Privacy Policy
At Apex Scout, we believe privacy is a fundamental right.
Policy Overview
Apex Scout ("we," "our," or "us") is operated by João Paulo Cruz dos Santos, a sole proprietor established in Portugal, who acts as the data controller for the personal data described in this policy. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.
Information We Collect
Personal Information
We may collect personal information that you voluntarily provide to us when you register on the website, express an interest in obtaining information about us or our services, or otherwise contact us. This may include:
- Name and email address
- Account credentials
- Profile information
- Communication preferences
- Vehicle and garage records (vehicles, setup sheets, maintenance and service history, odometer readings, faults, modifications, and private journal or track notes)
- Track-day activity (event bookings, attendance, and lap times)
- Session telemetry you upload (RaceChrono CSV files, GPS path traces, derived lap metrics, and Scout insight text). GPS traces are location data and are hard-deleted when you delete a session or your account.
- Approximate device location (mobile app only, with your permission): a foreground-only position fix used to find track days near you, never collected in the background and never used for advertising
- Content you create (profile and community posts, photos, comments, track notes, and messages to other users)
- AI assistant conversations and any files you attach to them
Google Sign-In Integration
When you choose to sign in with Google, we use Google OAuth 2.0 for authentication. Through this integration, we request and collect the following specific information from your Google account:
- Email address: Used to create and identify your account
- Name: Used to personalize your experience on our platform
- Profile picture: Used to display your avatar throughout the application
- Unique Google ID: Used to securely link your Google account to your Apex Scout account
We only request the minimum data necessary. We do not access your Google Drive, Gmail, or Calendar. You can revoke access at any time via your Google Account permissions page.
Discord Account Linking
If you choose to link a Discord account from your settings, we use Discord OAuth to confirm the connection and store your Discord user ID and username so we can display the link and offer community features. We do not post to Discord on your behalf and do not read your Discord messages. You can unlink your Discord account at any time from your settings.
Usage Information
We automatically collect certain information when you visit, use, or navigate our website. This information may include your IP address, browser type, operating system, referring URLs, pages viewed, and timestamps.
How We Use Your Information
We use the information we collect to:
- Authentication: Verify identity and secure your account.
- Service Delivery: Operate track day finder and maps.
- Personalization: Remember preferences and display profile.
- Communication: Send updates and respond to inquiries.
- Improvement: Analyze usage to enhance services.
- Security: Protect against fraud and unauthorized access.
The data we collect through Google Sign-In is used exclusively for authentication and personalization purposes within Apex Scout. We never use your Google data for advertising, selling to third parties, or any purpose unrelated to providing our track day finder services.
We do not sell your personal info. We share only with service providers, for legal requirements, or during business transfers.
We implement robust security measures. However, no internet transmission is 100% secure, so absolute security cannot be guaranteed.
We use a small number of cookies in two categories. See the dedicated Cookies section below for the full list and how to change your choice.
Cookies We Use
We split cookies into two categories. You can opt out of Analytics at any time — your choice is stored in the apex_scout_consent cookie for 12 months.
Strictly necessary (always on)
- apex-scout-session — keeps you signed in (expires after 120 minutes of inactivity).
- XSRF-TOKEN — CSRF protection for form submissions (session cookie).
- sidebar_state — remembers whether your sidebar is open in the authenticated app.
- apex_scout_consent — stores your cookie preferences so we don't ask again (12 months).
Analytics (opt-in)
- PostHog — product analytics: page views, sign-ups, feature usage. Hosted by PostHog Inc. on its EU cloud. Privacy policy.
- Google Analytics (gtag) — aggregate traffic statistics (page, referrer, anonymised IP). Privacy policy.
Analytics tracking through PostHog and Google Analytics is blocked, in your browser and on our servers, until you accept the Analytics category. Two narrow exceptions may run regardless of your choice: error and crash reports (operational telemetry, not behavioural tracking) and server-side feature-flag checks that decide which features are enabled for you. When you are signed in, your analytics events are identified to PostHog using your email address.
