Privacy Policy

PitConnex is built and operated by PT Kodeunikberkahdigital (Niqcode). For any question about this policy or your data, see Contact below.

PitConnex requires an account. Sessions you record are kept on your device and, once you are signed in, synced to our server as described below. Signing up collects:

• Your email address and a display name.
• Your password — we never store it in plain text. It is hashed with bcrypt before it reaches our database, so nobody at PT Kodeunikberkahdigital (Niqcode), including us, can read it back.
• A server-generated account id.

After you sign in, the app stores your session tokens in your device’s secure credential store — the iOS/macOS Keychain or the Android Keystore — never in plain preference files. On the web pit wall (PitConnex’s website at /pit), the short-lived access token is held only in the page’s memory and the refresh token in that browser tab’s session storage, which the browser clears when the tab is closed.

If you forget your password, you can ask for a reset code. We then send an email to your account’s address containing a 6-digit code. We store only a hash of the code; it expires after 15 minutes, works once, and stops working after 5 wrong tries. Resetting your password signs you out on every other device.

Only after you sign in, your recorded sessions, saved tracks, and GPS trails are uploaded to and stored on our server (api.pitconnex.com) so they follow you across devices. This includes precise location data — the GPS points that make up your session trail. All traffic to our server is encrypted (HTTPS).

A team has one owner, who invites other people as a driver or as pit crew with a single-use invite code (valid for 7 days). Everyone in a team can see the other members’ display names. The owner and pit crew can see each driver’s live position and lap times, and can read the sessions a driver has synced (the session data and lap times — not the GPS trails). You can leave a team at any time, and the owner can remove a member; a removed member stops receiving team data within seconds.

While a driver is driving live for a team, the app sends their current position, speed, lap number and pit status about once a second, plus each completed lap time. The owner and pit crew of that team see this live. We keep only the latest position of each driver, in the server’s memory — not a location history — and it is gone when the driver stops, the event ends, or the server restarts. Lap times are stored with the team’s live event.

The pit crew can send short announcements (such as “BOX BOX”) to one driver or to every driver. We store each announcement’s text, colour, sender, recipient and when it was delivered and seen, as part of that live event. A live event ends when the pit crew ends it, or automatically after 12 hours.

Teams can talk by voice during a live event. While a driver is driving live, the driver’s microphone is open and can be heard by the team’s owner and pit crew. The pit crew talks to drivers with push-to-talk: their microphone is only live while the talk button is held, and only the chosen driver (or every driver) can hear it.

Voice is not recorded: we never store it and we never ask our voice provider to record it. It is relayed in real time through LiveKit (LiveKit Cloud), a third-party service that processes the audio stream and the participants’ account id, display name and team role so it can deliver the audio to the right people. The audio is encrypted in transit.

Track and session maps are drawn using map tiles fetched live from OpenStreetMap (tile.openstreetmap.org). Whenever a map is shown, OpenStreetMap’s servers receive your device’s IP address and the map area being viewed, the same way any map tile provider works. We do not send them your account details, your GPS trail, or any other data beyond what a normal map request requires. The web pit wall fetches the same map tiles in the browser of whoever is viewing it.

Pit voice is relayed through LiveKit, as described under Pit voice. Password-reset codes are delivered by email through our mail provider, which receives your email address and the message containing the code.

PitConnex does not contain advertising, analytics, or crash-reporting software of any kind. We do not sell or share your data with advertisers.

You can delete your account at any time, in either of two ways:

• In the app: Settings → your account card → HAPUS AKUN (Delete account).
• Without the app, on this website: pitconnex.com/delete-account. Sign in with your email and password, confirm, and the account is deleted immediately.

Either way, this permanently deletes your account and every session, track, and GPS trail synced to our server, the teams you own (with their live events, lap times and announcements), your team memberships, and the lap times and announcements tied to you. This cannot be undone.

The account and this data are removed from our live database immediately. Any remaining copies in our database backups are purged within 30 days (1 month) as the backups rotate.

If you cannot sign in, email [email protected] from the address on the account and ask us to delete it.

Deleting your account does not touch data already saved on your phone — sessions and tracks recorded there remain until you uninstall the app or clear its local storage.

We keep synced sessions and tracks for as long as your account exists, or until you delete them individually. A driver’s live position is held only in memory and is never written to a history. Lap times and announcements from team live events are kept with the team until the team owner’s account is deleted. Password-reset codes expire after 15 minutes. Voice is not stored at all. If you delete your account, all of the data described under Deleting your data is deleted from our live database immediately; copies in database backups are purged within 30 days.

Data in transit between the app and our server is encrypted with HTTPS. Passwords are never stored in plain text — only a bcrypt hash. Session tokens live in your device’s OS-level secure storage, not in ordinary app files. Team invite codes and password-reset codes are stored only as hashes. Live timing, announcements and voice are only available to signed-in members of the team.

PitConnex is not directed at children and we do not knowingly collect data from anyone under the age required by Indonesian law to consent to data processing on their own behalf. If you believe a child has created an account, contact us and we will delete it.

Under Indonesia’s Personal Data Protection Law (UU No. 27/2022), you have the right to access the personal data we hold about you, request that we correct it, request that we delete it, and withdraw any consent you previously gave. You can exercise most of this yourself in Settings, and delete your account from the app or at /delete-account; for anything else, use the contact below.

If we make a material change to this policy, we will update the effective date above and, where required, notify you in the app.

Questions about this policy or a request about your data can be sent to [email protected].