Effective October 10, 2026
Who this covers
This policy explains what Derby Dashboard (derbydashboard.app) collects and what we do with it. It covers three kinds of people:
- Organizers and helpers: the adults who sign in to run a race (owners, race managers, judges and check-in volunteers).
- Racers: the children whose names, cars and photos are entered into an event.
- Families and spectators: people who open a race link or sign-up link, without an account.
Questions or requests go to support@derbydashboard.app.
Children's information
Derby Dashboard is a tool for adults. Children don't create accounts or sign in. A racer's details get into the app in one of two ways: an organizer types them in, or a parent or guardian fills in the online sign-up form for their child.
We store only what's needed to run the race: the racer's name, group (den, club or age group), car name and number, race results, and a photo if one is added. We don't ask for a child's birthday, address, school or contact details.
The pack or club running the race decides what's entered and who sees it. We ask organizers to get a parent's permission before adding a child's photo. The sign-up form asks parents separately whether a photo may be shown on screens. Without that permission, the photo is used only by the race managers to match the car at check-in, and it is never shown on a big screen or the family page.
If you're a parent and want your child's information removed, ask your pack or club, or email us and we'll help.
What we collect
| Your account | Email address, your name if you add it, and a scrambled (hashed) version of your password if you set one. We never store the password itself. We also note when the account was created and last used. |
|---|---|
| Your pack or club | Its name, and optionally its type, city and state. Who belongs to it and in which role. Its plan and paid-through date. |
| Events | Everything you put into an event: racers, groups, car names, photos, check-in, heats, results, awards, slides and messages. On the Free plan this stays in your browser. On Pack and Pack Plus it is also saved to our servers so other devices and helpers can open it. |
| Online sign-ups | What a parent sends through a sign-up link: racer name, group, car name, an optional note and an optional photo, plus whether the photo may be shown. To stop spam we keep a scrambled (hashed) version of the sender's internet address, not the address itself. |
| Finish photos | With Pack Plus and a camera at the finish line, one still image per heat. |
| Invitations | The email address and role of each person invited to help, and who invited them. |
| Security records | Short-lived sign-in codes and links, and a record of failed sign-in attempts (tied to an email address or internet address) so we can block password guessing. Failed attempts are cleared after about a day. If we change an account, pack or event from our admin area, that change is logged. |
| Technical logs | Our hosting provider records basic request information (such as internet address, browser type and the page requested) to keep the service running and secure. |
We don't collect payment card numbers. Paid plans are set up by email for now.
How we use it
- To run the service: sign you in, save and sync your events, show the big screens and the family page, and send sign-in codes and invitations.
- To keep it safe: stop spam and password guessing, and investigate problems.
- To help you when you ask: support, restoring something deleted by mistake, or changing your plan.
- To tell you about your account or important changes to the service.
We don't sell personal information, share it for advertising, or use racers' names or photos to market Derby Dashboard.
Who can see what
- Your pack or club: people with access to a pack can see its events, according to their role.
- Anyone with the race link or code: when an organizer turns on parent phones, the race link shows the heats, results and standings, including racers' names, groups and car names. Racer photos and finish photos appear there only if the organizer turns them on, and never for photos sent without permission. The link isn't listed anywhere public, but anyone it's shared with can open it.
- Anyone with the sign-up link or code: sees the event's name, date, place and details, and the form. They can't see other sign-ups or the roster.
- The big screens: show what the organizer chooses to show, in the room where the race is held.
- Us: we look at account or event data only when needed to run, support or secure the service.
Service providers
We use a small number of companies to run Derby Dashboard. They handle data only to provide their service to us.
- Cloudflare hosts the website and database, and provides the robot check (Turnstile) on sign-in and sign-up forms.
- Resend delivers our emails (sign-in codes and invitations).
We may share information if the law requires it, to protect people's safety, or as part of a sale or transfer of Derby Dashboard, in which case this policy would still apply to the information.
Cookies and storage on your device
We use one cookie, which keeps you signed in. There are no advertising or tracking cookies, and no analytics scripts. The app also saves your events and settings in your browser's own storage so racing keeps working without the internet. Clearing your browser's site data removes that copy.
How long we keep it
- Account and pack information: until you delete it.
- Events, photos, sign-ups and finish photos saved to our servers: until the event or pack is deleted. Deleted events and packs can be restored for 30 days, then are removed for good.
- Sign-in codes expire in 15 minutes, sign-in links in 20 minutes, and invitation links in 7 days.
- Backups kept by our hosting provider may hold deleted data for a short time longer.
Your choices
- See and change: your name, email and password are in Settings. Event data can be changed in the app by anyone with the right role.
- Download: any event can be saved as a backup file from the app.
- Delete: delete an event, a pack, or your whole account from Settings. If you're the only owner of a pack, hand it to someone else or delete it first.
- Ask us: email support@derbydashboard.app to get a copy of your information, correct it or delete it. We'll answer within 30 days.
Security
Connections are encrypted. Passwords are stored only as hashes, sign-in codes and links work once and expire quickly, and repeated failed sign-ins are blocked. No system is perfectly secure, but if we learn of a breach that affects your information, we'll tell you.
Where data is stored
Derby Dashboard is run from the United States. Our providers may process data in other countries, under their own safeguards.
Changes to this policy
If we change this policy, we'll update the date at the top. For important changes, we'll tell account owners by email or in the app before they take effect.
See also our Terms of Service.