Outbound link clicks
When you click a link that leaves Apex Scout (for example, to an organizer or track website), we record which link was clicked so we can measure interest and improve our listings. If you are signed in, this click is attributed to your account. This is a first-party record stored in our own database, uses no cookie, and runs whether or not you have accepted the Analytics category. We deliberately do not store your IP address, browser, or referrer for these clicks.
How AI Features Use Your Data
Apex Scout includes AI assistants and AI-powered event discovery. When you use these features, the content you send and relevant context about your account is transmitted to third-party AI model providers to generate a response. Depending on the feature and your subscription plan, this context can include: your name, country, timezone, and preferences; your garage and vehicle records (make, model, setup sheets, maintenance history, faults, modifications, odometer, and journal or track notes); your event attendance and lap times; short facts the assistant has previously saved about you; summaries of your earlier conversations; the messages you type; and any files (PDF, CSV, text, or images) you attach.
By default, chat on all plans is processed by Moonshot AI. Because Moonshot processes data on servers outside the European Economic Area, including in the People's Republic of China, using AI chat involves an international transfer of your data. Max-plan subscribers who choose a different model may instead route their conversations to Anthropic, OpenAI, xAI, or Google. Our AI assistants can also perform web searches through Tavily, which receives the search text generated from your request.
We apply a technical safeguard that blocks the assistant from saving certain sensitive fields (such as passwords, payment details, government identifiers, phone numbers, and addresses) into its long-term memory. This is a safeguard, not a guarantee, so please do not share sensitive personal data in a conversation that you would not want stored.
We keep your AI conversation history for as long as your account exists so the assistants stay useful across sessions. Uploaded attachments are removed automatically on a shorter cycle (unused uploads within 24 hours, deleted uploads within 90 days). Deleting your account erases your conversations and attachments.
Sub-Processors
To operate our service we engage the following sub-processors. Each receives only the data necessary for the stated purpose and is bound by its own privacy policy linked below.
| Provider | Purpose | Region |
|---|---|---|
| Authentication (Google OAuth 2.0), aggregate traffic analytics (Google Analytics), and AI chat processing when Gemini is selected by Max-plan subscribers | United States | |
| Discord | Optional OAuth account linking for connected accounts (receives an authorization and returns your Discord user ID and username) | United States |
| PostHog | Product analytics: page views, sign-ups, and feature usage | European Union |
| Moonshot AI | Default AI provider for chat assistants and document processing (including uploaded PDFs and images). Data may be transferred to servers outside the EEA, including to the People's Republic of China. | Outside EEA (PRC/global) |
| Anthropic | AI chat processing when selected by Max-plan subscribers, and internal AI quality evaluation | United States |
| OpenAI | AI chat processing when selected by Max-plan subscribers | United States |
| xAI | AI chat processing when selected by Max-plan subscribers, and internal AI quality evaluation | United States |
| Tavily | Web search and content retrieval requested by AI assistants (receives search text generated from your conversation) | United States |
| Stripe | Payment processing and subscription management | United States |
| Resend | Transactional email delivery (account notifications, receipts) | United States |
| Cloudflare | File storage for user-uploaded content (R2) and processing of uploaded images such as chat attachments (Cloudflare Images) | Configurable; defaults to United States |
| Laravel Nightwatch | Application performance monitoring and error tracking (captures request telemetry, exceptions, and stack traces) | United States |
Depending on your location, you may have rights to:
- Access and copy your data
- Correct or update your data
- Delete your data
- Restrict processing
- Data portability
If you are in the EU/EEA, you also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Portuguese data protection authority (CNPD, cnpd.pt).
Our services are not intended for individuals under 18. We do not knowingly collect personal information from children. If you believe we have, please contact us immediately.
Data Retention and Deletion
You can delete your account at any time from your settings. Deleting your account removes your profile, garage and vehicle records, posts, messages, and AI conversations and their attachments, cancels any active subscription immediately, erases your analytics profile from PostHog, and redacts your email from our email-campaign records. We keep account data for as long as your account is active. Internal activity and audit logs are retained for up to 365 days.
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically.