Last updated: 07.10.2026. This policy describes how personal data is processed in the PARC FERMÉ app and on the associated website. PARC FERMÉ is an unofficial fan app and is not affiliated with the FIA, Formula 1 or the teams.
We do not sell data. There is no advertising, no ad network, no analytics tool and no user tracking — neither in the app nor on the website. Data only flows to the technical service providers that make operation possible (section 5), and only as far as the respective feature requires.
Lucas Nentwig – PARC FERMÉ, c/o Autorenglück #36245, Albert-Einstein-Str. 47, 02977 Hoyerswerda, Germany. E-mail: parcferme.app@gmail.com. No data protection officer has been appointed; the statutory conditions for this are not met.
Account data: sign-in with a Google account, through which we receive in particular your e-mail address and name from Google; plus display name and optional profile details (bio, profile picture, favourite driver and team, notification settings). We also store when and in which version you agreed to the General Terms, the Terms of Use and this policy, so that your agreement can be demonstrated.
Content you create: messages in the public chat, watch-along and in leagues or rooms, private messages, comments, incident ratings (“True Standings”), predictions, poll votes, feedback, reports and your follow/follower relationships.
Game results: in “Start Lights” the measured reaction time of each attempt and its timestamp; in the “Grill the Fan” quiz the answers given and the score achieved; in “Race Word”, for each day, the guesses entered and whether the word was solved, as well as your streak (current and best) and the number of days played and solved. This data is required to build leaderboards and to detect manipulation.
Profile picture: if you upload an image, it is cropped on your device and stored in our hosting provider’s file storage. It is visible to other users.
Technical data: every connection involves technically necessary data, in particular IP address and timestamps, processed by our hosting provider. We also use timestamps for rate limits that prevent spam and automated access.
Push identifier: if you enable notifications, a device-specific push identifier (FCM token) is generated and stored. If you disable notifications or sign out, the identifier is removed; identifiers reported as invalid by Google are deleted automatically.
On your device only: the chosen language, your favourite team’s colour for the display, a cached copy of your profile details and notification settings, the key details of the most recently displayed race, a cached copy of these legal texts, headlines and inbox entries you have read, and the acknowledgement of the privacy notice are held in your device’s local storage (section 8). These entries themselves never reach us; the profile details and settings are additionally held in your account because they are meant to apply across devices.
Account and app features — standings, prediction game, leagues, chat, games, profiles — to perform the contract, Art. 6(1)(b) GDPR.
Translation of content into your chosen language — as a feature you use or in our legitimate interest in a cross-language community, Art. 6(1)(b)/(f) GDPR. The text to be translated is transmitted to the translation service (section 5). Translations are cached so the same text does not have to be transmitted repeatedly.
Security, moderation and abuse prevention — reports, blocks, rate limits, detection of manipulated game results — legitimate interest, Art. 6(1)(f) GDPR, and to meet our obligations as a service provider.
Notifications — based on your consent, Art. 6(1)(a) GDPR, revocable at any time in the settings.
Headlines: for this section we retrieve public RSS feeds from other outlets at regular intervals. This happens on our server, regardless of whether you are using the app — your IP address is not transmitted to those outlets. Only when you tap a headline and open the outlet’s page does a direct connection to them arise; from that moment their privacy policy applies.
Visible: display name, profile picture, optional profile details, your public posts, your leaderboard positions and your follow relationships. Not visible: your e-mail address, your push identifier, your settings and the content of private messages. For votes, the overall result is shown, not who voted how.
No data is shared with third parties for advertising or analytics purposes. Only the following providers are involved:
Hosting, accounts and database – Supabase. Sign-in, database, file storage and realtime features run via Supabase; data is held on servers in the EU (Frankfurt). A data processing agreement under Art. 28 GDPR is in place. The contracting party is Supabase Pte. Ltd, based in Singapore; some of the sub-processors it uses are based in the USA. Where data reaches these countries, transfers rely on EU standard contractual clauses under Art. 46 GDPR, which form part of the data processing agreement, together with a supplementary risk assessment.
Translation – Microsoft Azure. To translate content, the relevant text is transmitted to and processed by the Microsoft translation service. Only the text itself is transmitted — no name and no identifier. We use the service’s European endpoint, so translations are processed in data centres within the EU. Access by Microsoft personnel from outside the EU cannot be entirely ruled out in individual operational cases; the safeguards described in section 9 apply to this.
Sign in with Google. If you sign in with your Google account, Google processes the data required for authentication — including e-mail address, name and Google account identifier — and provides us with a sign-in confirmation to verify your identity. Google’s privacy terms apply in addition.
Push notifications – Firebase Cloud Messaging (Google). When the feature is enabled, the device-specific push identifier is transmitted to Google in order to deliver notifications to your device. The title and text of each notification are transmitted as well.
App store. Downloading and updating the app is handled by Google Play; Google processes the data arising from this under its own responsibility.
Beyond this, we only disclose data where we are legally obliged to do so, for example on the order of an authority or a court.
Rate limits and plausibility checks on game results run automatically. They may cause an action to be temporarily refused or a game result not to be counted. This does not amount to an automated decision with legal effect within the meaning of Art. 22 GDPR; account suspensions are always decided case by case.
We store your data for as long as your account exists. In the settings you can delete your account yourself at any time — either immediately and irreversibly or scheduled with a 30-day grace period. Within that period you can cancel the deletion by signing in again; afterwards the account and associated data are permanently removed.
Watch-along messages are deleted automatically after the respective race. Headlines are overwritten after some time. Copies in backups are overwritten within ordinary cycles. Reports and moderation decisions are retained for as long as necessary for accountability.
We use exclusively technically necessary storage. Your device’s local storage holds: the sign-in/session entry so you stay logged in; a marker whether a sign-in existed on this device, so the app removes your profile details from the device after you sign out; the chosen language; your favourite team’s colour, so the app appears in that colour right from the start; a cached copy of your profile details and notification settings so the app starts without delay; the key details of the race last shown on the start screen, so it appears immediately on the next launch; a cached copy of these legal texts so they remain readable offline — it expires by itself after three days; the list of headlines you have opened; the list of inbox entries you have read, keyed per account so that read states do not mix after switching accounts; and the acknowledgement that you have seen the privacy notice.
These entries are not transmitted to us. We use no analytics or advertising cookies. Should such features be introduced in the future, we will obtain your consent beforehand. If you delete your account immediately, all of the app’s local entries are removed with it.
Where data is processed outside the EU/EEA, this is based on appropriate safeguards under Art. 44 et seq. GDPR, in particular EU standard contractual clauses. Google may process data in the USA and is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. For the translation service we use Microsoft’s European endpoint, so processing takes place within the EU. Where access from a third country nevertheless occurs during operation, Microsoft is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.
You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on a legitimate interest. You may withdraw consent at any time with effect for the future. You may also lodge a complaint with a data protection supervisory authority. Please address requests to parcferme.app@gmail.com; we respond within the statutory deadlines.
Transmission is encrypted (TLS). Access to data is restricted by database-level rules so that users generally only see their own data or data intended for them. Game results and evaluations are computed server-side so they cannot be manipulated from the device.
The app is intended for persons aged 16 and over. Younger persons should only use the app with the consent of their legal guardians. We deliberately collect no data aimed at children and direct no advertising at them.
We may update this policy when features or legal requirements change. The current version is always available in the app and on our website.
For persons in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies. You have the rights described in section 10 to the same extent. Transfers to countries without an adequate level of data protection are based on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC); for Google, the Swiss-U.S. Data Privacy Framework also applies. You may also lodge a complaint with the FDPIC (www.edoeb.admin.ch).