Privacy Policy

Who operates the site

The High Groove is an online racing community operated by Cory Mott in South Carolina, United States. Cory Mott is responsible for the personal information handled by this website. This policy covers the public site, driver dashboard, administration tools and our website-connected Discord bot.

Contact privacy@mail.thehighgroove.com with privacy questions or requests; you do not need an account or Discord membership. Registration availability is shown on the signup page and can differ by region.

Information we handle

Support tickets contain your required contact email, optional Discord contact, questions, replies and submitted evidence. Authorized staff keep private investigation notes separately from customer conversations and formal updates. Ticket email links grant access to that ticket only. For a verified Discord connection, private ticket-channel Chat can synchronize with website Chat; private staff notes remain on the website.

Account information includes your email address, iRacing name and customer ID, date of birth, country and state or province, password hash, account status, verification history and recorded acknowledgements. Passwords are stored as hashes. Date of birth is restricted to Owner access and supports age checks, required authorization and changes in eligibility as members get older.

When you connect Discord, we receive your Discord user ID, display name, avatar and information needed to check league-server membership and synchronize website-managed roles. We also set your league-server nickname to the iRacing name on your account, where Discord permissions allow; other server members can see that name. We store protected authorization credentials where needed to maintain that connection.

Racing records include entries, car numbers and artwork, eligibility information, results, points, standings, reviews and corrections. Information comes from you, connected Discord services, league staff and imported iRacing race records. Imported results can identify drivers who do not have website accounts. Optional profile information can include a biography, location and avatar.

Authorized staff may record whole-field iRacing session evidence through the Windows companion. This includes driver identities, lap timing and order, lap progress, pit-lane and race-status observations, weather/track context and capture health diagnostics. We exclude local-driver-only pedals, fuel and tyre-wear telemetry. Private source evidence supports race review and analytics; public analytics require staff approval and current identity-visibility controls. Official results and scoring remain separate.

Team profiles, current rosters and counted racing contributions can be public. We retain effective team membership and role history to attribute sporting results correctly. Team invitations, seasonal activation and separate team-entry fees are managed through the website; Discord roles and private voice access follow the active team membership.

We also handle support and privacy correspondence, moderation and account-recovery evidence, notification records, security logs and information about entry fees and their payment status. We do not collect card numbers on this website. Stripe collects payment details directly through its hosted checkout. We receive payment status, amounts and transaction references to manage racing access, refunds and disputes; we do not store payment-card details.

Our server processes connection information, including IP addresses, to operate and protect the site. We use necessary browser cookies for sign-in and security; see the cookie disclosure for details.

Your appearance choice (Light, Dark or System) is an individual display preference. Signed-in choices are stored with your account until changed or account deletion; guest choices are stored locally in a functional cookie for up to one year.

Why we use information

We use information to operate accounts and racing activities you request, determine eligibility, communicate service and competition updates, maintain accurate results, administer fees, respond to requests and protect the community from fraud or misuse.

Some eligibility and access checks are automatic, using account status, age, Discord membership and configured competition requirements. Contact the league team if you believe a check used incorrect information or needs review; privacy requests can be made directly through our privacy contact.

Where EU data protection law applies, the basis depends on the purpose: performing a valid agreement for necessary requested services; legitimate interests in appropriate security, moderation and sporting administration, balanced against your rights; complying with a legal obligation; or consent where required. Optional consent is separate from acknowledging this policy and accepting racing rules. We will not treat a privacy-policy acknowledgement as permission for unrelated uses.

We do not use this site for targeted advertising or sell member information. No optional analytics, marketing-email program or advertising trackers are currently enabled. A new optional use will require an updated assessment and any legally required choice before it starts.

Public racing information

Published race results and standings may identify eligible drivers, their participation and performance. Public profiles and rosters have a separate publication control. Optional pictures, biographies and locations are private by default, with a separate publication choice for adults. Young and unregistered drivers are shown without a public identity unless a specific publication review authorizes it. Importing a result does not authorize a public profile.

You can request correction, removal or restriction of information that identifies you. We verify the request and assess applicable exceptions. Approved erasure removes account identity and replaces the public racing identity with Former driver while preserving scores. The process also addresses historical snapshots, links, source files and personal artwork. It is handled by the Owner rather than an instant self-service deletion button.

Other people may have copied previously public results. We will explain any limits affecting a request and take any further steps required by applicable law.

Who receives information

Authorized staff receive information appropriate to their responsibilities. Our providers include Hostinger for hosting and backups, Backblaze B2 for encrypted off-server backups and a separate private telemetry archive, Resend for email, Discord for connected identity, membership and messages, and Google for notifications to the operator about privacy correspondence. Privacy notifications contain a message reference rather than the incoming body or attachments.

UptimeRobot monitors service availability. GitHub supports software delivery and Linear supports development planning; these are not intended as repositories for member profiles or privacy correspondence. Password screening sends a short hash prefix to Have I Been Pwned, not your password, email or full password hash.

External services, including Discord, iRacing and Stripe, also handle information under their own policies. Stripe may act on our instructions for payment services and for its own purposes, including fraud prevention and legal compliance. We may disclose information where required by law or necessary for a legally justified investigation or protection of rights. We do not grant all staff access to all member information.

