Privacy Policy

1. Who We Are

LMU BoP Tourism is a website that aggregates lap time data for Le Mans Ultimate and presents a Balance of Performance (BoP) comparison tool. This site is operated independently by sim racing enthusiasts and analysts, and is not affiliated with Studio 397, Le Mans Ultimate, or any official racing organisation.

For privacy-related enquiries, contact: [email protected]

2. Data We Collect

2.1 Server logs

Our web server records a standard access log entry for every request: your IP address, the page requested, HTTP status code, browser user agent, and timestamp. We use them for debugging and security, and we do not share them with third parties. Logs are kept for 30 days.

2.2 Consent preferences

Your cookie choices are stored in a first-party cookie named zaraz-consent, set by Cloudflare Zaraz. This cookie records which categories you accepted or declined. See Cloudflare's privacy policy for details of their own data processing.

2.3 Performance analytics (Cloudflare RUM)

This site uses Cloudflare Real User Measurements (RUM), a cookieless performance monitor. A beacon script (beacon.min.js) loaded from static.cloudflareinsights.com sends anonymous page load and resource timing to Cloudflare at cloudflareinsights.com. No cookies are set and no persistent identifier is stored on your device. Cloudflare may use your IP address to derive a country and to prevent abuse. See Cloudflare's privacy policy.

2.4 Analytics: Google Analytics 4 (with your consent)

If you consent to the Analytics category, page view and session data is forwarded to Google Analytics 4 through Cloudflare Zaraz's server-side proxy. A first-party session cookie named cfz_zaraz-analytics ties page views to a single visit. No personal profile is built from this data and it is not used for advertising. Analytics data is kept for the retention period set on our GA4 property, 14 months. Google's processing is governed by Google's Privacy Policy.

2.5 Discord Bot

LMU BoP Tourism operates a Discord bot that provides BoP data commands in Discord servers. When you use a bot command, the following data is stored in our database:

Discord User ID: your numeric Discord account identifier, stored on first command use, for rate limiting and abuse handling.
Discord Guild (Server) ID: the numeric identifier of the server in which the command was used. A server record is created when the bot is added to a server, and holds the alert channel if one is configured.
Server information: server name, member count and bot configuration settings, stored to run and maintain the bot's features. Aggregate server statistics are not used to identify individual users.
Alert channel ID: if a server administrator enables BoP-change alerts, the target channel's numeric ID is stored for that server.

The bot does not collect your Discord username, avatar, email address, or any message content. Command parameters (car class, track name) are written to our server logs alongside your User ID, under the 30-day retention described in section 2.1.

Your User ID is kept until you request deletion by contacting [email protected]. Discord's own Privacy Policy governs all data held by Discord itself.

2.6 Site account and Steam link

Site accounts are optional. If you sign in, we store:

Discord User ID, username and avatar image reference: received from Discord when you authorise the sign in, and refreshed on each later sign in so the page shows your current name. We ask Discord for the identify scope only, so we do not receive your email address or the list of servers you are in.
Steam ID: stored if you link Steam, after Steam confirms the account is yours through its OpenID sign in. It is the numeric account ID and nothing else, and we use it to find which recorded lap times are yours. Unlinking it on your profile deletes it.
Account timestamps: when the account was created, when you last signed in, when Steam was linked, and when you last loaded a page while signed in. That last one is rounded to the hour, so it tells us an account is still in use and nothing about where you went. We do not keep a record of which pages you visit.

Signing in sets one cookie, named session, described in the cookie policy. It is signed by our server, holds a reference to your account, and lasts 30 days from your last visit, so it stays valid while you keep reading. Signing out clears it.

Your profile page is visible to you alone. It is served uncached, carries noindex, and is excluded in robots.txt. No page on this site shows one driver's history to anyone else.

One thing about your account is public: your username on the leaderboards. Each class at each track has a top ten built from official race results. If one of your laps is in one, the board shows your Discord username beside the lap, the car and the setup type. Drivers with no account here appear under a label like "Driver 4f2a", derived from their Steam ID through a keyed hash. The leaderboards are excluded from search engines.

This runs on legitimate interest, GDPR Art. 6(1)(f), set out in section 4. The profile page carries a switch that turns it off and puts that same label in place of your name. The lap stays on the board.

Deleting the account. The profile page carries a delete control, which erases the account immediately: the Discord ID, username, avatar reference, Steam link and those timestamps. Lap times survive it, because they are recorded against a Steam account from official races and are covered by section 2.7, which carries a second control for erasing those as well. Discord bot records (section 2.5) are deleted on request to the address in section 1.

