Privacy Policy

1. Introduction

This Privacy Policy explains how King of the Touge ("KOTT", "we", "us", or "our") collects, uses, and shares your personal data when you use our competitive Assetto Corsa racing service (the "Service").

We are committed to handling your data lawfully, fairly, and transparently. We comply with the EU General Data Protection Regulation (GDPR) and the UK GDPR as well as analogous data-protection laws in other jurisdictions where the Service is available.

This Privacy Policy is incorporated by reference into the Terms of Service.

2. Data Controller

King of the Touge is operated by an individual, Nick, who is the data controller for the purposes of GDPR and is contactable at `nack@kingofthetouge.com`.

Data Protection Officer. We have not designated a DPO, and are not required to. Article 37(1) mandates one only where processing is carried out by a public authority, where core activities require large-scale regular and systematic monitoring of data subjects, or where core activities involve large-scale processing of special-category data under Article 9. None applies: KOTT is a private hobbyist service with a few hundred players, processes no special-category data, and its monitoring is limited to gameplay within the Service. Direct all data-protection enquiries to `nack@kingofthetouge.com`; they are handled by the operator personally. We will designate a DPO and update this section if that assessment ever changes.

3. Data We Collect

3.1. Steam account data (required)

When you sign in via Steam OpenID we collect:

• Your Steam ID (64-bit integer; the canonical KOTT identity).
• Your public Steam display name.
• Your public Steam avatar URL.

Steam never shares your email, password, real name, or private profile data with us. The Steam ID is treated as personal data under GDPR.

3.2. Discord account data (optional)

If you choose to link a Discord account, we collect via Discord OAuth2:

• Your Discord user ID (snowflake).
• Your Discord display name (global username and per-server

nickname).

We use this data to send you direct-message notifications about matches, queue events, and season announcements; and to assign your rank role on the KOTT Discord. You can unlink your Discord account at any time using the `/unlink` command in the KOTT Discord.

3.3. Race and lap data (server-authoritative)

For every race or Time Attack lap you complete on the Service we record:

• Lap times including sector splits and finish times.
• Server-authoritative telemetry — top speed, average speed,

off-track and collision counts, position trace samples used for lap validation and anti-cheat.

• Match results — winner, loser, rating change, dispute status.
• Rating history — your Glicko-2 rating over time.

This data is tied to your Steam ID.

3.4. Client-side rich telemetry

For some laps your game client uploads a detailed recording of the lap. This is gated on your having accepted these Terms (see §4 — the basis is the contract between us, not separate consent). It comprises:

• 20 Hz samples across 55 channels for the duration of a single lap: your

car's world position, velocity and g-forces; your control inputs (throttle, brake, clutch, steering, handbrake); engine RPM, gear and fuel; and per-wheel tyre temperature, pressure, wear, slip angle, surface grip and suspension travel.

This is the most detailed data we hold about you. It exists so that the lap detail page can show you your own driving — track map, sector breakdown, speed trace, inputs, friction circle and tyre temperatures — and so that we can detect manipulation of the game's physics (see §4).

Rich telemetry is visible only to you on your own lap pages; it is never shown to other players. Collection is currently paused service-wide.

3.4a. In-game chat

Messages you send in chat on a KOTT server are recorded, together with your Steam ID, the display name you were using, the server, and the timestamp. This is used for moderation — investigating abuse reports and resolving disputes.

Chat is content of your communications, so treat anything you type on a KOTT server as recorded. Do not share personal or sensitive information in chat.

3.4b. Live position broadcast

While you are connected to a KOTT server, your car's position on track is broadcast publicly and in real time on the live server map on our website, alongside your display name, crew tag, rank and best time. Anyone visiting the site can see it — no account needed.

This is limited to your position within the game world for as long as you are connected. It is not stored as a location history, and it says nothing about your physical location. If you do not want this, do not join a server while the live map is enabled.

3.4c. Crews, badges and community standings

If you join or create a crew we store your membership, the crew's name and tag, and your role in it. Crews may upload a sticker image, which is reviewed by a human before it appears. We also store any badges awarded to you and your per-community skill rating. All of this is public on the site.

3.5. Technical and security data

When you visit the Service we briefly process:

• IP address — used for rate limiting, anomaly detection

(matchmaking key fingerprint binding, Tier 1 fleet operator anti- abuse), and short-term server logs (typically rotated within 30 days). IP addresses are redacted from public APIs and never displayed publicly.

• Browser user-agent — used for technical diagnostics and

abuse detection.

• Cookies — see Section 9 below.

3.6. Bans and moderation

If you are banned, suspended, or appeal a moderation action, we record:

• The action taken, the issuing admin, the public reason, the

internal note (admin-only), and any appeal URL or transcript.

• Tenant scope (whether the action applies Service-wide or to a

specific Operator's servers only).

