1. Who is responsible for your information?
PADDOCK.GURU is an independent Formula 1 fan website operated by Owen Weston. For the purposes of applicable data protection law, the operator is the data controller for personal information processed through PADDOCK.GURU.
We handle personal information in accordance with applicable UK data protection law, including the UK GDPR, the Data Protection Act 2018 as amended, the Data (Use and Access) Act 2025 and relevant provisions of the Privacy and Electronic Communications Regulations 2003 (PECR).
For privacy questions, requests or concerns, contact privacy@paddock.guru. This is the website's published privacy contact method. No postal or residential address is published here.
PADDOCK.GURU is not currently presenting itself as a company or separate incorporated legal entity. References to “we”, “us” or “our” in this policy mean the PADDOCK.GURU service and its operator.
2. Information we collect and use
Information you provide when using an account
- Account email address and username.
- Optional first and last name, if you choose to add them.
- Your Supabase account identifier and account authentication/session information.
- Profile preferences, including favourite driver, favourite team, supporter badge settings and notification preferences.
Passwords are handled by Supabase Authentication. PADDOCK.GURU does not need to receive or store your password in its own website database. Do not send passwords to the privacy email address.
Discord linking
If you choose to link Discord, the website uses Discord's OAuth authorisation flow and requests the identify permission. We receive and store the Discord account identifier, username, global display name and avatar information returned by Discord. Linking is optional and is not required to browse the public website.
Where Discord linking and server role synchronisation are enabled, your PADDOCK.GURU profile identifier, Discord user identifier and relevant preference information (such as your selected driver or team) may be sent to the PADDOCK.GURU Discord bot/service so it can associate your website profile with your Discord account and synchronise configured server roles. The bot may also process information needed to operate reaction roles and server announcements. Discord itself processes your account and activity under its own terms and privacy policy.
Browser push notifications
If you opt in to browser notifications, your browser creates a push subscription. We store the subscription endpoint and its cryptographic keys, associate it with your account and use it to send the alerts you request. We also store your notification choices, such as selected session types and reminder intervals. Your browser or its push service provider is involved in delivering notifications and may process device or delivery information under its own terms.
Technical and usage information
Our hosting platform and other service providers may generate technical records needed to deliver, secure and troubleshoot the website, such as IP address, request time, browser or device information, error details and server logs. The precise log fields and retention periods depend on the provider and its configuration. We do not currently use an advertising profile or sell personal information.
Public Formula 1 information
Race calendars, session information, results and related motorsport data are retrieved from OpenF1. This is generally information about events and competitors, rather than information about your personal use of the website. Requests to the data provider and its own technical logs are subject to OpenF1's terms and privacy information.
3. Why we use your information and our lawful bases
Under the UK GDPR, we must have a lawful basis for each purpose. Depending on the feature, we rely on:
- Contract / steps at your request: to create and operate your account, authenticate you, save your profile and preferences, provide requested notifications, and carry out Discord linking or disconnection that you initiate.
- Legitimate interests: to operate, maintain and secure the website; prevent misuse; troubleshoot faults; maintain service records; and administer the optional community integration. We consider your rights and expectations when relying on this basis.
- Consent: where consent is required, including permission requested by your browser for push notifications and any non-essential cookies or similar device storage that may be introduced in future. You can withdraw consent at any time, without affecting processing already carried out lawfully.
- Legal obligation: where we must retain or disclose information to comply with applicable law or a lawful request.
We do not use account preferences to make decisions that produce legal or similarly significant effects about you. We do not intentionally collect special-category personal data.
5. International transfers
Some service providers or their subprocessors may process information outside the United Kingdom. The exact locations depend on the provider's infrastructure, account configuration and support operations. Where a restricted transfer of UK personal data takes place, the controller must ensure an appropriate UK GDPR transfer mechanism and safeguards are in place, such as UK adequacy regulations or an approved contractual safeguard with any required risk assessment.
We will make relevant transfer information and safeguards available on request where required. Provider locations and subprocessors can change; consult the providers' current privacy and data-processing documentation for their latest details.
6. How long we keep information
We keep personal information only for as long as reasonably necessary for the purposes described in this policy, taking account of legal, security and operational needs. Current retention criteria are:
- Account and profile information: while your account remains active, unless information is corrected or removed earlier. If you delete your account, we request deletion of the associated Supabase authentication account; related profile data is subject to the database's configured deletion behaviour and any lawful retention requirement.
- Discord link information: while the link remains active. You can disconnect Discord from your account. Copies already held by Discord or the bot/service may need to be removed separately where applicable.
- Push subscriptions: while subscribed and associated with your account, or until you unsubscribe, remove the subscription or delete your account. Expired subscriptions may be removed when delivery fails.
- Technical logs, backups and security records: for the period required by the relevant provider's operational, security and backup processes. These periods are not all controlled directly by PADDOCK.GURU.
There is not currently a single fixed deletion timetable for every category of technical log or provider backup. We will review retention settings as the service develops. Information may remain in encrypted or disaster-recovery backups for a limited period after deletion before those backups are rotated.
7. Your data protection rights
Depending on the circumstances and the lawful basis, you may have the right to:
- be informed about how your information is used;
- request access to your personal information;
- request correction of inaccurate or incomplete information;
- request erasure;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive certain information in a portable format; and
- withdraw consent where processing is based on consent.
These rights are not absolute and some apply only in particular circumstances. To make a request, email privacy@paddock.guru and explain what you need. We may need to verify your identity before responding. We normally respond within one month, subject to lawful extensions for complex or multiple requests.
You can also make a data protection complaint directly to PADDOCK.GURU by emailing privacy@paddock.guru. Please make clear that you are raising a data protection complaint and include enough detail for us to understand the issue. We will acknowledge receipt within 30 days, make appropriate enquiries without undue delay, keep you informed about progress where appropriate and tell you the outcome without undue delay.
If you remain unhappy, you can complain to the UK's Information Commission (which took over the former Information Commissioner's Office functions on 30 September 2026): Make a complaint to the Information Commission. You do not have to contact us first, although the Commission may ask whether you have raised the issue with us.
9. Security
We use technical and organisational measures intended to protect personal information, including authenticated access to account features, server-side handling of sensitive integration credentials, HTTPS where configured, and access controls for administrative functions. No internet transmission or storage system can be guaranteed completely secure. Please use a unique password and contact us promptly if you believe your account has been compromised.
10. Children
PADDOCK.GURU is a general-audience motorsport information service and is not designed to collect children's personal information deliberately. If you believe a child has provided personal information in a way that should not have happened, contact us at privacy@paddock.guru so we can review it.
11. Changes to this policy
We may update this policy when the website, its providers or applicable law changes. The “Last updated” date at the top shows when it was most recently revised. Where a change materially affects how we use existing personal information, we will take reasonable steps to bring it to users' attention before the new processing begins where required.
12. Contact
For any privacy or data protection question, email privacy@paddock.guru.