Coupon codes. If you redeem a code handed out by a streamer, we record your Discord ID, which code it was, when you used it and when the month it buys runs out. Redeeming needs a linked Steam account, and we store a one way scrambled form of that Steam ID beside the record, never the Steam ID itself. One code per driver is the whole point of that record, so it is the one thing here that outlives deleting the account: without it anyone could delete and sign back in for another free month, or sign up with a second Discord account for the same one. The scrambled form cannot be turned back into your Steam ID, which is why the record survives an erasure request without keeping you in it. It holds nothing else about you, and it is never sent to the analytics or advertising services described above.

Account data is kept until you delete it. We do not sell it, share it, or use it for advertising, and it is never sent to the analytics or advertising services described above.

2.7 Race results we record, including drivers who have no account here

Le Mans Ultimate publishes the results of its official multiplayer races. We read those results daily and keep a per-driver record, which the tier bands and the pace distributions are built from. This covers drivers who have never visited this site. For each driver in a race we store:

Steam ID: the numeric account ID that the results carry. It is how a driver's laps stay attached to the same driver across races. We do not read a Steam profile, a friends list, or a game library.
Lap times and race counts: best qualifying lap, best race lap and median race lap per car, track, setup type and race length, plus how many races are recorded on each.
Driver Rating: the rank, tier and progress the game assigned, frozen to the race that set that best qualifying lap.

Where this record is published. The tier bands, the pace distributions and the per-car figures are aggregates: counts and percentiles across thousands of drivers. The leaderboards are the only place we publish one driver on their own. Each class at each track has a top ten showing the lap, the car, the setup type and the patch the lap's Balance of Performance dates from, beside a driver label: a Discord username where that driver holds an account here and has not switched it off (section 2.6), otherwise a stable label like "Driver 4f2a" derived from the Steam ID through a keyed hash. The leaderboards are excluded from search engines.

One page names drivers without publishing them. After an endurance race run with teams, a driver who holds an account here and drove in it can see that race replayed on their own profile: their car broken into stints, beside the car it finished next to and the winner of its class, with each driver named as the game named them in that session. It is on a private page, visible only to somebody who was in that race, and it is never public and never indexed. It replays what everyone in the session already saw on the timing screen and in the results, which is why the drivers on it are named rather than labelled. Each account holds only their most recent such race, and the one before it is overwritten. An erasure request under section 5 takes a driver's name off it, including off the cards of the people they raced against.

Legal basis. Legitimate interest, GDPR Art. 6(1)(f): comparing Le Mans Ultimate performance takes a real sample of laps, and these come from public official races.

How long we keep it. Indefinitely, so pace can be compared over time, across a BoP change or a season.

Objecting, and having it removed. You can object to this processing under Art. 21 and ask us to erase your record under Art. 17. Sign in, link the Steam account so the request proves itself, and use "Erase my lap record" on the profile page. You can also write to the address in section 1, though we will still ask you to prove the account is yours, so that nobody can erase another driver's history.

What erasure does. The lap times themselves are not deleted. We replace your Steam ID on those rows with a random value, which is what makes the record stop being about you: the laps stay in the site's published figures, and nothing in them names a person. Deleting them instead would silently move the tier and percentile figures every visitor reads. We stop recording you from then on, and to do that we keep one thing, a one way digest of your Steam ID computed with a secret key, which lets us recognise races to skip without holding a readable copy of the ID itself. The account you signed in with is deleted at the same time, because keeping it would mean keeping the Steam ID we just erased.

It is permanent. The random value is never written down anywhere, so there is no key that could turn it back, and we cannot restore your history later even if you ask. Signing in and linking Steam again gives you a new empty account, not your old laps, and races you run after the request are not recorded.

2.8 Advertising: Google Ads (with your consent)

If you consent to the Advertising category, one Google advertising service becomes active:

Google Ads conversion tracking & remarketing: runs via Cloudflare Zaraz's server-side proxy. An audience pixel (ga-audiences) may fire to build remarketing audience lists. No additional browser cookies are set by this component.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to this site and/or other sites on the internet.

You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of a third-party vendor's use of cookies for personalised advertising by visiting aboutads.info. Within the EEA/UK, you can decline the Advertising category in our .

All Google advertising data is processed by Google under their Privacy Policy and Ads Policy. If you do not consent, neither service activates and no advertising data is sent.