This data persists in the moderation log for as long as required to operate the moderation system effectively.

3.7. Feedback and disputes

If you submit a feedback report or open a match dispute we record your message text, attachments, and the corresponding Steam ID and match context.

4. How We Use Your Data

We process your data for the following purposes and on the following GDPR Article 6 legal bases:

• Authenticate you on the Service — Steam ID, Discord ID (if linked) · Contract (Article 6(1)(b))
• Display your public profile, rating, and match history — Steam ID, display name, lap data, rating · Contract (Article 6(1)(b))
• Provide matchmaking, scoring, and leaderboards — Lap and race data, rating history · Contract (Article 6(1)(b))
• Send you Discord notifications — Discord ID, notification preferences · Consent (Article 6(1)(a))
• Detect cheating, manipulate-rating attempts, abuse — Telemetry, IP, lap data · Legitimate interest (Article 6(1)(f))
• Show you your own lap analysis (track map, inputs, friction circle) — Rich client telemetry · Contract (Article 6(1)(b))
• Show live on-track positions on the public server map — In-game position, display name, crew tag · Legitimate interest (Article 6(1)(f))
• Moderate servers and resolve disputes — In-game chat messages · Legitimate interest (Article 6(1)(f))
• Operate crews, badges and community standings — Crew membership, badges, community rating · Contract (Article 6(1)(b))
• Operate, maintain, and improve the Service — All of the above · Legitimate interest (Article 6(1)(f))
• Comply with legal obligations (e.g. court order) — As required · Legal obligation (Article 6(1)(c))
• Operate the moderation and appeals system — Bans, dispute messages, audit log · Legitimate interest (Article 6(1)(f))

You can withdraw consent for Discord notifications at any time from your notification settings page.

5. Data Sharing

We do not sell, rent, or otherwise commercially share your personal data with third parties.

We share data only with:

5.1. You

Everything tied to your Steam ID is visible on your public profile and accessible via your `/me` page.

5.2. Other players (publicly)

The following data is publicly visible on leaderboards, profile pages, and match-history pages:

• Your Steam display name and avatar.
• Your Glicko-2 rating, rank tier, and match record.
• Your lap times, sector splits, and personal-best history.
• The fact that you have raced specific players.

This is the inherent point of a public competitive racing leaderboard.

5.3. Service providers

• Steam (Valve Corporation) — Steam OpenID for authentication.
• Discord (Discord Inc.) — Discord OAuth2 for account linking

and bot API for notifications, role sync.

• Our hosting provider — VPS infrastructure for the central

Service.

• Assetto Corsa lobby service — server registration only; no

player data flows to the lobby.

We require these providers to safeguard your data and to use it only for the purposes for which it was disclosed.

5.4. Operator-run servers (tenants)

When you race on a third-party Operator's server, the Operator can see — within the scope of their tenant — your in-game activity:

• Your in-game player name (broadcast by the AssettoServer protocol).
• Your race history on their servers.
• Tenant-scoped moderation context (bans they have applied).

Operators do NOT see your IP address (Tier 1 fleet IP data is held centrally), your Discord ID (unless you separately share it), or your full cross-tenant rating history.

KOTT-central staff have administrative access to all data for moderation, support, and fraud-prevention purposes.

5.5. Legal authorities

We may disclose data when required to comply with a valid legal process, court order, or governmental request, when we believe in good faith that disclosure is necessary to protect the rights or safety of users or the public, or to comply with applicable law.

6. Data Retention

• Account data (Steam ID, Discord link) — Until you request erasure
• Match results and rating history — Indefinite (historical competitive record)
• Lap times and sector splits — Indefinite (leaderboards / records)
• Server-authoritative race position traces — 90 days, then automatically deleted
• Rich client telemetry traces (§3.4) — 90 days, then automatically deleted
• In-game chat messages (§3.4a) — 90 days, then automatically deleted
• Live position broadcast (§3.4b) — Not stored — transient, discarded when you disconnect
• Crew membership, badges, community ratings — Until you leave the crew or request erasure
• Server logs (including IP) — Rotated within 30 days
• Database backups — 60 days, then deleted
• Moderation records (bans, audit log) — Indefinite (operational requirement)
• Feedback and dispute messages — Indefinite (operational record)

We keep results and lap times indefinitely because they are the competitive record the Service exists to maintain — a leaderboard that silently forgets is not a leaderboard. The detailed traces behind those results are a different matter: they are far more granular, far less necessary after the fact, and are therefore deleted on the schedule above.

When you exercise your right to erasure (Section 7.3), your data is removed from the live Service immediately. It may persist in encrypted backups for up to 60 days before backup expiry; we do not restore from backups containing erased data without your renewed consent.

