Privacy Policy

Introduction

Kerbside (kerbside.racing) is a Formula 1 statistics site. We do not require an account or ask for your name, email address, or other directly identifying information. We use a small amount of browser storage and, if you consent, a randomly generated identifier for basic quiz analytics. This page explains what that identifier is, what else we store, and the choices and rights you have over all of it.

What we don’t do

We don’t run Google Analytics, ad networks, or any third-party tracking pixel — there is no advertising on Kerbside and nothing to fund with it. We don’t use third-party cookies. The identifier described below is stored in your browser’s localStorage rather than a cookie, but EU/UK law treats the two the same way for consent purposes, so we do too.

What we store, and where

• Quiz streak and stats (day/win streak, win rate, average guesses, solved count, and guess distribution), Fact Check streak and stats (day/win streak, days played, and correct-answer count — its own, separate browser storage from the quiz streak), race display preferences (Celsius/Fahrenheit and my time/track time), and your cookie choice — stored in your browser’s localStorage, and mirrored into a small first-party cookie holding the same accepted/rejected value, so the page can render the banner correctly on your very first load without it flashing. Unlike the other items in this list, that cookie value (just the word “accepted” or “rejected” — no identifier) is automatically included on every request the same way any cookie is, and our server reads it to decide whether to render the banner; we do not log, store, or otherwise retain it server-side beyond that. Your quiz/Fact Check streak and stats and race display preferences are never sent to our server on our own initiative. The one exception is sharing: if you choose “View streak image” in the Stats panel, your current and best streak are put in the image URL so we can draw the picture, which means those two numbers appear in our server request logs (see “Data retention” below). Nothing else about your stats leaves your device, and no share request carries the analytics identifier described next.
• Analytics identifier (requires your consent) — a randomly generated id, stored in your browser and also sent to our server each time you play the daily quiz, practice mode, or the Fact Check, so we can measure participation, return-visit rates, and how much play crosses over between the two games. The same identifier is reused across the quiz and the Fact Check for that cross-play measurement. Until you accept the cookie banner, it is never created, stored, or sent — rejecting has the same effect as not answering.
• Aggregate quiz activity and campaign attribution — when you open the quiz hub, choose or play a game, complete it, or use a result-sharing control, we increment anonymous counters. Campaign parameters in the link (such as source, medium, campaign, content, term, and platform) or the referring site are stored only as cleaned aggregate buckets. Share counters distinguish copy, native sharing, and X so we can compare the controls. These rows contain no analytics identifier, IP address, user-agent, or raw page URL and cannot be traced back to an individual visitor. Small per-day flags containing only the date and event name are kept in your browser so a reload or retry does not count the same play event twice. With consent, the first known campaign/referrer may also be retained locally as a fallback for later direct quiz plays.
• Feedback you send us — via the feedback page, or when you tell us why you’re turning notifications off. We store your message, the page URL it was sent from, an optional email address if you choose to give one, and a coarse identifier made by hashing your IP address and browser user-agent together (not reversible to the original IP), used only to rate-limit abuse. This is sent as soon as you submit, regardless of your cookie choice, because it’s the specific action you asked us to take.

A randomly generated identifier that we receive and can associate with repeat visits is best described as pseudonymous data, not anonymous data — under GDPR, online identifiers like this can still count as personal data even without a name attached. We treat it that way: it’s covered by the consent and rights described below, and it is never combined with anything that could identify you by name.

How we use the analytics identifier

Each play records a per-device, per-day flag (started / completed / help opened) against the identifier, which we use to compute participation and retention curves — e.g. roughly how many people who played yesterday come back today. It is never used to build an individual profile beyond that, and never shared with or sold to a third party.

Separately, the aggregate counters let us compare the two games, understand how campaign landings proceed into a game, measure completion and sharing, and see which result-sharing controls lead people back to Kerbside. Explicit campaign parameters on the current visit take precedence over an older locally retained source, so a new campaign is not credited to a previous one.

Data retention

The identifier itself rotates automatically every calendar year, but rotation is not the same as deletion: the daily flag rows recorded against an identifier are not automatically deleted, since deleting them would defeat the point of measuring return visits over time. We do not currently have a fixed deletion schedule for these rows. They contain no name, email, or other directly identifying field — only a device id, a date, and three booleans.

Aggregate participation, campaign, hub-funnel, and share-channel counters are also not automatically deleted. They contain only a date, cleaned attribution bucket, game/action category, and totals; they contain no per-device identifier.

Our hosting and network providers (Google Cloud and Cloudflare) also generate standard technical logs for every request — e.g. IP address, user agent, requested URL, and timestamp — for operational and security purposes, under their own retention settings. We do not separately collect or query this data for analytics.

Legal basis

We rely on your consent to store and send the analytics identifier. You can withdraw that consent at any time via “Cookie preferences” in the footer — doing so stops any new identifier from being created or sent, though it does not retroactively delete rows already recorded (see “Your rights” below for how to request that).

Your quiz streak/stats, your Fact Check streak/stats, your race display preferences, and your cookie choice are stored on the basis that they’re necessary to provide the specific feature you’re using — showing your streak and stats back to you, preserving the units and time display you selected, and remembering a choice you already made so we don’t ask again on every page.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, or erase data associated with your analytics identifier, restrict or object to its use, withdraw consent, and complain to a supervisory authority — in Sweden, Integritetsskyddsmyndigheten (IMY), though you are not limited to that authority if you’re elsewhere. Because we don’t know who you are, we’d generally need the identifier stored in your own browser to locate any associated rows — reach out via the feedback page and, if you still have it, include the value of the cookie-consent-v1/analytics keys from your browser’s local storage.

Your choices

Accept or reject the analytics identifier from the cookie banner on first visit, or change your mind anytime with “Cookie preferences” in the footer of any page. You can also block or delete browser-side data at any time using your browser’s own settings — clearing your site data for kerbside.racing removes your quiz streak and stats, your Fact Check streak and stats, your race display preferences, your cookie choice, and the locally stored identifier, though not rows already recorded on our server (see “Data retention” above). The Stats panel in the quiz also has its own “Reset stats” option, scoped to win rate/average guesses/solved count/distribution only — it does not touch your day or win streak.

Operator and processors

Kerbside is operated as a hobby project; the fastest way to reach us about this policy is the feedback page. The only third parties that process data on our behalf are our infrastructure providers: Google Cloud (hosting, database, and server logs) and Cloudflare (DNS, CDN, and DDoS protection). We don’t use a separate analytics, email, or error-monitoring vendor.

Children’s privacy

Kerbside is intended for a general audience. We do not knowingly request names, contact details, or other directly identifying information from children.

Changes to this policy

If this policy changes, we’ll update it on this page and update the “Last updated” date above.