Privacy

F1RaceDraft (www.f1racedraft.com) is a fan-made fantasy motorsport game, not affiliated with Formula 1 (the “Site”). It is operated by Blackbird Corporation. F1RaceDraft is operated by Blackbird Corporation. Privacy and legal contact: hello@blackbirdcorporation.com. Place of operation stated on the Site: Ireland.

For privacy requests — access, correction, a copy of your data, or deletion — email hello@blackbirdcorporation.com. Using the email address on your account helps us verify the request. It is not an absolute requirement; we may still need to ask for enough information to confirm it is you.

• The Site is intended for people aged 18 or over.
• You can browse races, results, and games without creating an account.
• If you sign up, we store the email and username you give us, a hashed password (not the password itself), and the teams and picks you lock so they follow you across devices.
• We do not charge you, we do not take card details, and we do not sell your data.
• Google Analytics and Google AdSense cookies are optional. They stay off until you accept them on the cookie banner. Details are in our Cookies notice.

Account. Email address, username, password hash and salt, verification and reset codes (stored as hashes, for a short time), terms-acceptance time and policy version, and a signed-in session cookie.

Play. Weekend teams (podium, fastest lap, DNF calls), season driver and constructor picks, and league entries tied to your account so friends can see your username, team name, and locked picks on a shared board.

On this device. A local copy of picks may sit in your browser so the Site feels fast. Game bests for Lights Out and Pit Stop stay in this browser session only. Guess the Circuit and Pit Lane Limiter do not persist scores. A random paddock id in session storage powers the “in the paddock” count — it is not your name or email.

Analytics (optional). If you accept analytics cookies, the Site loads Google Analytics 4 (gtag.js, measurement ID G-JR9N6NPZ1K) so we can see page views and traffic. Google may set cookies on your device. We do not send your account email to Google Analytics.

Page counts (no cookie). Vercel Web Analytics counts pages and, when your link includes them, campaign tags such as utm_source. It does not set an analytics cookie and it does not receive your account email. Refusing analytics cookies turns off Google Analytics. It does not turn off this page count.

Advertising (optional in the EEA, UK, and Switzerland). If you accept advertising cookies, Google AdSense and its partners may set cookies or use identifiers to serve ads. In-page Adsterra (Profitableratecpmnetwork) units follow the same choice in those regions and when we cannot tell the country. Elsewhere those in-page units can load before a choice, and you can turn them off in Cookie settings. Partners may set cookies or use identifiers to serve, measure, and (where allowed) personalise ads on this Site. Third-party vendors, including Google and Adsterra partners, may use cookies or similar technologies to deliver and measure advertising based on a user’s prior visits to this Site or other sites. Google’s use of advertising cookies enables it and its partners to serve ads based on visits to this Site and/or other sites on the internet. You may opt out of personalised advertising at Google Ads Settings or aboutads.info. How Google uses data on partner sites: policies.google.com/technologies/partner-sites. We do not send your account email to AdSense or Adsterra.

Technical logs. The hosting provider may keep standard request logs (IP address, time, pages) for security and uptime. We do not use these to advertise to you. How long those logs are kept is set by the hosting provider. A specific period is not published on this Site.

Site visit total (optional, no cookie). On production we may add 1 to a per-site visit total stored in a separate database (Supabase table visitor, row f1racedraft.com). That store holds only the site name, a count, and a last-updated time — not your email, IP, or account. It is not Google Analytics.

We do not ask for payment details, government ID, or precise location.

• To run your garage — create an account, keep you signed in, save teams, score races, and show league boards (performance of a contract with you).
• To keep the Site safe — prevent abuse, spam, and cheating (legitimate interests in a fair, working service).
• Analytics — Google Analytics page views if you consent (consent).
• Advertising — Google AdSense and partners if you consent (consent).
• To email you about your account only — verification and password-reset codes. We do not send marketing lists.

• We do not sell, rent, or trade your personal information.
• We do not sell your account data to advertisers or run ads against your garage email.
• We do not take entry fees or real-money stakes.
• We do not use your data for automated decisions that produce legal or similarly significant effects.

We use service providers (processors) to host the Site, store data, and send account email. They process data to provide that service. Copies of each provider’s data-processing addendum and transfer clauses are not reproduced on this Site.

• Vercel — Site hosting and CDN. Typical data: IP address, request logs, and technical diagnostics for the hosted Site. Vercel Web Analytics also counts page views without a cookie.. Region: Location depends on the provider.
• Neon — Postgres database. Typical data: Account email, username, password hash/salt, picks, league entries, presence ids. Region: Location depends on the provider.
• Resend — Transactional email (verification and password reset). Typical data: Email address and message content for those account emails. Region: Location depends on the provider.

Production hosting for this Site is Vercel. Netlify is not listed as a production processor.

