Privacy
Short, because there is not much to say. APEX sells nothing, and accounts are optional: everything works without one. It does measure which pages get used, and it asks first where the law requires it. Two things are worth reading carefully: what an account stores if you make one, and what happens to what you type into the chat assistant.
What APEX does not do
- No advertising and no retargeting. Nothing here feeds an ad network: the analytics below runs with ad storage and ad personalisation switched off, so it measures use and cannot be used to follow you somewhere else.
- No account required. Every page and the chat assistant work without signing in. An account is optional, and only stores what is listed under If you create an account.
- No selling or sharing of personal data. Analytics data is not sold, and Google Signals and ad personalisation are both switched off.
Analytics
APEX uses Google Analytics 4 to answer questions it otherwise cannot: which of these pages are actually used, whether people arrive on a phone or a desktop, and whether things like the race replay and the 3D circuit viewer are ever opened. This is a portfolio project with no revenue, and until now it had no way of knowing whether any of it worked.
What is collected:
- Pages viewed and how long was spent on each, device type, browser, language, approximate location to city level (Google discards the IP address rather than storing it), and the link or search that brought you here.
- Eight specific interactions, by name: opening the Pitwall assistant, sending it a message, starting a race replay, showing a second-screen pairing code, opening a 3D circuit view, generating one, selecting a search result, and loading a page whose data failed to arrive.
The message count is recorded; the messages are not. Nothing you type — into the assistant or into the search box — is ever sent to Google. Nor is anything that could identify you: if you have an account, its id, name and email are never sent to Google Analytics, so analytics cannot be tied to it. Analytics data is deleted after 14 months.
Consent, and why there is now a banner
Google Analytics sets a cookie named _ga. Unlike the rate-limiting cookie below, it is not strictly necessary, so it is not something to set without asking.
If your browser reports a timezone in the EU, the EEA or the UK, you are asked before anything is stored, and analytics stays switched off until you say yes. Ignoring the banner leaves it off. Everywhere else, analytics is on by default. That is a legal distinction rather than a judgement about who deserves privacy, and it seems better stated plainly here than hidden behind a banner nobody reads.
You can opt out anywhere in the world using your browser's cookie controls, by blocking googletagmanager.com, or with any content blocker — a substantial share of visitors already do, which means the numbers this produces are undercounts.
The other cookie
Using the Pitwall assistant sets a single cookie named f1_agent_sid. It is a signed random identifier, it expires after seven days, and it exists for one reason: rate limiting. Without it, everyone sharing an IP address — which on mobile networks can be thousands of people — shares one request allowance, and one heavy user exhausts it for everybody else.
It carries no profile, records nothing about you, and is useless to any other site. It is set only when you use the assistant, and it is not asked about (nor is the sign-in cookie described below, if you choose to make an account): a strictly-necessary cookie does not require consent, and asking permission for something you cannot decline would be theatre. The analytics cookie above is a different matter, which is exactly why that one is asked about.
If you create an account
Accounts are optional. Nothing on this site needs one; signing in only adds favourites, preferences and saved chat history that follow you between devices. There are no passwords: you sign in with Google or with a one-time link sent to your email address.
If you make one, this is what is stored, all of it in a MongoDB Atlas database (the same one that holds the race data):
| What | Why | Kept for |
|---|---|---|
| Your email address, display name, and avatar URL | To sign you in and show who is signed in. The name and avatar come from Google if you use it (the avatar is a link to the picture on Google's servers, not a copy); otherwise the name starts as the first part of your email address and the avatar is your initials. You can change the name. | Until you delete the account |
| Linked sign-in methods | If you use Google: your Google account id and the tokens Google issues at sign-in, stored encrypted. They are not used for anything after sign-in. | Until you disconnect Google or delete the account |
| Sessions | One record per signed-in browser, with its IP address and browser name, so you stay signed in. | 30 days after you last used it, or until you sign out |
| Preferences | Favourite driver and team, time format, and later your home page layout and spoiler settings. | Until you delete the account |
| Chat conversations | Once saved chat history is switched on, conversations you have while signed in are stored against your account so you can come back to them on another device. | Until you delete them or the account |
| Session reminders | Only if you switch email reminders on: which sessions to remind you about, how far ahead, your time zone and the address to send to, plus a record of each reminder sent so none is sent twice. | Settings until you delete the account; each sent-record 60 days |
| Sign-in links | A hashed copy of each emailed link, and a record that a link was sent to your address, used to limit how many can be sent. | 10 minutes for the link; one hour for the record |
Accounts are not deleted automatically for inactivity, so an account you stop using stays until you delete it.
Signing in sets one cookie, better-auth.session_token (on the live site it carries a __Secure- prefix). It holds a random session identifier, lasts up to 30 days, and is strictly necessary to keep you signed in, so like the rate-limiting cookie it is not asked about. It is only set once you choose to sign in.
Who else is involved. If you sign in with Google, Google sees that you signed in to APEX and shares your name, email address and profile picture with it. If you use an email link, the link is sent through the email provider APEX sends mail with, which therefore handles your address and the message. Neither receives your preferences or your chat history.
Export or delete it yourself. On your account page, Export my data downloads everything listed above as a JSON file (with sign-in tokens withheld, since they are credentials rather than information about you). Delete account removes your account, every session, your linked sign-in methods, your preferences, your reminder settings and your saved chat conversations immediately. If the database host is keeping backups, a copy can survive in them until they expire.
Stored in your browser only
Two things are kept locally and never sent anywhere: your display preferences on the Watch page (pinned drivers, density, timing mode), and a marker letting a watch session resume if you reload. Your answer to the analytics banner is kept the same way. Clearing site data in your browser removes all three — and, in the EU and UK, means you will be asked about analytics again.
Chat messages — the real disclosure
This is the part that actually matters. When you use the Pitwall assistant, what you type leaves this site and reaches four places:
| Recipient | Receives | Why |
|---|---|---|
| Ollama Cloud | Your message | Runs the language model that writes the answer |
| LangSmith | A trace of the conversation | Debugging and quality checks. This is on in production. |
| Tavily | Search queries derived from your question | Only when the assistant looks something up on the web |
| MongoDB Atlas | The conversation thread | So the assistant remembers earlier turns within one conversation |
Practical advice: do not type personal information into the chat. Messages containing card numbers, national ID numbers or phone numbers are rejected before they reach a model or a trace, but that filter is a safety net for obvious cases, not a guarantee.
Thumbs-up and thumbs-down votes, and any comment you attach to one, are stored so answers can be improved.
Requests your browser makes elsewhere
Loading APEX causes your browser to contact a few other hosts directly, which means those hosts see your IP address: Google Fonts (typefaces), OpenF1 (live timing on some pages), Wikimedia Commons (images), OpenTopoData (circuit elevation), Google Analytics (unless you have declined or blocked it), and Google Calendar only if you use an add-to-calendar link. Where those come from is described on data sources.
Retention
Rate-limiting records expire automatically. The session cookie expires after seven days. Analytics data is deleted after 14 months, which is the longest Google Analytics allows. Conversation threads are currently kept without a fixed expiry — if you want one removed, ask via GitHub Issues, though note that an issue is public, so do not quote anything private in it.
This is a personal project
APEX is built and run by one person, on free service tiers, with no company behind it. It is not a commercial service, and it should not be treated as one. Anything you send to the assistant should be something you would be comfortable being processed by the third parties named above.