Privacy Notice
Last updated: 2026-03-09
1. Controller
The data controller is Lorenzo Rubino.
For privacy requests, rights requests, or questions: lorenzo@motorsportsoftware.com
2. Scope of this notice
This notice describes the personal data processing carried out through TimeTool, an app for schedule and event-time management, including:
- Sign-in with Apple or Google
- Subscription to shared streams
- Creation and sync of private events
- Optional PDF import with AI-assisted extraction
- Push notifications and Live Activities
3. Categories of personal data processed
Account and authentication data
- Username stored in the display name field
- Email address, when provided by the sign-in provider
- Phone number, when present in the provider identity
- Technical account and provider identifiers
- Role, tier, and account status
Core app data
- Subscribed streams
- Shared schedule events
- Private events
- Groups, memberships, and operational metadata required for sync
PDF upload and extraction data
- Uploaded PDF content
- File metadata and extraction-run metadata
- Candidate events derived from model output
- Review and publish/save decisions
- AI usage metadata, including model, token counts, and cost for some admin flows
Device and runtime data
- APNs device token
- Live Activity token
- Local cache, sync state, and local preferences stored on the device
4. Purposes and legal bases
| Purpose | Examples of data | Legal basis |
|---|---|---|
| Account creation, sign-in, and profile management | Username, email, phone if available, account/provider identifiers | Performance of a contract or pre-contractual measures |
| Delivery of the app's main features | Streams, shared events, private events, sync flows | Performance of a contract |
| Push notifications and Live Activity updates | APNs token, Live Activity token, stream/event identifiers | Performance of a contract and technical/operational legitimate interest |
| Security, access control, abuse prevention, and service reliability | Internal identifiers, account state, strictly necessary technical logs | Legitimate interest |
| Optional PDF extraction requested by the user | PDF content, model output, run metadata | Performance of a user-requested service |
| Future tax/accounting obligations if billing is enabled | Transaction and accounting data | Legal obligation |
5. How AI PDF extraction works
The PDF import feature is optional. If a user chooses to use it:
- The PDF is uploaded from the device
- The file is stored temporarily in service infrastructure to allow processing
- The content is sent to third-party AI providers to extract events and schedule data
- The results are reviewed by the user or an admin before saving or publishing
TimeTool does not technically block every non-schedule PDF. If a user uploads documents containing unnecessary personal data, that data may be transmitted to AI providers. Manual event entry remains available as an alternative.
Users should upload timetable or schedule PDFs only and avoid documents containing contact lists, travel details, rooming lists, logistics packs, or other unnecessary personal data.
6. Whether providing data is mandatory
Providing the data needed for account creation, sign-in, event sync, and stream management is necessary to use the related service features.
Using PDF extraction with AI is optional. If a user does not want to use that feature, events can be entered manually.
7. Recipients of personal data
Personal data may be processed by providers that support the technical operation of the service. The main recipients or providers involved are:
- Cloudflare — APIs, queues, workflows, and temporary PDF storage
- Supabase — authentication and the application database
- OpenAI — primary AI inference provider for PDF extraction
- Anthropic — alternate AI inference provider
- Apple — Sign in with Apple, push notifications, Live Activities, and future StoreKit billing
- Google — Google sign-in
8. International transfers
Some processing may involve transfers of personal data outside the European Economic Area. In particular, cloud infrastructure and related subprocessors may operate across multiple regions, and the AI providers used for PDF extraction may involve processing or storage outside the EEA.
9. Retention periods
| Category | Retention rule |
|---|---|
| Account and profile data | For the lifetime of the account; deleted on account deletion except for minimal technical or legal needs |
| Published shared events | Deleted about 24 hours after the event ends |
| Private cloud events | Kept until the user deletes them or deletes the account |
| Local cache and preferences | Kept until local removal, app uninstall, or data clearing |
| PDFs stored temporarily | Deleted after success, failure, or cancellation |
| APNs tokens | Until logout or later invalidation |
| Live Activity tokens | Until the activity ends or is replaced |
10. Processing methods
Processing is carried out using electronic systems and organizational measures consistent with the purposes described above, with reasonable technical and organizational safeguards intended to reduce the risk of unauthorized access, loss, or misuse.
11. Data subject rights
Subject to the limits set by the GDPR, data subjects may request:
- Access to personal data
- Rectification of inaccurate data
- Erasure
- Restriction of processing
- Objection where applicable
- Portability where applicable
Requests may be sent to lorenzo@motorsportsoftware.com.
If you believe the processing violates applicable law, you may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
12. Account deletion
TimeTool includes an in-app account deletion flow. Account deletion removes application account data according to the logic currently implemented, subject to what remains necessary to prevent fraudulent technical recreation of a deleted identity, comply with legal obligations, and retain strictly necessary data until the corresponding technical retention work is complete.
13. Changes to this notice
This notice may be updated if the service, vendors, retention rules, or legal requirements change. The version published on this website is the official version that applies at the time of consultation.