Privacy Policy

1. Introduction

This Privacy Policy explains how WEAREXALT Inc, a Delaware corporation (“WEAREXALT”, “we”, “us”, or “our”), collects, uses, shares, and protects information about you when you use GridScout (“GridScout” or the “Service”). WEAREXALT is the controller responsible for your personal data.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

2. Scope

This Privacy Policy applies to all parts of GridScout, including:

• The GridScout Discord bot, used within Discord servers and in direct messages.
• The GridScout website (for example, gridscout.app), including documentation and informational pages.
• The GridScout live web application (for example, the live timing and “Crowd Engineer” predictions experience), whether accessed in a browser or as a Discord Activity (embedded app).

GridScout is built on top of, and accessed through, the Discord platform. Your use of Discord is also governed by Discord’s own Terms of Service and Privacy Policy, which we do not control.

3. Information We Collect

3.1 Information from your Discord account (bot). When you interact with the GridScout bot, Discord provides us with, and we process, the following: your Discord user ID, your username and display name, the server (“guild”) ID, name, and approximate member count where applicable, the channel ID, your language/locale setting, and metadata about the interaction (such as the command used and the time of use). The GridScout bot operates with minimal Discord permissions and a restricted set of gateway intents; it cannot read the content of your messages or access your direct messages, member lists, or presence.

3.2 Information when you sign in (website & Discord Activity). If you sign in to the live web application or launch it as a Discord Activity, we use Discord’s OAuth flow. With your authorisation (the “identify” and “email” scopes), Discord provides us with, and we store, your Discord user ID, username, and email address, and we may receive additional profile fields returned by Discord (such as your avatar and global display name). To keep you signed in, we store your Discord access token inside a secure, HTTP-only cookie on your device (see Section 4); we do not store this access token in our databases.

3.3 Predictions (“Crowd Engineer”). When you participate in predictions, we store the choices you submit, the time of each vote, and the points you accumulate, linked to your Discord user ID, so that we can record your participation, prevent duplicate voting, and maintain scores.

3.4 Preferences. We store the settings you choose, such as your preferred motorsport series, time zone, measurement units (speed and temperature), live-timing stream delay, and sound preferences, linked to your Discord user ID.

3.5 Command inputs and search queries. When you use a command or search (for example, the name of a driver, team, or circuit), we process that input to return results, and the search text may be sent to our search provider. We do not link these search terms to your identity or retain them as part of a profile about you.

3.6 Server configuration data. If you are a server administrator and configure GridScout’s features (such as race reminders, live-event broadcasts, news, or document notifications), we store configuration tied to your server, including selected channel and role identifiers, notification preferences, and—where you enable webhook-based delivery—the Discord webhook identifiers and tokens that allow GridScout to post to your chosen channels. These webhook tokens are credentials; please treat the decision to enable them accordingly.

3.7 Analytics and technical data. We use PostHog (see Section 7) to understand how the Service is used and to detect and fix errors. This may include events such as which commands or pages are used, device and browser information, approximate usage patterns, timing/performance data, and error reports, associated with your Discord user ID and username where you are identified. On the live web application, PostHog also provides session replay, which records interactions such as pages viewed, clicks, and navigation; text you type into form fields is masked and is not captured. On the GridScout website (our marketing and documentation pages), we use Google Analytics rather than PostHog to measure usage; it collects information such as pages viewed, interactions, approximate location derived from your IP address (which Google does not retain in full), and device or browser information, subject to the cookie consent described in Section 4.

3.8 Log and security data. Our servers may generate operational logs (such as timestamps and error messages) that can transiently include identifiers like a username or server ID for debugging. We also process your IP address transiently to apply rate limits and protect the Service against abuse; we do not store IP addresses in our databases.

We do not request or knowingly collect payment information or special categories of personal data (such as health, biometric, or political data).

4. Cookies and Local Storage

We use a small number of cookies and similar technologies on the live web application and the GridScout website.

Essential cookies: discord_auth (HTTP-only) keeps you signed in by storing your Discord access token and basic profile, and expires after a short period (up to seven days); oauth_state (HTTP-only) is a short-lived security token used to protect the sign-in process.

Analytics cookies (live application): PostHog sets first-party cookies (served via our own domain) to measure usage and enable session replay as described in Section 3.7.

Analytics cookies (website): On the GridScout website we use Google Analytics, which sets first-party cookies to measure usage. Where consent is required (for example in the EU, EEA, and UK) these cookies are set only after you accept them via our cookie banner, and you may decline; in other regions they are enabled by default. You can change or withdraw your choice at any time using the “Cookie settings” link in the website footer.

