Privacy Policy
Effective Date: [DATE — set at launch] Last Updated: 2026-08-05
Sim Control ("Sim Control", "we", "us", "our") is operated by Limit Break Technologies LLC, a Texas limited liability company. This Privacy Policy explains what personal data we collect when you use the Sim Control desktop app, website, and related services (the "Services"), why we collect it, who we share it with, and the choices and rights you have. By using the Services you agree to this Policy and to our Terms of Service.
Sim Control is a live race-control, strategy, and telemetry platform for sim racing (iRacing, Le Mans Ultimate, rFactor 2). This Policy reflects that use and nothing else.
1. Purpose limitation (our promise)
We collect personal data only for the clear, specific purposes described in this Policy — running your account, delivering live race control and telemetry analysis, enabling team collaboration, processing subscriptions, and providing support and security. We do not use your data for unrelated purposes. If we ever intend to use your data for a new, materially different purpose, we will tell you and obtain your consent first. We do not sell your personal data, and we do not use it for advertising or cross-context behavioral tracking.
2. Data we collect
2.1 Account information
| Data | Required | Purpose |
|---|---|---|
| Email address | Yes | Account identity, sign-in, transactional email |
| Display name | Yes | Your name in the app and to teammates |
| Password (hashed) | Yes | Authentication — hashed, never stored in plaintext |
| Auth/session tokens | Yes | Keeping you signed in (secure HttpOnly cookies on web; secure storage on desktop/mobile) |
2.2 Sim identities
| Data | Purpose |
|---|---|
| iRacing customer ID / Steam ID, in-sim display name, licence & rating (per sim) | Attribute your results to you, enable per-sim teams, show ratings. Verified via the sim's own data API where available. |
2.3 Team & collaboration data
| Data | Purpose |
|---|---|
| Team membership, roles, invitations | Role-based collaboration and access control |
| Direct & team messages | Team communication (end-to-end encrypted, AES-256-GCM) |
2.4 Racing & telemetry data (the core of the Services)
| Data | Purpose |
|---|---|
| Lap times, session results, live telemetry frames | Live race control, results & history, strategy |
Uploaded telemetry files (.ibt, .duckdb) and setups (.sto, .svm) |
Purple Sector analysis, setup library, team sharing |
| Stint/race plans, fuel & strategy inputs | Strategy planning |
You control whether this data is shared to your teams. Data you contribute to a team may remain available to that team per the sharing model even if you leave (see §8).
2.5 Subscription & billing
| Data | Purpose | Where |
|---|---|---|
| Subscription tier & status, Shopify customer reference | Managing your subscription | Our database + Shopify |
| Payment card / bank details | Payment processing | Shopify only — card data never touches our servers |
2.6 Support & diagnostics
| Data | Purpose |
|---|---|
| App diagnostic/log bundles (only when you submit them or on a failure), crash & error reports | Troubleshooting, stability |
2.7 Technical data
| Data | Purpose |
|---|---|
| IP address, device type / user agent, app version, request logs | Security, abuse prevention, rate limiting, operations |
2.8 Data we do NOT collect
- Payment card numbers (handled entirely by Shopify).
- Precise device geolocation.
- Biometric templates — Touch ID / Windows Hello / Face ID are processed on your device only and never transmitted to us.
- Social-media profiles, or your browsing history outside the Services.
3. Privacy "nutrition label"
A quick summary of the above — data type → linked to you? → used for → shared with:
| Data type | Linked to you | Used for | Shared with |
|---|---|---|---|
| Contact (email, name) | Yes | Account, transactional email | Resend (email delivery) |
| Credentials | Yes | Sign-in | — (hashed, never shared) |
| Sim identity & ratings | Yes | Result attribution, teams | — |
| Racing & telemetry data | Yes | Core features; shared to your teams by your choice | Team members you choose; AWS (storage) |
| Purchases / subscription | Yes | Billing | Shopify (payments) |
| Diagnostics & crash data | Yes | Troubleshooting, stability | Sentry, AWS |
| Identifiers (IP, device, app version) | Yes | Security, abuse prevention, operations | — |
Tracking: we use only first-party, essential cookies/local storage for sign-in and preferences. No third-party advertising or cross-site tracking.