Storage, security and international processing

The main server is in Boston, United States. Email and other providers may process information outside your home country, including in the United States. Where applicable law requires safeguards for an international transfer, the relevant arrangement must be established; US hosting alone does not provide those safeguards.

We use access restrictions, encrypted connections, protected credentials and encrypted off-server backup files. No service can guarantee absolute security. A security incident is assessed for containment, recovery and any notification required by applicable law.

How long information is kept

Our cleanup schedule removes expired sign-in and recovery records after 30 days, clears delivered or terminal account-email content after 30 days, and removes its delivery metadata after 90 days. Pending messages and documented holds are excluded. Competition-message content and destination details follow those limits; minimal acceptance evidence can remain with the sporting record.

Relevant whole-field telemetry and statistical history have no automatic age-based expiry. Access remains restricted and privacy requests, corrections, erasure and documented holds still apply. Each capture has a separate encryption key so erasure can make affected archived source evidence unreadable, including older object versions. Removed identity must remain suppressed after recovery. Companion sign-in requests expire within five minutes and are removed within one day; PC authorization expires with its original website session, no later than seven days. The companion can remove local capture files seven days after the website verifies the complete archive and source-session matching; incomplete, conflicted or unverified captures stay local.

Recruiting listings are opt-in. Expressing interest opens a private Discord discussion with the driver and current team management; Discord administrators and people with Manage Threads can also access it. We do not copy discussion transcripts to the website. Closed threads and ordinary listing/discussion metadata are deleted after 30 days unless a documented hold applies. A restricted digest prevents recreating a closed discussion pair during its season and is removed 30 days after season completion.

Dashboard notices about required actions remain available. Optional email and Discord copies start enabled and can be changed independently in Profile settings. Verification, password-reset and essential security messages remain available. Changing delivery preferences does not change an appeal deadline or complete a required action.

Dashboard notifications, including archived notifications, are removed after 90 days from creation unless a documented hold applies. Reading or archiving does not restart that period, remove underlying sporting or business records, or complete a required action.

Unused artwork is eligible for removal after 30 days when no retained record references it. Closed privacy-case details are removed after 24 months unless a documented hold applies. Security and moderation evidence is reviewed after 12 months; necessary restrictions or disputes may justify specific continued retention. Bounded cleanup batches can take additional runs to clear a backlog.

We assess deletion requests individually and document any information that must be retained, the reason and the applicable period or review date. Historical sporting results may be preserved after removing identifying information where appropriate. Necessary retained payment or security evidence remains restricted.

Payment records enter retention review three years after the end of the calendar year of the latest financial activity. This is a review date, not an automatic deletion deadline. We consider actual tax filing dates, refunds, disputes and other applicable obligations, document continued retention with a further review within one year, and securely dispose of records no longer needed. Payment-review reasons are removed 24 months after disposal; minimal decision and recovery records prevent deleted information from returning from backups.

Support case history is kept for ongoing assistance and future troubleshooting without an automatic age-based purge. We review the continuing need for personal information at least annually and preserve applicable privacy requests, corrections, redaction, erasure and documented holds. Discord ticket channels are removed after final closure, withdrawal or duplicate handling; website history follows its separate review policy. Ticket access proofs and notification or email records use the shorter schedules described above.

Encrypted B2 backup snapshots have a 13-calendar-month maximum age enforced during successful backup runs. Hosting-provider backups have their own lifecycle. Backups may temporarily contain removed information and are not used for ordinary publication. We maintain a restricted erasure ledger and replay it before a restored system can resume service. Minimal suppression identifiers remain while needed to prevent erased identities from reappearing; these are restricted identifiers, not a claim of complete anonymity.

Your choices and requests

Depending on applicable law, you may have rights to access or obtain a copy of your information, correct it, request erasure or restriction, object to certain uses, withdraw consent, or receive portable data. These rights can have conditions and exceptions. Withdrawing consent does not invalidate processing that was lawful before withdrawal.

Send your request to privacy@mail.thehighgroove.com and tell us what you need. Include enough information to locate the relevant account or race record. Do not send passwords, recovery codes, payment-card details or identity documents unless a specific, justified verification process is agreed. We may ask for proportionate evidence that the information is yours before disclosing or changing it.

We will apply the response period required by the law governing your request and explain any permitted extension or refusal. You may contact the relevant privacy regulator, including your EU supervisory authority, the Office of the Privacy Commissioner of Canada or the applicable provincial authority. Contacting us first does not remove that right.

Young members

The minimum age is 13. A parent or guardian must contact us before a Quebec resident under 14 connects Discord or submits a full registration. We verify the adult's authority and authorization before issuing a registration code. Other legally required authorization is assessed for the relevant purpose, including paid participation. We do not impose a separate blanket guardian-approval rule for all teenagers. Having an iRacing or Discord account does not provide authorization for this website.

If you believe we have collected information from a child who is not eligible, or you are a guardian with a question about your child's information, contact privacy@mail.thehighgroove.com.

Changes to this policy

We will update this page and its effective date when our practices change. Material changes will receive an appropriate notice. Where a new purpose requires consent, updating this policy alone will not provide it.