Privacy Notice

Last updated: September 2026

OptiTrack (optitrack.co and the OptiTrack app) shows live and replayed positions of boats in sailing and rowing races. This notice explains what personal data is involved, where it comes from, who is responsible for it, and what you can do about it.

Contents: Who is responsible · Race participants · Viewers · Club administrators · Hosting and service providers · Retention · Your rights · Contact

Who is responsible for your data

Two parties are involved, with different roles under the GDPR:

• The organising club or event organiser is the controller for race participant data. It decides which sailors are entered, what information is shown, and for how long a race stays available. It is the club's responsibility to inform participants and, where required, obtain consent — normally through the entry form or the Notice of Race.
• OptiTrack (Hans-Joachim Drescher, Swieqi, Malta — full details under Contact) is the processor for that data: we store and display it on the club's instructions under our data processing terms. OptiTrack is the controller only for the small amount of data that concerns the website and app themselves — viewer preferences, notification tokens, administrator accounts, and server logs.

If you take part in a race

What data is involved

Data	Where it comes from	Shown publicly?
Sail number, boat name	Entered by the club	Yes
Your name (helm, crew or skipper)	Entered by the club, or imported from the club's regatta management system. Clubs are encouraged to publish sail numbers only.	Yes, if the club enters it
Club, class, division, rating	Entered by the club	Yes
Positions, speed and heading of your boat during the race	The GPS tracker on your boat	Yes — live and in replay
Results and statistics derived from the track (elapsed time, distance, placings)	Computed by OptiTrack	Yes
Tracker hardware identifier, battery, signal quality	The tracker	No — visible to the club's administrators only

We do not receive your email address, phone number, date of birth, or address. If the club's regatta management system holds such details, they stay there; OptiTrack imports only the fields listed above.

Where and to whom it is published

Race pages are public. Anyone with the link can watch live, replay the race, and see the start list and results — without logging in. Clubs may embed race pages on their own websites, and race pages may be found through search engines. Tracking normally starts when the tracker is switched on and can be stopped by the club, or automatically at the finish line if the club configures it.

Legal basis

The legal basis is determined by the club as controller. In most cases it is either your consent, given when you enter the event, or the club's legitimate interest in running and publicising the competition. For sailors under the age of digital consent in their country (16 in most of the EU, lower in some member states), the club must obtain the consent of a parent or guardian.

Children

Many races tracked with OptiTrack are youth events (for example Optimist fleets). OptiTrack does not collect data from children directly; it displays what the organising club enters. We ask clubs to publish sail numbers rather than names for youth fleets, and we will remove a minor's name from any race on request from the club, a parent or guardian — see your rights.

If you watch races

• No account, no login. You can watch and replay races without identifying yourself.
• Your location is not collected. The map optionally shows your own position if you enable it on your device; this is used only on your screen and is never sent to our servers.
• Club preference cookie. A cookie remembers which club's page you last opened so the app can reopen there. It contains a club name, nothing about you.
• View counts. To see which races are popular we record, per race and per day, a one-way hash of your IP address and browser type, using a secret key that changes with each installation. The hash cannot be turned back into your address and is deleted after 400 days.
• Race-start notifications (opt-in). If you tap “Notify me”, we store a push-notification token for your device, a random device identifier, and the clubs you follow. That is used only to send you alerts when those clubs start a race. Turning notifications off, or uninstalling the app, removes it. See how to delete your data.
• Site analytics. We run our own, self-hosted analytics (GoatCounter) on our own server. It counts page views without cookies and without sharing data with any third party.
• No advertising, no advertising identifiers, no cross-site tracking.

If you administer races for a club

Club administrators have a username and password issued by OptiTrack. We store the username, a hashed password, the clubs and features the account may access, and session tokens. Administrative actions and logins are recorded in server logs for security, with the IP address, and kept for 14 days. API keys issued to clubs are stored as hashes.

Hosting and service providers

We do not sell data. Data is shared only with the providers needed to run the service:

Provider	Purpose	Data
Hetzner Online GmbH (Germany, EU)	Hosting of the servers and databases	All data described here, stored in the EU
Google Firebase Cloud Messaging	Delivering race-start push notifications to Android devices	Push token only, and only if you opted in
Map tile providers (Esri, CARTO, OpenStreetMap)	Background maps	Your IP address and the map area you view, when tiles load
Google Fonts	Web fonts on the website's information pages	Your IP address, when the font loads
The club's regatta management system (e.g. madmin)	Source of the start list when a club imports entries	Sail number, name, club, class — read by OptiTrack, not sent to it

Where a provider processes data outside the EU (Google), this happens under the EU standard contractual clauses or the EU–US Data Privacy Framework.

How long data is kept

• Race data (start lists, tracks, results) is kept so that races can be replayed. The organising club can delete a whole race, or the track of a single boat, at any time from its admin pages. When a club stops using OptiTrack, its race data is deleted.
• Viewer data: notification tokens until you turn notifications off or uninstall; hashed view counts 400 days; the club preference cookie one year.
• Server logs: 14 days.
• Administrator accounts: for as long as the club uses OptiTrack.

Your rights

Under the GDPR you may ask for access to your personal data, have it corrected or deleted, restrict or object to its processing, and receive a copy in a portable format. You may also complain to the data protection authority in your country.

As a race participant, the quickest route is the organising club: it can replace your name with your sail number, delete your boat's track, or delete the race. You can also write to us at info@optitrack.co; we will act on the request together with the club and confirm within 30 days. Parents and guardians may make requests on behalf of a minor.

As a viewer, see how to delete your data.

Security

All connections use TLS. Race data can only be changed by the club's administrators after login. Servers are in the EU, access is limited to the people who operate the service, and passwords are stored only as hashes.

Changes to this notice

We may update this notice from time to time. The “last updated” date above changes when we do, and significant changes will be announced to club administrators.

Contact

OptiTrack is operated by Hans-Joachim Drescher, Swieqi, Malta.
Email: info@optitrack.co
The postal address is provided on request and is stated in the data processing terms.

Malta's supervisory authority is the Information and Data Protection Commissioner (idpc.org.mt). You may also complain to the authority in your own country.

← Back to OptiTrack