Privacy Policy

GridCast is operated by VibeWright Labs LLC, a Georgia limited liability company, which is the data controller for the personal data described here. This policy covers the gridcast.gg website, our APIs, our desktop applications (GridCast Launcher, GridCast Broadcaster and GridCast Lite), our broadcast overlays, and the Griddy chat bot on Twitch, YouTube and Discord.

It does not cover third-party services you reach through GridCast, such as iRacing, Twitch, YouTube, Discord or our payment processors. Those have their own privacy policies.

3.1 Account information

• Username, email address and a hashed password — we never store your password in readable form.
• Display name and, optionally, your first and last name.
• Your account role and status, and the date you accepted these terms.
• Email verification and password reset tokens, which expire after use.

3.2 Profile and driver information

All of this is optional, and all of it appears on your public profile if you provide it:

• Country, timezone, hometown, biography, and how long you have been sim racing.
• Racing name, car number and car number artwork.
• Favourite driver, car, movie, song and artist.
• Social handles for X/Twitter, Instagram, YouTube, TikTok, Twitch and Bluesky.
• Photographs you upload: headshots, personal photos, rig photos, and team or league artwork.

3.3 Content you create

Leagues, seasons, events, teams, rosters, results, overlay themes, sponsor artwork, channel settings, and messages you send to us for support.

3.4 Payment information

When you buy a plan, our payment processor collects your card or wallet details directly. We do not receive or store your full card number, CVC or bank credentials. We keep only what we need to run your account: which plan you have, its status and renewal date, the processor's transaction and customer identifiers, and the billing email or country the processor returns to us.

3.5 Chat and community data

If you use Griddy on Twitch, YouTube or Discord, we store your platform user ID and display name on that platform, your virtual Points balance, and your prediction and trivia activity. Where a server administrator has configured it, we also store which Discord server is linked to which GridCast channel and which announcement channels to post in.

4.1 Technical and log data

Our servers record IP address, browser and device type, pages and API endpoints requested, timestamps, referring page and error diagnostics. We use this to keep the Service running, to debug faults, and to detect abuse such as brute-force login attempts. We also record your last login time.

4.2 Broadcast and telemetry data

When you run our desktop software during a session, it reads live data from your sim — standings, lap and sector times, gaps, positions, flags, incidents, fuel, tyres and similar telemetry — and relays it to your overlays in real time. This is race data, not personal browsing data. Live telemetry is relayed for display and is not kept as a permanent recording; session results and standings are stored so leagues have a history.

4.3 No third-party tracking

We do not embed Google Analytics, advertising pixels, session recorders or any other third-party tracking or profiling tools, and we do not build advertising profiles or engage in cross-context behavioural advertising.

• iRacing. If you sign in with iRacing or link your iRacing account, we receive your iRacing customer ID and display name, and — where you have authorized it — race results, licence and rating information. We store the access and refresh tokens needed to keep that connection working.
• Race result imports. League administrators and our import tools bring in results containing driver names, iRacing customer IDs, finishing positions, lap times, incidents and points.
• Connected platforms. Twitch, YouTube and Discord provide the account identifiers and display names needed for Griddy to work in your channel or server.
• Payment processors. They tell us whether a payment succeeded, the plan purchased and the subscription's status.

We use only what the Service needs to function. We do not use advertising or tracking cookies.

You can clear or block cookies in your browser, but signing in will not work without the session cookie and tokens.

• To provide the Service — create your account, render overlays, run leagues, publish results and standings, and operate Griddy.
• To communicate with you — verification and password reset emails, notifications you have enabled, billing and service announcements. Marketing email is sent only if you opted in, and every marketing email has an unsubscribe link.
• To take payment and manage subscriptions, invoices and refunds.
• To support you when you contact us.
• To keep the Service safe — rate limiting, abuse detection, moderation and investigating breaches of our Terms.
• To improve the Service — understanding which features are used and diagnosing faults, using aggregate and log data.
• To meet legal obligations such as tax and accounting requirements.

We do not use your personal data to train machine-learning models, and we do not sell it.

If you are in the EEA or the UK, we rely on the following legal bases under the GDPR:

• Performance of a contract — running your account, delivering the features you signed up for, and taking payment.
• Legitimate interests — keeping the Service secure and working, preventing abuse and fraud, and improving what we build. We balance these against your rights.
• Consent — marketing email, optional AI portrait generation, and any optional integration you choose to connect. You can withdraw consent at any time.
• Legal obligation — retaining financial records and responding to lawful requests.

We share personal data only with the service providers we need to operate, and only as far as each one requires. We do not sell personal data and we do not share it for advertising.

We may also disclose data:

• To league and channel administrators, who can see the roster, entry and results data for their own league or channel.
• When required by law, or to respond to a valid legal request, or to protect the rights, safety and property of our users, the public or us.
• In a merger, acquisition or sale of assets, in which case we will tell you before your data becomes subject to a different privacy policy.

GridCast is a public broadcast platform, so some information is visible to anyone, including people without an account and search engines:

• Your display name, username and public profile page, including any bio, photo, country, hometown, social handles and favourites you filled in.
• Your race results, standings, statistics and league and team memberships.
• Channel, league and team pages, and their sponsor artwork.
• Overlay themes you publish to the marketplace.
• Your Points balance and ranking on public leaderboards, under your platform display name.

Your email address, password, payment details, IP address and access tokens are never shown publicly. Only fill in the optional profile fields you are happy for the world to see.

When a league imports race results, GridCast may create a placeholder driver record for a competitor who has never signed up, so that results and standings are complete. These records contain race-related information only — typically a driver name, iRacing customer ID and results — and are created on the instruction of the league administrator who imported the data.

