Overcut is a sim racing telemetry platform. This page explains what we do with the data that comes from your sessions and your account, and what you can switch off. For anything about your data, write to hello@overcut.gg.
When you record a session with the Connector, a private copy of it is kept for you in the cloud. This is what that involves.
A copy is the full recording of a session as the Connector wrote it: the telemetry of your laps, the car, the track, the game and the capture environment as broad ranges. Only you can see it, unless you share it.
Purpose: to give you your session history and the analysis of each session.
Legal basis: our legitimate interest in providing that history and analysis, as described in the Terms of Use.
Kept until you delete the copy or delete your account.
The Record sessions switch in your account decides whether new sessions are copied. Turning it off applies to sessions that start afterwards and does not delete what is already stored. You can delete one copy, or all of them, in your account.
Purpose: to let you object to this use and to remove what we hold.
Legal basis: your rights to object and to erasure, which the switch and the delete controls carry out.
After you delete a copy, the stored file is removed shortly afterwards, and for a deleted account within about a day. A marker with no telemetry stays until the account is deleted, so that the Connector does not send the same session again.
Community data lets eligible driving data from your recorded sessions count in grouped results shown to other drivers. Your sessions themselves stay private to you unless you share them.
We use it to give drivers grouped insights, on the basis of our legitimate interest. We keep a written assessment that weighs that interest against your rights.
Eligible driving data from your sessions, the car setup, the game version and the quality of the capture.
Not part of Community data or of the capture environment: the name of your computer, your computer username, network identifiers, serial numbers, the software installed on your computer and the devices connected to it. None of these is recorded in a session or used in grouped results. Some are handled for other purposes, such as the device name you see when you pair the Connector and the network address that reaches our servers.
A grouped result is never shown for fewer than 8 distinct accounts. Any ranking, minimum or "best" claim needs at least 30 distinct accounts.
Community data is on by default, and the switch is how you object. Turn it off in your account, in Data and privacy, at any time.
None of your driving data is used in grouped results, including from sessions recorded before. Your sessions stay saved and private. The switch does not cover the places where you appear in someone else's session; see Other drivers. Turning it back on applies only to sessions recorded afterwards, once the Connector has picked up the change. This is separate from Record sessions: turning Record sessions off means nothing new is saved or uploaded.
Each recorded session carries a few broad ranges about the machine and the capture, so results from very different setups are not mixed up.
The operating system family and a version range, the processor architecture, a range for the number of logical processors, a range for the amount of memory, the Connector and game adapter versions, the game version, and how steadily the game data arrived. Hardware is kept only as ranges, never as exact models or specifications.
Your computer name or username, network addresses, serial numbers, processor or graphics card models, installed programs, connected devices, file names and folder paths.
Other drivers in your sessions are recorded without a name.
No name and no gaming platform identifier is stored for them. Each one is given a stable reference that is used only inside Overcut.
The switch in your own account does not cover records of you in another driver's session. If that is you, write to hello@overcut.gg with your first and last name in the game, and we will stop using the records that refer to you. We use the name only to find those records.
When you pair the Connector with your account and when it connects to our servers, the following is processed.
When you pair the Connector, it sends the name of your computer, taken from the computer and cut to 32 characters. We store it with the paired device.
Purpose: to identify the computer you paired and tell it apart from your other devices.
Legal basis: our legitimate interest in running the pairing and keeping your account secure.
Kept while the computer stays paired. Disconnecting a computer, from your account or from the Connector, erases its name at once. Deleting your account erases it too.
When the Connector asks to be paired, we keep the country the request comes from, as reported by Cloudflare, and the time it was made. The confirmation page shows you the country and how long ago the request was made, so you can tell whether it is yours.
Purpose: to let you recognize your own request before you approve it, and to refuse one you did not make.
Legal basis: our legitimate interest in keeping your account secure.
Kept with the request, which is deleted at most 25 hours after it expires. A request expires 10 minutes after it is made.
To tell you whether a request comes from the same network as the page you are using, we derive a short value from the network part of the address of the request, using a secret key, and compare it with the same value derived from your page. Only the value of the request stays with the request. The page shows you only whether the two networks match.
