The Out LapBy Appie
Privacy

What leaves your phone.

Effective · 2 November 2026

The Out Lap is made by one person in the United Kingdom. This page says what the app, its widgets and this website do with data, in the order it happens. The short version: no accounts, no names, no emails and no payment details reach us from the app, and nearly everything it knows about you never leaves your phone.

01Who is responsible

The controller for any personal data described here is Appie Ltd (company number 17466227), United Kingdom, which makes and publishes The Out Lap. Questions, requests and complaints go to hello@appie.ooo or through the support page.

02No accounts, no sign-in

There is no account to create and nothing to sign in to. The app never asks for your name, email address, phone number or payment details, and none of them reach us. You pick a driver, answer three questions about how you watch, and the season is yours.

03Subscriptions and the paywall

The Out Lap Pro is bought from Apple through the App Store. Apple takes the payment, holds your billing details and runs the subscription; Apple's privacy policy governs all of that. We are never shown your payment details - only whether a subscription is active.

On Android, The Out Lap Pro is bought from Google through Google Play. Google takes the payment, holds your billing details and runs the subscription; Google's privacy policy governs all of that. Here too we are never shown your payment details - only whether a subscription is active.

The app uses the Superwall SDK to show its paywall and to receive purchase events. Superwall receives:

  • a device-generated identifier - a random ID created on your phone, not your Apple ID, name or email. Apple's "identifier for vendor" (IDFV), which is specific to our apps on your device, is also sent;
  • whether your subscription is active, the date the app was first installed, and a count of how many times the paywall has been shown - so it is not shown to a subscriber, and so it can be worded differently on a second look;
  • paywall and purchase events - which paywall, plan and price you were shown, the paywall was shown or dismissed, a purchase started, succeeded, failed or was restored;
  • basic device information - iOS version, device model, app version and locale;
  • your onboarding choices - the driver you picked, and whether you turned on notifications and offers - stored as short labels against that identifier so the paywall can be worded around them;
  • onboarding events - which onboarding pages you viewed, for how long, and which buttons you used - so we can see where the onboarding loses people.

On Android, Superwall receives the same things, with Android's device ID in place of Apple's identifier for vendor, and the Android version in place of the iOS version. Android's device ID is specific to our apps on your device. The Superwall SDK can also read Google Play's record of how the app was installed, to redeem a web offer link; we do not use those links.

Whenever the app talks to Superwall, on iPhone or Android, Superwall sees your IP address and uses it to work out your approximate location: country, region, city and time zone. This is never your precise location, and it does not use any location permission. It also receives how long the paywall took to load.

Superwall does not receive your name, email address or payment details. Superwall is a United States company; its handling of this data is described in Superwall's privacy policy.

Our sub-processors, in full: Apple (payments, subscriptions, and notifications through Apple Push Notification service), Superwall (the paywall), Fly.io (the servers that hold season data, recordings and the push tokens in section 06), Cloudflare (this website, its contact form, and the front door to our servers), Resend (the launch-list emails in section 12), Google (payments and subscriptions on Android, and the inbox that support email lands in), Open-Meteo (weather) and Apple Maps (the radar backdrop). None of them is given anything that names you, unless you choose to write to us (section 12). Each of them protects what it is given at least as well as this page promises, under its own published terms.

04What the app fetches

Season data - results, standings, calendars, session recordings - and the 3D circuits are downloaded from our own servers, hosted on Fly.io: relay.theoutlap.app, viewer.theoutlap.app and maps.theoutlap.app, which reach Fly.io through Cloudflare, and flive2.fly.dev and gridcast-live.fly.dev. Like any web request, a download carries your device's IP address, which appears in ordinary server logs. Those logs are kept briefly, to run and debug the service, and then discarded. Nothing else about you is attached to a download: no identifier, no account, no name. What the app sends us for notifications is in section 06.

05Track weather

The TRACK WEATHER widget asks Open-Meteo for the conditions at the next circuit. The request carries the circuit's coordinates - never yours; the app has no location permission and never asks for one - and, as any web request does, your IP address. Open-Meteo's data is licensed under CC BY 4.0, and its privacy policy is at open-meteo.com/en/terms. The map behind the numbers is an Apple Maps snapshot rendered by iOS on your device, to which Apple's Maps terms apply. The TRACK WEATHER widget is not in the Android app.

06Notifications and the lock-screen card

Race reminders are local. If you allow notifications in onboarding or tap Remind me, the app asks iOS for permission and schedules a reminder on your device fifteen minutes before each upcoming qualifying, sprint and race, straight from the season calendar. Nothing about them is sent to us. Switch them off in the app at any time.

Offers are separate and off by default. We only send you an occasional offer if you tick the box for it in onboarding, or switch on Offers in the Following tab, and you can switch it off there at any time.

Everything else comes from our server, relay.theoutlap.app, through Apple Push Notification service: a card on your lock screen (a Live Activity) half an hour before each session, which follows the session live and ends on the result; an alert when a qualifying, sprint or race starts, and another when it finishes, saying where your driver ended up; and an alert when a session's replay is ready. To send them, the app gives our server:

  • push tokens - random strings Apple issues so that a server can reach this app on this phone: one for alerts, one that lets us start a lock-screen card, and, while a card is up, that card's own. A push token is not your Apple ID, your name, your phone number or anything else that names you;
  • the driver you follow - his car number, three-letter code and team colour - so the card shows him and an alert can say where he finished;
  • while a card is up, the session it belongs to - which session, the Grand Prix and the number of laps;
  • whether the app is an App Store build or a test build, which tells us which of Apple's two push servers to use.