7. Your Rights Under GDPR

You have the following rights regarding your personal data. We honor these rights regardless of your jurisdiction.

7.1. Right of access (Article 15)

You can view all data tied to your Steam ID directly from your `/me` profile page. For a full machine-readable export of your data, request one via the KOTT Discord (see Section 11).

7.2. Right to rectification (Article 16)

Some profile fields are derived from Steam (display name, avatar) and are updated automatically when Steam provides new values; you can update those at the source. Other corrections (e.g. disputed match results) are handled via the match-dispute system or via Discord support.

7.3. Right to erasure (Article 17, "right to be forgotten")

You can self-serve account deletion from your profile page using the Delete my account button. This:

• Schedules erasure with a 30-day grace window (you can cancel

during this period).

• After the grace window, hard-deletes your row in `players`,

`player_ratings`, `discord_links`, `player_bans`, and cascades through all child tables (race participations, lap records, rating history, telemetry traces, moderation records).

• Backups containing your data continue to age out for up to

60 days; we do not restore from those backups.

Anonymized aggregate data (overall match counts, leaderboard position history excluding your name) may be retained.

7.4. Right to restriction of processing (Article 18)

You can disable Discord notifications via your notification settings page. To restrict other processing, contact us via Discord.

7.5. Right to data portability (Article 20)

You can request a JSON-format export of your data via the KOTT Discord. We aim to fulfill data-export requests within 30 days.

7.6. Right to object (Article 21)

You can object to processing based on legitimate interest by contacting us. We will weigh your objection against our legitimate interest in operating the Service, the moderation system, and anti-abuse measures.

7.7. Right to lodge a complaint

If you believe your data-protection rights have been violated, you have the right to lodge a complaint with your local data-protection supervisory authority. In the EU, find your supervisory authority via the European Data Protection Board.

8. International Data Transfers

Your data is stored in the United States. The Service runs on a virtual private server hosted by Hostinger International Ltd. in Phoenix, Arizona, USA. If you are in the EEA or the UK, your personal data is transferred outside the EEA/UK and stored there.

We rely on the Standard Contractual Clauses for that transfer. Our hosting provider's Data Processing Agreement incorporates the EU Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, applying Module Two (controller to processor) — we are the controller and Hostinger International Ltd. is the processor and data importer. For transfers originating in the United Kingdom, the UK International Data Transfer Addendum to those clauses (Version B1.0, in force 21 March 2022) issued by the UK Information Commissioner also applies.

You may request a copy of the relevant safeguards by contacting us at the address in §11. The provider's Data Processing Agreement is published at hostinger.com/legal/dpa and their data-protection contact is `gdpr@hostinger.com`.

9. Cookies and Local Storage

We use the following cookies and local-storage entries:

• `kott-player` — Player authentication after Steam login · 14 days · Strictly necessary
• `kott-admin` — Admin-panel authentication · 30 days · Strictly necessary
• `kott-admin-tenant` — Admin sidebar tenant switcher state · Session · Strictly necessary
• `dismissed_discord_prompt` — Remembers if you dismissed the Discord-link toast · 7 days · Functional
• `kott_dismissed_announcements` (localStorage) — Tracks announcement banners you dismissed · Until cleared · Functional
• `kott_recent_visits` (localStorage) — Cmd-K admin palette recent-routes · Until cleared · Functional

We do NOT use:

• Advertising cookies.
• Cross-site tracking pixels.
• Third-party analytics that profile individual users.

10. Children

The Service is not directed to children under 13 (or the higher age of digital consent in your country, e.g. 16 in most EU jurisdictions for ranked features). We do not knowingly collect data from children below these thresholds.

If you believe we have inadvertently collected data from a child below the applicable age threshold, please contact `nack@kingofthetouge.com` and we will remove it.

11. Contact

For privacy-related inquiries, data-export requests, erasure requests beyond the self-serve flow, or to exercise any of the GDPR rights above:

• Email: `nack@kingofthetouge.com`
• Discord: Join via the link in the site footer; #support channel.
• Data Protection Officer: none designated, and none required — see §2 for

why. Enquiries go to the address above.

We aim to respond to GDPR requests within 30 days (one month) of receipt as required by Article 12(3). Complex requests may be extended by an additional two months with notice.

12. Changes to This Policy

We may update this Privacy Policy as the Service evolves. When we do:

• The "Last updated" date at the top of `/privacy` will be revised.
• Material changes (new categories of data collected, changes to

legal basis, changes to recipients) will be announced via the Service and in the KOTT Discord at least 14 days before they take effect, where practicable.

• Continued use of the Service after the revised policy takes

effect constitutes your acceptance of it.

If you do not agree to a revised policy, your remedy is to stop using the Service and (optionally) delete your account.

---

Last updated: set to the publication date when this is published via Admin → Legal.