membership, badges, community ratings — Until you leave the crew or request erasure
• Server logs (including IP) — Rotated within 30 days
• Database backups — 60 days, then deleted
• Moderation records (bans, audit log) — Indefinite (operational requirement)
• Feedback and dispute messages — Indefinite (operational record)

We keep results and lap times indefinitely because they are the competitive
record the Service exists to maintain — a leaderboard that silently forgets is
not a leaderboard. The detailed traces behind those results are a different
matter: they are far more granular, far less necessary after the fact, and are
therefore deleted on the schedule above.

When you exercise your right to erasure (Section 7.3), your data is
removed from the live Service immediately. It may persist in
encrypted backups for up to 60 days before backup expiry; we do
not restore from backups containing erased data without your renewed
consent.

7. Your Rights Under GDPR

You have the following rights regarding your personal data. We honor
these rights regardless of your jurisdiction.

7.1. Right of access (Article 15)

You can view all data tied to your Steam ID directly from your
/me profile page. For a full machine-readable export of
your data, request one via the KOTT Discord (see Section 11).

7.2. Right to rectification (Article 16)

Some profile fields are derived from Steam (display name, avatar)
and are updated automatically when Steam provides new values; you
can update those at the source. Other corrections (e.g. disputed
match results) are handled via the match-dispute system
or via Discord support.

7.3. Right to erasure (Article 17, "right to be forgotten")

You can self-serve account deletion from your
profile page using the Delete my account
button. This:

• Schedules erasure with a 30-day grace window (you can cancel

during this period).

• After the grace window, hard-deletes your row in players,

player_ratings, discord_links, player_bans, and cascades
through all child tables (race participations, lap records,
rating history, telemetry traces, moderation records).

• Backups containing your data continue to age out for up to

60 days; we do not restore from those backups.

Anonymized aggregate data (overall match counts, leaderboard
position history excluding your name) may be retained.

7.4. Right to restriction of processing (Article 18)

You can disable Discord notifications via your
notification settings page. To restrict other
processing, contact us via Discord.

7.5. Right to data portability (Article 20)

You can request a JSON-format export of your data via the KOTT
Discord. We aim to fulfill data-export requests within 30 days.

7.6. Right to object (Article 21)

You can object to processing based on legitimate interest by
contacting us. We will weigh your objection against our legitimate
interest in operating the Service, the moderation system, and
anti-abuse measures.

7.7. Right to lodge a complaint

If you believe your data-protection rights have been violated, you
have the right to lodge a complaint with your local data-protection
supervisory authority. In the EU, find your supervisory authority via
the European Data Protection Board.

8. International Data Transfers

Your data is stored in the United States. The Service runs on a dedicated server hosted by OVH in Vint Hill, Virginia, USA, and encrypted database backups are stored with Backblaze B2, also in the United States. If you are in the EEA or the UK, your personal data is transferred outside the EEA/UK and stored there.

We rely on the Standard Contractual Clauses for both transfers.

Hosting. Our hosting provider's Data Processing Agreement incorporates the EU Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, applying the controller-to-processor clauses — we are the controller and OVH US LLC (dba OVHcloud) is the processor and data importer. Creating an account executes that agreement and those clauses; no separate signature is required. For transfers originating in the United Kingdom, the UK International Data Transfer Addendum to those clauses (Version B1.0) also applies, as Schedule 3 to the same agreement. The provider's Data Processing Agreement is published at us.ovhcloud.com/legal/data-processing-agreement.

Backups. Backblaze's Data Processing Addendum supplements its Terms of Service and incorporates the same 2021/914 Standard Contractual Clauses, applying the controller-to-processor clauses to customers that are organisations — which we are — with Backblaze, Inc. as the processor and data importer. It is published at backblaze.com/company/policy/dpa-for-eea-eu-residents.

You may request a copy of the relevant safeguards by contacting us at the address in §11.

<!-- Verified 2026-09-15 by reading both provider DPAs directly, after the infrastructure moved
off Hostinger (Phoenix, Arizona) to OVH (Vint Hill, Virginia) on the same day. The previous
text declared reliance on Hostinger's DPA; Hostinger is no longer a processor for the live
Service, and that text is preserved in git history.