Local storage: We may store non-personal items in your browser’s local storage, such as developer/debug toggles or a mini-game high score. These do not identify you.

You can control cookies through your browser settings; disabling essential cookies may prevent you from signing in or using certain features.

5. How We Use Your Information

Provide the Service: to operate the bot, website, live application, and Discord Activity; respond to your commands; sign you in; deliver notifications you or your server have requested; and record your predictions and scores.

Personalise: to remember your preferences and settings.

Improve and analyse: to understand usage, diagnose problems, monitor errors, and improve the Service.

Security and integrity: to apply rate limits, prevent abuse, fraud, and duplicate voting, and protect the Service and its users.

Legal: to comply with applicable law and respond to lawful requests.

6. Legal Bases for Processing (UK/EU)

If you are in the United Kingdom or the European Economic Area, we rely on the following legal bases under the UK GDPR and EU GDPR:

• Performance of a contract: to provide the features you request, such as signing in, saving settings, and recording predictions.
• Legitimate interests: to secure, maintain, analyse, and improve the Service, provided these interests are not overridden by your rights. You may object to this processing (see Section 10).
• Consent: where required, for example for certain analytics and session-replay cookies and for your authorisation to share your Discord email with us. You may withdraw consent at any time.
• Legal obligation: where we must process data to comply with the law.

7. How We Share Your Information

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share information only as described below.

Service providers and sub-processors: we use trusted third parties to operate the Service. Those that may process personal data on our behalf include:

• Discord — the platform through which the Service is provided, including sign-in and message/webhook delivery.
• PostHog (United States) — product analytics, error monitoring, and session replay for the bot and live application.
• Google (United States) — Google Analytics for usage measurement on the GridScout website.
• Database and infrastructure hosting (for example, our managed PostgreSQL provider and our caching provider) — to store and serve your account, settings, and prediction data.

Data and infrastructure that do not receive your personal data: services such as our search index, object storage for race documents, and motorsport data providers process public motorsport information only and do not receive your personal data.

Legal and safety: we may disclose information if required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of WEAREXALT, our users, or the public.

Business transfers: if WEAREXALT is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy.

8. International Data Transfers

WEAREXALT is based in the United States, and certain of our service providers (including PostHog) process data in the United States. If you access the Service from the United Kingdom, the European Economic Area, or elsewhere, your information may be transferred to and processed in countries that may have different data-protection laws than your own. Where required, we rely on appropriate safeguards for such transfers, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the EU-US Data Privacy Framework (under which Google is certified).

9. Data Retention

We retain personal data for as long as necessary to provide the Service and for the purposes described in this Privacy Policy. In general, we keep your account information, settings, and prediction history while you continue to use GridScout. Server configuration data is retained while the relevant feature remains enabled. Analytics data is retained according to our analytics provider’s retention settings. We will delete or anonymise personal data when it is no longer needed, or upon a valid deletion request, unless we are required to retain it to comply with a legal obligation or to establish, exercise, or defend legal claims.

10. Your Privacy Rights

10.1 UK and EU (GDPR). Subject to applicable law, you have the right to: access the personal data we hold about you; request rectification of inaccurate data; request erasure (“the right to be forgotten”); restrict or object to processing; request data portability; and withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data-protection supervisory authority (in the UK, the Information Commissioner’s Office).

10.2 California (CCPA/CPRA). If you are a California resident, you have the right to: know what personal information we collect, use, and disclose; access a copy of that information; request deletion; request correction; and not be discriminated against for exercising your rights. We do not sell or “share” (as those terms are defined under California law) your personal information, and we do not use sensitive personal information for purposes that would require an opt-out. You may exercise these rights as described below, and you may use an authorised agent where permitted by law.

10.3 How to exercise your rights. To make a request, contact us at the email address in Section 14. We will verify your request, typically by confirming your Discord identity, and respond within the timeframe required by applicable law. You may also reduce or stop our processing at any time by signing out of the web application, removing the bot from your server, or discontinuing use of the Service.

11. Data Security

We implement reasonable administrative, technical, and organisational measures designed to protect your information, including transmission over encrypted (HTTPS/TLS) connections, access controls, and a secrets-management system for credentials. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Children’s Privacy

The Service is not directed to, and we do not knowingly collect personal data from, children under the age of 13 (or the higher minimum age required by Discord or by law in your country). If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

13. Third-Party Services and Links

The Service relies on and may link to third-party services (such as Discord and motorsport data sources). This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review their policies separately.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

WEAREXALT Inc (Delaware, United States)
Email: max@wearexalt.com

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide notice on our website or Discord server. Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.