Privacy Policy
Last updated: July 2026
Overview
ApexKit is built to be privacy-first: the tools do their work in your browser, and we collect as little as possible. You can use the core tools without an account and without giving us any personal data. We do run a small backend for the shared track catalog and for optional accounts, and this policy explains exactly what that involves.
Data Storage
ApexKit's tools run in your browser. What you create or open stays on your device:
- Lines: the racing lines, tracks, and settings you create are saved locally in your browser using IndexedDB. If you sign in (see Accounts below), the track setups you choose to save are also synced to and stored on our servers so you can reach them from other devices.
- Reel: the video footage and telemetry files you open are decoded and rendered entirely in your browser. They are never uploaded, and the exported video is generated on your device and saved directly to it.
For content that stays on your device — your Reel footage and exports, and your Lines data while you are signed out — this data:
- Never leaves your device
- Is not transmitted to our servers
- Is not accessible to us or any third party
- Can be deleted by clearing your browser data (or, for an exported video, by deleting the downloaded file)
Some tools work with location data that you provide — for example, the GPS telemetry you load into Reel. This is read and processed locally in your browser and is never transmitted to or stored by us.
Accounts (Optional)
You can use ApexKit's core tools without an account. If you choose to create one — so you can save and sync your Lines setups across devices — you sign in with Google or Apple.
When you sign in, we receive from that provider and store your email address, a unique account identifier, and your name if the provider supplies it. We use this only to create and secure your account, sign you in, and sync the setups you save. We never receive your Google or Apple password. Signing in is also governed by the provider's own privacy policy (see Third-Party Services).
We keep you signed in using authentication cookies or tokens that are strictly necessary to provide the service. We do not collect payment information — there are no paid features today — and we do not track you across other sites.
You can delete your account at any time by contacting us; this removes your synced setups and account record from our servers.
Data We Process on Our Servers
Beyond optional accounts, our backend handles a small amount of data:
- Track requests: if you ask us to add a track to the catalog — or open an uncatalogued venue from a map search — we store the track's name and location, any note you add, and, only if you choose to provide it, an email address so we can tell you when the track goes live. An email is never required.
- Rate limiting & security: when your browser contacts our API (to load the track catalog or submit a request), we briefly process your IP address to prevent abuse. We do not use it to build a profile of you.
Data Retention
We keep data only as long as we need it:
- Account data & synced setups: kept for as long as your account is active. When you delete your account, we remove them within 30 days.
- Track requests: kept while the request is relevant to the catalog; any email you provided is deleted once the track goes live or on your request.
- IP addresses: processed transiently for rate limiting and not retained as part of a stored profile.
- Browser data: stays on your device until you delete it or clear your browser storage.
Analytics
ApexKit uses Cloudflare Web Analytics, a privacy-first, cookieless service that measures aggregate traffic (such as page views) to help us improve the site. It does not use cookies, does not fingerprint visitors, does not collect personally identifiable information, and does not track you across other sites.
We also record aggregate, cookieless counts of a few in-app actions — such as opening a track, drawing a line, or exporting a video — so we can tell whether our tools are actually being used. These counts are anonymous totals only: no cookies, no identifiers, and nothing that can be traced back to you or linked across sites.
Third-Party Services
ApexKit uses the following third-party services:
- Sign-in (Google & Apple): If you create an account, authentication is handled by Google or Apple. When you sign in, the provider shares your email address, a unique identifier, and your name (if available) with us. See Google's Privacy Policy and Apple's Privacy Policy.
- Hosting & database (Cloudflare): Our website and API run on Cloudflare, which stores the track catalog, track requests, and account data on our behalf. See Cloudflare's Privacy Policy.
- Map tiles (Lines): Satellite imagery is loaded from Esri when using the Lines editor. Your IP address may be visible to this service when loading map tiles. See Esri's Privacy Policy.
- Reel: Video and telemetry are decoded and rendered entirely in your browser. Reel makes no third-party requests with your footage or data.
Fonts are self-hosted and do not involve any third-party requests.
Cookies
ApexKit does not set any cookies for tracking or advertising. If you sign in, we use authentication cookies or tokens to keep you logged in. Our hosting provider (Cloudflare) may set essential security cookies (such as __cf_bm) to protect against bots and abuse. These are all strictly necessary to provide the service and do not require consent under GDPR.
Your Rights (GDPR)
You have rights over any personal data we hold. How to exercise them depends on where the data lives:
- Data in your browser: your Lines data and Reel files are already on your device. Export them with the built-in export features, or clear your browser's local storage to delete them.
- Account data: you can request access to, correction of, or a copy of your account data and synced setups by contacting us. Deleting your account removes your synced setups and account record from our servers.
- Track requests: if you gave us an email with a track request, you can ask us to remove it at any time.
- Withdraw consent / object: where we rely on your consent for optional processing, you can withdraw it at any time.
The lawful basis for account data is performance of the service you have signed up for; for the optional track-request email it is your consent.
Children's Privacy
ApexKit does not knowingly collect personal data from children under 16, and you must be at least 16 to create an account. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to This Policy
We may update this policy to reflect changes in our practices or for legal reasons. Significant changes will be noted on this page with an updated revision date.