If a placeholder record represents you, you may claim it and take control of it, or ask us to remove it by emailing support@gridcast.gg. We will honour removal requests even where the underlying race result remains part of a league's historical record.

• Account and profile data — while your account is open, and for up to 30 days after you ask us to delete it, so the deletion can be reversed if it was a mistake.
• Race results and standings — kept as part of a league's historical record even after an individual account closes, though we will disassociate them from your personal profile on request.
• Billing records — kept as long as tax and accounting law requires, typically seven years.
• Server and security logs — normally weeks to months, longer if needed to investigate an incident.
• Live telemetry — relayed for display, not retained as a recording.
• Points and chat records — while the connected platform account remains linked.
• Backups — deleted data may persist in encrypted backups for a short period before being overwritten on the normal cycle.

We use HTTPS everywhere, hash passwords with a strong one-way algorithm, sign session cookies and access tokens, rate-limit authentication endpoints, restrict administrative access, and keep secrets out of the application code. Overlay links carry an access key so live broadcast data is not exposed by a guessable URL.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and any required regulator as the law requires. Please report any vulnerability you find to support@gridcast.gg — we would much rather hear from you than not.

Wherever you live, you can ask us to:

• Access the personal data we hold about you, and receive a copy.
• Correct anything inaccurate — most profile fields you can edit yourself.
• Delete your account and personal data, subject to the retention rules above.
• Export your data in a portable, machine-readable format.
• Object to or restrict processing based on our legitimate interests.
• Withdraw consent at any time, including for marketing email.

Email support@gridcast.gg from the address on your account and we will respond within 30 days. We may need to verify your identity first. We will not discriminate against you for exercising these rights.

You can also unsubscribe from marketing email using the link in any such message, disconnect a linked platform from its settings page, remove Griddy from your channel or server at any time, and decline optional features such as AI portraits.

If you are in the European Economic Area or the United Kingdom, you have the rights set out in Section 14 under the GDPR and UK GDPR, and you also have the right to lodge a complaint with your local supervisory authority — the Information Commissioner's Office in the UK. We would appreciate the chance to resolve your concern first.

We do not carry out automated decision-making that produces legal or similarly significant effects on you.

Under the California Consumer Privacy Act as amended by the CPRA, California residents have the right to know what personal information we collect and how we use and disclose it, to request deletion and correction, to receive a portable copy, and not to be discriminated against for exercising those rights. Exercise them at support@gridcast.gg.

We have not sold or shared personal information in the preceding twelve months, as those terms are defined by the CCPA, and we do not sell or share the personal information of consumers we know to be under 16. Because we do not sell or share personal information, we do not act on opt-out preference signals for that purpose. We do not use or disclose sensitive personal information for purposes requiring a right to limit.

GridCast is operated from the United States and our servers are located there. If you use the Service from outside the United States, your data is transferred to and processed in the United States, which may have different data protection laws than your country. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

GridCast is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has given us personal data, email support@gridcast.gg and we will delete it promptly. Where local law sets a higher age of digital consent (16 in parts of the EEA and the UK), we apply that age instead.

We will update this policy as GridCast changes. When we make material changes we will update the “Last updated” date above and give notice in the Service or by email before they take effect. Continuing to use GridCast after that means you accept the updated policy.

Connecting a YouTube channel to GridCast is optional. If you choose to connect one, GridCast uses YouTube API Services, and this section is the disclosure Google and YouTube require of every application that does.

20.1 What we ask for

Google shows you a consent screen naming GridCast Telemetry Systems — the full name of the application you know as GridCast — and the access it is asking for before anything happens. We request one scope, youtube.force-ssl, and we use it only for the YouTube channel you selected:

• Creating, updating and deleting the scheduled live broadcasts for races on your GridCast calendar, and setting their thumbnails.
• Reading those broadcasts’ status and stream ingest state during a show, and ending the stream when the show finishes.
• Updating the description of a finished broadcast’s video with results, chapter timestamps and sponsor credits.
• Reading whether your channel is live, which is what places a channel on air on GridCast TV.
• Reading your playlists and their videos, when you ask GridCast TV to import a playlist as programming.

We do not upload video, do not post to your channel outside the broadcasts you scheduled through GridCast, do not modify videos GridCast did not create, and do not read any YouTube account other than the one you connected.

20.2 What we store

We store the OAuth access and refresh tokens Google issues, encrypted at rest; the connected channel’s YouTube channel ID, title and avatar, so we can show you which account is connected; and the video IDs, titles, thumbnails, durations and scheduled times of the broadcasts and playlist items you asked GridCast to manage. We do not sell this data, do not use it for advertising, and do not use it to train machine-learning models.

20.3 Revoking access

You can disconnect YouTube at any time in your GridCast channel settings, which revokes the token with Google and deletes it here. You can also revoke GridCast’s access directly at https://myaccount.google.com/permissions. Revoking stops all future access immediately; broadcasts GridCast already created on your channel remain yours and are unaffected.

20.4 GridCast TV viewers

You do not need a Google account, or any account, to watch GridCast TV (tv.gridcast.gg). The television plays partner channels’ broadcasts through the official YouTube embedded player, which is served by YouTube itself: when a video plays, YouTube receives the same information it would if you watched on youtube.com, as described in the Google Privacy Policy. The programme listings, video titles, durations and thumbnails shown on the guide are retrieved via YouTube API Services and refreshed on an ongoing basis; GridCast stores no YouTube data about you as a viewer.

20.5 The policies that govern this

GridCast’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google’s own handling of your data is described in the Google Privacy Policy.

For any privacy question, or to exercise any of the rights above, contact us. We read everything sent here.