Nothing else is stored with them: no name, no email, no IP address, and not the identifier Superwall holds. A new driver pick replaces the old one; no history of picks is kept. The server runs on Fly.io in London and keeps all this on an encrypted disk, which Fly.io backs up daily, keeping each backup for five days. Requests to the server pass through Cloudflare on the way. Apple sees each token and the words of each notification as it delivers them, under Apple's privacy policy.

How long we keep them: a card's token is deleted when the card ends, and never later than a few hours after its session. The alert token and the card-starting token are kept while the app is on your phone. Once the app is deleted, Apple tells us the token no longer works the next time we use it, and our server deletes it then. A token Apple keeps refusing is deleted too.

The app does not ask for notification permission on first launch. Instead it uses iOS's quiet ("provisional") permission: alerts land in Notification Center without a sound or a banner, each with Apple's own Keep and Turn Off buttons. Allow notifications from Remind me and they arrive as ordinary banners. Live Activities are on by default in iOS. Turn alerts off in Notification Center, or in iOS Settings under Notifications, The Out Lap; turn the lock-screen card off in iOS Settings under The Out Lap, Live Activities. iOS does not tell us when you do, so the tokens stay with us until the app is deleted, as above - but nothing more reaches your screen.

On Android, the only notifications are the local race reminders. They are scheduled on your phone and nothing about them is sent to us. There are no lock-screen cards, result or replay alerts, offers or push tokens on Android.

07What stays on your device

Your chosen driver, your onboarding answers, your widget settings and a cache of season data live on your device - in the app's own storage, and in its App Group container so the widgets can read them. We cannot see any of it, except the driver you follow, which also goes to our server with your push tokens (section 06). Delete the app and it all goes with it.

08What the app does not do

No location permission: the approximate location in section 03 comes from your IP address, not your phone. No camera, no contacts. No advertising, no advertising identifier, no cross-app tracking - and no tracking prompt, because there is nothing to ask. No analytics beyond the Superwall paywall and onboarding events in section 03. No cookies. The push tokens in section 06 send notifications and lock-screen cards and do nothing else: they are not used to track you or to advertise to you, and they are not sold.

09Children

The Out Lap is not directed at children and has no age gate. It collects nothing that names anyone, children included. If you think a child has sent us personal data by some route we have not imagined, tell us and we will delete it.

10The legal bases

Where any of the above counts as personal data under the UK GDPR or the EU GDPR - an IP address in a server log, a push token on our server, the identifier Superwall holds - we rely on two lawful bases: performance of a contract, to deliver the app and the subscription you asked for; and our legitimate interests in running, securing and pricing the service. The launch list in section 12 and any offers you opt in to rest on your consent, which you can withdraw at any time. Superwall, Fly.io and Resend are United States companies, so that data may be processed in the United States under the safeguards described in their own policies. Nothing here is used to make automated decisions with legal or similarly significant effects on you.

11Your rights

Under the UK GDPR and the GDPR you can ask to see the personal data we hold about you, have it corrected or erased, restrict or object to our use of it, take a copy of it, and complain to the Information Commissioner's Office (ico.org.uk) or to the authority where you live.

In practice: there is no account to close. From the app, the only things we hold are the push tokens and driver pick in section 06, stored with nothing that names you, so we cannot look yours up from a name or an email. If you joined the launch list on this website, we hold that address too (section 12), and we will remove it when you ask. Deleting the app removes everything it kept on your device, and its tokens leave our server as section 06 describes. Your subscription record is Apple's, managed from Settings under your name, then Subscriptions. On Android it is Google's, managed in the Play Store under Payments and subscriptions. The identifier and events Superwall holds are covered by Superwall's policy and its own contact details. Ask us anyway at hello@appie.ooo and we will answer within a month.

To have your data deleted: on Android, open the Following tab and tap Delete my data, which starts an email to us with your identifier filled in. On iPhone, email hello@appie.ooo with the subject Delete my data. We delete what we hold for that identifier and ask Superwall to delete the identifier, events, approximate location and onboarding choices held against it, within a month. Apple's or Google's subscription record stays with them, under their own policies.

If you are in California: we do not sell personal information, and we do not share it for cross-context behavioural advertising.

12This website

This site sets no cookies and runs no analytics. It is served by Cloudflare, whose infrastructure logs requests the way any host does, under Cloudflare's privacy policy.

If you use the contact form, it sends what you type - your name, your email address, the topic and your message - together with the page you sent it from and the country Cloudflare sees the request coming from. Cloudflare passes it on as an email to our inbox, which is hosted by Google. We use it only to read your message and reply, keep it no longer than we need to help you, and you can ask us to delete it at any time. Writing to hello@appie.ooo directly works the same way.

If you leave your email address in the Notify me box on the home page, it goes to Resend, the service that sends our email, and joins a list with one purpose: telling you when The Out Lap is on the App Store. You get one email straight away to say you are on the list, and one on launch day. The address is not used for anything else or shared with anyone else. To leave the list, use the link in the launch email or reply to either email. We delete the list within 30 days of the launch email going out.

13Changes

If the app starts doing something this page does not describe, this page changes first. The date at the top moves, and the current version always lives at theoutlap.app/privacy.

14Contact

Appie Ltd, Holland House, Driffield, YO25 8BJ, United Kingdom.
hello@appie.ooo, or the support page.