3. Third-Party Services

This site uses the following services and resources. Where a third-party transfer happens, it is subject to that party's privacy policy:

Cloudflare Zaraz, our consent management platform and tag delivery gateway. Zaraz records your consent choices and implements Google Consent Mode v2. Third-party tools are only loaded after the relevant consent state allows them. Cloudflare privacy policy.
Local fonts and scripts, the main site serves its fonts, HTMX, and application JavaScript from this domain. These assets do not create third-party requests by themselves.
Cloudflare RUM (static.cloudflareinsights.com, cloudflareinsights.com), a cookieless performance monitoring beacon loaded on every page. Collects page load timing data; sets no cookies and stores no persistent device identifier. Cloudflare privacy policy.
Google advertising services, which may be enabled through Zaraz after advertising approval; serves personalised or non-personalised ads depending on your consent.
Steam (steamcommunity.com), used only if you link a Steam account to a site account. You sign in at Steam, Steam confirms the account to us, and we receive the numeric Steam ID and nothing else. Governed by the Valve Privacy Policy.
Discord (discord.com), our bot runs on the Discord platform. Discord processes all message routing and command interactions, and also provides the sign in described in section 2.6. We receive only the User ID and Guild ID needed to respond to a command, and the User ID, username and avatar reference when you sign in; all other interaction data is handled by Discord under their Privacy Policy and Terms of Service.

4. Legal Basis for Processing

Server logs: Legitimate interest (GDPR Art. 6(1)(f)), necessary for security and service operation.
Consent cookie (zaraz-consent): Legitimate interest (GDPR Art. 6(1)(f)), necessary to record and honour your consent choices.
Cloudflare RUM: Legitimate interest (GDPR Art. 6(1)(f)), cookieless and anonymous performance monitoring necessary to maintain site quality.
Cloudflare Zaraz: Legitimate interest for tag delivery and consent enforcement; consent where a configured tool requires it.
Analytics (GA4, cfz_zaraz-analytics cookie): Consent (GDPR Art. 6(1)(a)), only active when you accept the Analytics category.
Advertising (Google Ads): Consent (GDPR Art. 6(1)(a)), only active when you accept the Advertising category.
Discord Bot data (User ID, Guild ID): Legitimate interest (GDPR Art. 6(1)(f)), necessary to deliver the bot service, apply the command rate limit, and prevent abuse.
Site account (Discord identity, Steam ID, session cookie): Performance of a contract (GDPR Art. 6(1)(b)), necessary to provide the account you asked for and to show you your own lap times.
Race results (Steam ID, lap times, Driver Rating): Legitimate interest (GDPR Art. 6(1)(f)), necessary to measure the driver field the site's tier bands and pace comparisons are cut from. Set out in full in section 2.7, including how to object to it.
Showing an account holder's username on a public leaderboard: Legitimate interest (GDPR Art. 6(1)(f)). The interest is a leaderboard that names the drivers who set the laps. What is published is a username, a lap and a car, from races the game runs in public. It is a separate entry from the site account row above, which relies on performance of a contract and covers running the account only. You can object under Art. 21 with the switch on the profile page. See section 2.6.
Keeping a record that you redeemed a coupon code: Legitimate interest (GDPR Art. 6(1)(f)). The interest is a giveaway with a limit on it, which cannot be enforced without knowing who has already used a code. It is a separate entry from the site account row above because it is the one record that outlives deleting the account, for that reason alone. The Steam side of it is stored scrambled rather than readable, so what outlives the account is the ability to tell a repeat redemption from a first one, not your Steam ID. See section 2.6.

5. Your Rights

Under GDPR and applicable data protection laws you have the right to:

Access the personal data we hold about you
Rectification of inaccurate data
Erasure of your data ("right to be forgotten")
Restrict or object to processing
Withdraw consent at any time via the link in the footer
Lodge a complaint with your local supervisory authority

If you hold a site account, the profile page has a delete control that takes effect immediately (section 2.6). The lap record in section 2.7 is separate: erasing it is a separate and permanent request, and section 2.7 says what we need in order to be sure the request is yours.

To exercise any right, contact: [email protected]

6. Data Transfers

Third-party services (Cloudflare, Google advertising services when enabled, and Discord) may transfer data to servers outside the European Economic Area. These providers use transfer safeguards such as Standard Contractual Clauses and, where applicable, participation in the EU-US Data Privacy Framework.

7. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. The "last updated" date at the top of this page will change when we do so.