Purpose: to warn you when a request comes from a different network from the one you are using.
Legal basis: our legitimate interest in keeping your account secure.
The value is erased as soon as the request is approved, denied, expires or is used, and in any case within about 20 minutes of the request being made: it is valid for 10 minutes and the cleanup that erases expired values runs every 10 minutes. The value derived from your own page is compared and not kept.
The request carries the name of your computer, cleaned of control characters and cut to 32 characters. The confirmation page shows it to you. When you approve and the Connector collects the pairing, the name moves to the paired device and is erased from the request.
Purpose: to let you recognize which computer is asking before you approve.
Legal basis: our legitimate interest in keeping your account secure.
Erased from the request when the pairing is collected. A request that is denied, or that nobody collects, keeps the name until the whole request is deleted, at most 25 hours after it expires. The copy on the paired device follows the retention of the name of your computer above.
A pairing request holds the codes it uses, the version of the Connector, the country, the times, its state and, once someone decides it, the account that decided. After it expires, a cleanup that runs every 10 minutes deletes the request once 24 hours have passed.
Purpose: to run the approval and the collection of the pairing.
Legal basis: our legitimate interest in running the pairing and keeping your account secure.
The whole request is deleted at most 25 hours after it expires (24 hours plus up to 10 minutes until the next cleanup, rounded up). A request expires 10 minutes after it is made. If you delete your account, the requests you decided are deleted with it.
When the Connector connects, our API processes the network address it comes from, only in memory. In security alerts and counters it appears as a pseudonymized value derived with a secret key, not as the address. Cloudflare, which sits in front of our servers, also processes the address as an infrastructure provider.
Purpose: to limit the rate of requests and to detect abuse.
Legal basis: our legitimate interest in keeping the service secure.
The API does not write the address to its logs. The pseudonymized value and the counters stay in memory for a few minutes and are lost when the service restarts. An alert that carries the pseudonymized value stays in our private alert channel. Cloudflare keeps the address under its own terms.
The Connector downloads track data from a separate server of ours. That server's web access log records each request with the network address, in readable form, in the host's system log.
Purpose: to operate the server and investigate faults and abuse.
Legal basis: our legitimate interest in keeping the service running and secure.
The system log has no time limit: it keeps entries until it grows past its size cap, which today is about six weeks of entries.
If the Connector shows its message as a Windows notification instead of its own small window, that notification can appear in screen captures and streams. Its own small window is excluded from captures.
Purpose: to tell you this before you stream, so you can switch notifications off.
Legal basis: none is needed, since this describes how your own computer shows a message and is not data we receive.
Nothing is stored.
When a new computer is connected to your account, we send an e-mail to the address of your account so you can disconnect a computer you do not recognize. The e-mail has the name of the computer, the date and time (UTC), the approximate country the request came from when we have one, and a link to disconnect it. It is sent by an e-mail delivery provider we contract.
Purpose: to warn you when a new computer is connected to your account, so you can disconnect one you do not recognize.
Legal basis: our legitimate interest in keeping your account secure.
We do not keep a copy of the e-mail, and our logs record only whether it was sent. The delivery provider keeps a record of the sending for 30 days, on the plan we use.
We use service providers to run Overcut. The table shows what each kind of provider does and where it processes the data it receives.
Your account and session data are hosted in Brazil. The European Commission recognises Brazil as providing data protection essentially equivalent to the GDPR (adequacy decision (EU) 2026/179), so no additional transfer safeguards are required.
Function: Database, account and sign-in, Overcut servers
Location: Brazil
Function: Delivery of the site, network protection, session files, live connection
Location: United States
Function: Payment processing
Location: United States
Function: Errors and technical logs
Location: European Union and United States
Function: Aggregate usage analytics
Location: European Union
Function: Sending Overcut e-mails
Location: United States
Where a provider above receives data in the United States, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses, depending on each provider's contract.
You can ask for the names of these providers at hello@overcut.gg.
Discord and Google appear only if you choose to sign in with them. They handle the data you give them under their own terms and privacy policies.
Other uses of data are described in the Terms of Use, and are not repeated here.