Other parties the Site talks to, including Google when you accept optional cookies:

• Vercel Web Analytics — Cookie-free page and campaign counts. Page path and, when a link includes them, utm_source, utm_medium, and utm_campaign. No account email and no analytics cookie. This runs so we can see which post brought a visit even when Google Analytics is refused.
• Google Analytics — Audience and traffic measurement via gtag.js (GA4). If you accept analytics cookies, your browser sends page views and technical data (for example approximate location from IP, device, and referring page) to Google. Google may set first-party cookies such as _ga. We do not send your account email to Google Analytics from this Site.
• Google AdSense — Advertising (display ads) via Google AdSense. If you accept advertising cookies, Google and its advertising partners may set cookies or use advertising identifiers to serve ads, measure them, and (where you allow it) personalise them. We do not send your account email to AdSense from this Site. You can change this in Cookie settings or Google Ads Settings.
• Adsterra (Profitableratecpmnetwork) — Advertising (in-page native banner). Adsterra and its advertising partners may set cookies or use similar technologies to deliver and measure in-page banners and one native unit. Those units sit in the page flow and do not cover buttons. In the EEA, the UK, Switzerland, and when the country is unknown, they stay off until you allow Advertising. Elsewhere they can load before that choice. You can turn them off in Cookie settings. We do not send your account email to Adsterra from this Site.
• Supabase — Aggregate visit total for this Site. If a visit is counted, we update the visitor row named f1racedraft.com (count and last-updated time only). We do not send your account email or IP to that table.
• Unsplash — Image CDN for page photography (browser request). Your browser may send your IP address to images.unsplash.com when images load. Unsplash does not receive account emails or picks from this Site.
• f1api.dev and OpenF1 — Race calendar, grids, and live timing fetched by our servers. These APIs receive requests from our hosting, not your account email or picks.

Other players can see your public username, team names, and locked picks on leagues and leaderboards. Do not use a username you would not want shown.

We may disclose information if required by law, to protect the Site or other players, or as part of a transfer of the Site (the buyer must honour this notice or give you a new one).

These periods come from the Site’s configuration in code. Where a period is not set in code, we say so.

• Signed-in session cookie (gridrival_auth): Max-Age 30 days, or until you sign out (cookie is then expired with Max-Age 0). Flags: HttpOnly; SameSite=Lax; Path=/; Secure in production (including Vercel).
• Email verification and password-reset codes: stored as hashes and expire after 15 minutes.
• Paddock presence: a visitor is counted as active for 90 seconds; stale presence rows are deleted after 10 minutes.
• Account profile, weekend squads, championship picks, and league entries: kept until you delete the account (or we close it under the Terms).
• On-device weekend and championship picks: localStorage on this browser until you clear this site’s storage.
• Lights Out and Pit Stop session bests, and the random paddock id: sessionStorage for this tab, until the session ends.
• Google Analytics cookies (_ga and related): set by Google only if you accept analytics cookies; retention is controlled by Google (typically up to 24 months for GA4).
• Google advertising cookies (for example DoubleClick / AdSense cookies): set by Google and partners only if you accept advertising cookies; retention is controlled by those vendors.
• Adsterra / Profitableratecpmnetwork advertising cookies or similar technologies: set when an in-page unit loads (after Advertising consent in the EEA, UK, Switzerland, and when the country is unknown; without that wait elsewhere). Retention is controlled by those vendors.
• Site visit total on Supabase (visitor row for f1racedraft.com): kept as a running count until we stop using that table.
• Hosting request logs: kept by the hosting provider for security and uptime. A specific period is not published on this Site.

If you ask us to delete your account, we will remove personal data we control in the database, except where we must keep a record (for example a fraud or legal hold) or where a copy already sits in a backup until that backup is replaced. A specific backup retention period is not published on this Site.

Passwords are stored hashed. Sessions use an HTTP-only cookie named gridrival_auth, SameSite=Lax, with Secure in production. The Site is served over HTTPS. No method of transmission or storage is perfectly secure, and we do not promise that unauthorised access can never happen. If we become aware of a breach that is likely to put your rights at high risk, we will take the steps the law requires, including telling you where we must.

Depending on where you live, you may have the right to:

• access a copy of the personal data we hold about you;
• correct it;
• ask us to delete it or restrict how we use it;
• object to processing based on legitimate interests;
• withdraw cookie consent at any time via Cookie settings in the footer;
• receive data you gave us in a portable form (we handle this by email, not a self-serve download); and
• complain to your local data protection authority (in Ireland, the Data Protection Commission).

Email hello@blackbirdcorporation.com. Using your account email helps verification but is not required. We may still need to verify it is you. We will respond within the time the law allows.

You can delete your account from Account when signed in. Sign out to drop the session cookie on this device. Contact: Contact.

The Site is intended for people aged 18 or over. We do not knowingly collect personal information from anyone under 18, and we do not direct the Site at children under 13. If you believe we have information about a child, email hello@blackbirdcorporation.com and we will delete it.

The Site is offered from F1RaceDraft (www.f1racedraft.com) and is open to fans worldwide. Vercel, Neon, Resend, and Google may process information outside Ireland and the EEA. The specific transfer tools each provider uses are not listed on this page.

We may update this notice from time to time. Material changes will be highlighted. Where a change requires new consent, we will ask for that consent before the new processing starts.

Playing the Site is also covered by our Terms, Cookies notice, About, and Contact page.