What each document actually says, so the next reader does not re-derive it:
• OVH US LLC dba OVHcloud, 11950 Democracy Drive, Suite 300, Reston, VA 20190. DPA last
updated 2025-12-10. SCCs of 2021/914 at Schedules 1 (controller-to-processor) and 2
(processor-to-processor); UK IDTA Version B1.0 at Schedule 3. "Customer's execution of
an order form or creation of an account constitutes its execution of this DPA and the
Standard Contractual Clauses" — deemed signed, like Hostinger's was.
• Backblaze, Inc. DPA last updated 2022-09-20. Module One (controller-to-controller) for
individual customers, Module Two (controller-to-processor) for organisations. Nackware
LLC is an organisation, so Module Two.

TWO THINGS STILL FOR A HUMAN, neither of which blocks the EU/EEA position above:

1. ⚠️ BACKBLAZE'S UK ROUTE IS THE OLD ONE. Their separate UK addendum
(backblaze.com/company/policy/dpa-for-uk-residents, also 2022-09-20) uses the older UK
Standard Contractual Clauses — it is headed "for the purposes of Article 26(2) of
Directive 95/46/EC" and cites s.17A DPA 2018 / Schedule 21 — NOT the UK IDTA B1.0 that
OVH uses. Whether that remains an adequate route for new UK transfers is a legal
question this file should not answer. §8 above therefore claims the UK addendum for
the HOSTING transfer only and says nothing about the UK for backups. Resolve with
privacy@backblaze.com or counsel before claiming more.

2. Confirm the OVH contracting entity on the actual invoice is OVH US LLC and not
OVHcloud SAS or OVH Hosting Ltd. The Vint Hill datacentre and the US DPA both point to
OVH US LLC, but which entity you contracted with is an account fact, not a public one.

None of this is legal review. It is a faithful reading of two published documents.

This section is written UNWRAPPED (long lines) on purpose: CommunityMarkdown applies
inline formatting per line, so a bold span crossing a newline renders as literal
asterisks. Keep paragraphs on one line here.

Re-check if the server moves region or either provider changes. -->

<!-- The 2026-07-27 note that stood here described reading Hostinger's DPA and finding the
SCCs already in force but undeclared. It was accurate then and is history now: the
move to OVH on 2026-09-15 retired that mechanism along with that provider. Kept in
git rather than inline, because a verification note for a processor we no longer use
reads as though it still covers the transfer.

The lesson it ends on is the one that survives: the starter this document came from
asserted the server was "located in the European Union", and it never was. Denying a
transfer that is actually happening is worse than declaring it and naming the
mechanism as pending — which is why §8 is now written the way it is. -->

9. Cookies and Local Storage

We use the following cookies and local-storage entries:

• kott-player — Player authentication after Steam login · 14 days · Strictly necessary
• kott-admin — Admin-panel authentication · 30 days · Strictly necessary
• kott-admin-tenant — Admin sidebar tenant switcher state · Session · Strictly necessary
• dismissed_discord_prompt — Remembers if you dismissed the Discord-link toast · 7 days · Functional
• kott_dismissed_announcements (localStorage) — Tracks announcement banners you dismissed · Until cleared · Functional
• kott_recent_visits (localStorage) — Cmd-K admin palette recent-routes · Until cleared · Functional

We do NOT use:

• Advertising cookies.
• Cross-site tracking pixels.
• Third-party analytics that profile individual users.

10. Children

The Service is not directed to children under 13 (or the higher age
of digital consent in your country, e.g. 16 in most EU jurisdictions
for ranked features). We do not knowingly collect data from children
below these thresholds.

If you believe we have inadvertently collected data from a child
below the applicable age threshold, please contact
nack@kingofthetouge.com and we will remove it.

11. Contact

For privacy-related inquiries, data-export requests, erasure
requests beyond the self-serve flow, or to exercise any of the
GDPR rights above:

• Email: nack@kingofthetouge.com
• Discord: Join via the link in the site footer; #support channel.
• Data Protection Officer: none designated, and none required — see §2 for

why. Enquiries go to the address above.

We aim to respond to GDPR requests within 30 days (one month)
of receipt as required by Article 12(3). Complex requests may be
extended by an additional two months with notice.

12. Changes to This Policy

We may update this Privacy Policy as the Service evolves. When we do:

• The "Last updated" date at the top of /privacy will be revised.
• Material changes (new categories of data collected, changes to

legal basis, changes to recipients) will be announced via the
Service and in the KOTT Discord at least 14 days before they
take effect, where practicable.

• Continued use of the Service after the revised policy takes

effect constitutes your acceptance of it.

If you do not agree to a revised policy, your remedy is to stop
using the Service and (optionally) delete your account.

---

Last updated: 2026-09-16.