4. How we use your data (lawful bases)
| Purpose | Basis |
|---|---|
| Account, teams, telemetry/strategy features | Performance of our contract with you |
| Subscription & billing | Performance of our contract |
| Security, abuse prevention, service reliability | Our legitimate interests |
| Service improvement (aggregated, de-identified) | Our legitimate interests |
| Legal compliance | Legal obligation |
5. Who we share data with (sub-processors)
We share the minimum necessary with vetted service providers, only to run the Services:
| Provider | Data | Purpose |
|---|---|---|
| Amazon Web Services | Uploaded files, backups, hosting | Storage & infrastructure (US) |
| Resend | Email address, name | Transactional email delivery |
| Shopify | Billing/subscription info | Subscription payments |
| Sentry | Error/diagnostic data, identifiers | Crash & error monitoring |
| Discord | Discord identity you choose to link | Community & release notifications (opt-in) |
| iRacing (members data API) | Your iRacing customer ID | Verifying your linked sim identity |
Crew-chief voice generation runs locally on your device — no data leaves your machine for it. We do not sell your data, share it with advertisers, or use it for automated decisions that produce legal effects about you.
6. Data security
- In transit: TLS 1.2+ for all communications.
- At rest: AES-256-GCM for messages and sensitive values; passwords are securely hashed.
- Tokens: web sessions use
HttpOnly+Secure+SameSitecookies with CSRF protection; desktop/mobile use secure OS storage — page JavaScript can't read your session token. - Access: role-based access control; tenant isolation on every data path; separate admin authentication; rate limiting and brute-force lockout on sign-in.
- Payments: handled by Shopify (PCI DSS); card data never reaches our servers.
7. Your rights & choices
Depending on where you live (including under GDPR and California's CCPA/CPRA), you have rights to: access and export your data, correct it, delete it, object to or restrict certain processing, and to not have your data sold or shared (we don't sell or share it for advertising). You will not be discriminated against for exercising these rights.
| Right | How to exercise |
|---|---|
| Access / Export | In the app: your data export (a downloadable takeout of your cloud files), or email us |
| Correction | In-app profile settings, or email us |
| Deletion | In the app: Settings → Account → Delete Account (see §9), or email us |
| Object / Restrict | Email us |
We respond to verified requests within 30 days.
8. Data retention & deletion
We keep personal data only as long as needed for the purposes in this Policy or as required by law. See our data retention schedule for the detailed schedule.
- Active accounts: retained while your account is active.
- Account deletion: when you delete your account (or ask us to), we erase your personal data within 30 days, except where we are legally required to retain it (e.g., tax and transaction records, typically 7 years) or where data has been fully de-identified.
- Team-shared data: telemetry, setups, or results you contributed to a team may remain available to that team per the sharing model, dissociated from your identity where feasible.
- Backups: residual copies in encrypted backups are overwritten on the normal backup rotation.
Deletion is enforced by an automated erasure process, not just by policy.
9. Deleting your account
You can delete your account at any time from Settings → Account → Delete Account in the app. We will confirm by email, stop future subscription charges, and begin erasure. Deletion is permanent after any brief stated grace period; personal data is removed within 30 days as above.
10. Children's privacy
Sim Control is not intended for anyone under 16. We do not knowingly collect personal data from children. If we learn we have, we will delete it promptly.
11. International users
We operate from the United States and store data with US-based providers (§5). If you use the Services from outside the US, you consent to processing in the US, with appropriate safeguards for any cross-border transfer.
12. Changes to this Policy
We may update this Policy. For material changes we will notify you by email or in-app at least 30 days before they take effect, and update the "Last Updated" date above.
13. Contact
- Privacy requests: privacy@simcontrol.dev
- Security concerns: security@simcontrol.dev (see security@simcontrol.dev)
- Entity: Limit Break Technologies LLC, Texas, USA
This document is provided for transparency and is not legal advice. Limit Break Technologies LLC has it reviewed by counsel before launch.
Revision history
| Date | Version | Changes |
|---|---|---|
| 2026-08-05 | 2.0 | Full rewrite for Sim Control / Limit Break Technologies LLC: real data model, nutrition label, purpose limitation, 30-day deletion mechanism, updated sub-processors (AWS/Resend/Shopify/Sentry/Discord/iRacing), simcontrol.dev contacts |
| 2026-02-27 | 1.0 | Initial (inherited) version |