Privacy Policy

HCW Live is a live-timing service for hillclimb motorsport, part of the HCW / Hillclimb World platform. The data controller is BRIGHT, obrt za informatičke usluge, vl. Marino Poropat (OIB: 41528912664), Rovinj, Croatia.

For any privacy questions or to exercise your rights, contact us at marino.poropat.90@gmail.com.

Account (optional). If you create an account, we process your email address, name and password (stored only as a bcrypt hash — never in readable form) and your role. Purpose: to let you sign in and use account-related features. Lawful basis: performance of a contract (Art. 6(1)(b) GDPR). An account is not required to view results.

Push notifications (optional, with consent). If you enable notifications, we store your push subscription (push endpoint and keys, plus a device name), the drivers and events you follow, and your notification history and preferences. Notifications work without an account — in that case your browser is assigned a random device identifier stored locally (hcw-live-client-id). Purpose: to send the alerts you asked for. Lawful basis: consent (Art. 6(1)(a)). You can withdraw consent at any time by disabling notifications or unfollowing.

Error monitoring. We use Sentry to report technical errors so we can keep the service stable. Session replay is turned off, and IP addresses and personal data are scrubbed from reports. Lawful basis: legitimate interest (Art. 6(1)(f)).

Athletes' data in results. In start lists, timing and results we display competitor data: name, nationality, club and, where applicable, a photo or short bio. This data comes from event organisers and sporting federations. Lawful basis: legitimate interest (Art. 6(1)(f)).

Aggregate viewership stats. We keep aggregate live-viewership numbers (e.g. the peak number of simultaneous viewers and an approximate count of devices per day) to understand load. These are computed with a non-reversible probabilistic sketch and store no identifiers. Purpose: capacity and reliability. Lawful basis: legitimate interest (Art. 6(1)(f)).

Product analytics (optional, with consent). If you accept analytics in our consent banner, we use PostHog (EU cloud, eu.i.posthog.com — data stays in the EU, reverse-proxied through our own /ingest path) for product analytics: page views and specific events. PostHog stores an anonymous device/session identifier in a cookie scoped to .hillclimbworld.com, so the same person is recognised across this site and the main Hillclimb World site. If you are signed in, we also attach your HCW account id, email, role and subscription tier so we can understand usage by account. Session recording and autocapture are turned off. We also use Microsoft Clarity for session replay and heatmaps; Clarity records masked interactions (text and inputs are masked by default) and click/scroll maps, and sets its own cookies. Analytics is off by default and only runs after you opt in. Purpose: understanding and improving the service. Lawful basis: consent (Art. 6(1)(a)). You can withdraw consent at any time via the consent banner.

What we do NOT do. We show no advertising and do not sell your data. The „Near Me" feature uses your location entirely within your browser — we never send or store it.

We do not sell your data. To run the service we rely on the following providers, who process data on our behalf:

Railway — hosting of the application and databases (PostgreSQL, Redis). Region: EU.

Sentry — technical error reporting (minimal, without IP/personal data).

PostHog — product analytics (EU cloud; data stays in the EU). Only after you opt in to analytics.

Microsoft (Clarity) — session replay and heatmaps. Only after you opt in to analytics.

Browser push services (Google, Apple, Mozilla) — delivery of the push notifications you requested.

Some of these recipients may process data outside the EU/EEA (e.g. in the US), in particular the browser push services and Microsoft Clarity. Where that happens, the transfer relies on appropriate safeguards under the GDPR (such as Standard Contractual Clauses). PostHog is hosted in the EU.

We keep account data for as long as the account is active; you can delete your account at any time, after which the related data is erased within 30 days. Push subscriptions are removed as soon as they become invalid. Error reports are kept for 90 days. Analytics data is retained by PostHog and Microsoft Clarity according to their default retention periods (Clarity retains data for up to one year). Athletes' data in results is kept as a permanent sporting record.

Under the GDPR you have the right to: access, rectification, erasure, restriction, objection, and data portability. Where processing is based on consent (push notifications), you can withdraw it at any time, without affecting prior processing.

How to exercise your rights: you can delete your account yourself in your profile, and turn off notifications in settings. For access, correction or export, email marino.poropat.90@gmail.com.

You also have the right to lodge a complaint with a supervisory authority — in Croatia this is the Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

We publish competitors' names, nationality, club and, where applicable, photos and bios as part of public sporting results, on the basis of legitimate interest and data provided by organisers and federations. If you are a competitor and wish to object, contact us at marino.poropat.90@gmail.com.

The service is not directed at children under 16 and we do not knowingly collect their data. Data of underage competitors that appears in results comes from organisers and federations.

We may update this policy from time to time. We will post material changes on this page and update the date at the top.

BRIGHT, obrt za informatičke usluge, vl. Marino Poropat (OIB: 41528912664) — marino.poropat.90@gmail.com — live.hillclimbworld.com

HCW Live uses essential and functional cookies and local storage needed for the site to work and to remember your preferences. With your consent, we also use analytics cookies (PostHog and Microsoft Clarity). We show no advertising cookies. Essential and functional cookies do not require consent. Analytics cookies are off by default — we set them only after you opt in via our consent banner, and you can change or withdraw your choice there at any time.

Essential cookies: __Secure-authjs.session-token — keeps you signed in (lasts 24 hours). Functional cookies: hcw-live-locale — remembers your chosen language; UI-state cookies. Functional local storage: hcw-live-client-id — a random device identifier for push notifications without an account; plus your preferences (favorites, theme, language, panel width); and your saved consent choice.

Analytics cookies (only after you opt in). PostHog: a cookie named ph_phc_…_posthog scoped to .hillclimbworld.com holding an anonymous device/session identifier (distinct_id), shared with the main Hillclimb World site (persists up to 12 months). Microsoft Clarity: _clck — a persistent identifier for session replay and heatmaps (up to 12 months); _clsk — a per-session identifier (expires when the session ends).

You can change or withdraw your analytics consent at any time via the consent banner. You can also clear all this data via your browser settings (clearing cookies and site data for live.hillclimbworld.com). Note that after clearing you may be signed out and your preferences will reset to defaults.