HCRALabs, LLC
Privacy Policy
1. Scope and who operates the website
HCRALabs is the name under which the website and services are provided. This Privacy Policy describes how the operator of HCRALabs (“we,” “us,” or “our”) collects, uses, discloses, retains, and manages information in connection with the website, free member registration, member communications, and site discussion features. It applies to the Service described in our Terms of Service.
We apply this policy to information collected through visits to website pages, member registration, authentication, account administration, support inquiries, blog comments and discussions, and protected report downloads.
2. Information we collect
Account and profile details. When you register, we collect your email address, first and last names, confirmation that you are at least 21, and the information necessary to manage your account. We also process the Display Name associated with your account and displayed with your public discussion contributions. We do not require a date of birth or government identification to create a free member account.
Consent and preference records. We record acceptance of the Terms of Service and Privacy Policy, their version identifiers and timestamps, and your separate, optional marketing preference. The current selection is stored in your profile. Each actual change made in the Member Profile screen creates a preference-history event; where prior accounts are migrated, an initial recorded baseline does not imply an earlier preference change.
Authentication and technical information. We process account/session identifiers, verification-code activity, authentication cookies, and operational or security data necessary to run the website. Website hosting and security providers may process request-related information such as IP addresses, device/browser details, access timestamps, and diagnostic logs.
Website analytics. On designated public-facing website pages where Cloudflare Web Analytics is enabled, the service processes browser-based measurements of website traffic and page performance. Analytics information may include page-view and visit measurements; website hostnames and page paths; referring websites or pages; country, browser, operating system, and device-type information; navigation information; and page-load timing and Core Web Vitals. These measurements support reporting about website usage and performance.
Comments and communications. For active blog comments and discussions, we process the text and other information you choose to publish, along with the account or Display Name association needed to display and moderate contributions. When you contact support, we process the message and contact details necessary to respond.
Personalized reports and download audits. Members claim individual published Race Sheets or reports before downloading. Each personalized PDF includes the member’s Display Name, internal unique member identifier (UUID), and a unique download reference. The server maintains download-processing audits containing the member identity, report identity, download reference, Display Name snapshot, and processing status. We use these data to administer access and processing, trace issued versions, protect intellectual property, investigate suspected unauthorized redistribution or misuse, and maintain security. A status such as “READY” records processing state and does not establish actual receipt or opening of the PDF.
Download audit records are designed to survive account removal and may continue to contain former-member identifiers and the earlier Display Name snapshot. Removing a public comment Display Name does not delete or rename audit records or previously issued PDF copies. Retention criteria and privacy-request procedures are described in Sections 9 and 10.
3. Why we use information
We use information to register and authenticate members; provide authorized content; maintain and secure accounts; display and moderate community discussions; process, personalize and audit protected report downloads; preserve audit trails related to account removal; respond to inquiries; deliver administrative messages; detect abuse; document acceptance of our policies; and meet applicable legal obligations. We also use Cloudflare Web Analytics reports to understand aggregate website traffic, usage patterns, and performance so that we can maintain and improve the website.
Only if you make a separate, optional affirmative selection may we use your contact information to send promotional news, research, or product updates. You may withdraw that selection without losing basic membership.
4. Public comments and Display Names
HCRALabs discussion features are available. Discussion submissions currently consist of plain-text comments and replies; text may include typed links. These contributions may be publicly visible and searchable. Your chosen public Display Name may appear alongside your contributions while membership is active. We do not treat material voluntarily posted in a public discussion as a private communication. Comment-file attachments are not currently offered.
Please do not include sensitive information or information about another person without authorization. Even after your Display Name is changed, your comment text may identify you if you included a name, location, employer, social handle, link, or other distinguishing details.
5. Membership withdrawal: comments remain, name becomes “Non-Member Comment”
Ordinary members may permanently close their own accounts from the Member page after signing in and completing the required confirmations. Closure deletes the Supabase authentication account, associated profile, report claims, and member-specific marketing preference history; the member is signed out and access is revoked. Privileged OWNER and ADMIN accounts cannot use this self-service mechanism. Written privacy requests and account-closure assistance may be submitted to support@hcralabs.com. Separately authorized historical download, security, or removal audit records may be retained for permitted purposes, subject to Section 9 and applicable law.
Existing blog comments and discussion contributions ordinarily remain on the HCRALabs site so that conversations and their context are preserved. However, the public Display Name previously shown with those retained contributions will be removed and replaced by the generic label “Non-Member Comment”. The site will no longer display the former member’s Display Name as the author label on those retained contributions.
This change affects the public byline; it does not alter personalized PDFs or associated download audit records and does not by itself guarantee that comments are anonymous. The text of a contribution, quoted replies, page URLs, third-party search indexes, screenshots, or cached copies may still reveal information. Removing the member’s public Display Name is distinct from deleting personal information from account systems or handling a separate legally protected deletion request.
To request removal or correction of personally identifiable information in retained comments or other records, submit a written request to support@hcralabs.com. We will review and resolve written requests within 30 calendar days of receipt, subject to applicable law, identity verification where appropriate, and any legally required response period or permitted extension. Depending on the circumstances, we may remove, correct, restrict, or retain particular information as law permits or requires. Ordinary account closure does not itself constitute a request for complete personal-information erasure.
If you later register again with the same eligible, unblocked email address while registration is available, HCRALabs creates a new account identity, profile, acceptance records, and report claims. Previous account data and report claims are not restored or linked to the new membership. Previously published comments remain shown under “Non-Member Comment” rather than being reattributed to the new account.
6. Service providers and disclosures
We use Supabase for member authentication and account data; Resend for authentication-related emails; Cloudflare for website hosting, private storage, email routing, and Web Analytics; and an administrator-managed Gmail inbox for routed support inquiries. These service providers process information needed to perform their respective functions. We will update this notice when the material service-provider arrangements change.
We may disclose information where reasonably necessary to protect the Service or users, investigate suspected abuse, comply with applicable law or valid legal process, or manage a permitted business transition, subject to applicable legal requirements. If we introduce advertising, payment, or additional analytics services that materially change how information is handled, we will revise this notice before implementing those changes.
7. Cookies, analytics, and technical records
Our member portal uses secure, HTTP-only authentication cookies to keep members signed in. If you select the optional “remember email” function on the sign-in form, your email address is stored in your browser’s local storage on that device to prefill a future sign-in. This optional browser-stored value is separate from an authentication cookie; you can remove it through your browser’s site-data controls. Anyone with access to that browser profile may be able to see the remembered email. Hosting and security services may process technical requests and operational logs necessary for reliability and protection.
On designated public-facing website pages where enabled, we use Cloudflare Web Analytics to measure website traffic and page performance. According to Cloudflare, its Web Analytics beacon does not use cookies, browser local storage, or device fingerprinting to track individual visitors over time. Cloudflare receives the visitor’s IP address as part of normal network request processing, but states that its Web Analytics real-user-monitoring service discards that address at the nearest Cloudflare data center rather than retaining it in the service’s core databases or logs. This analytics processing is separate from our authentication cookies, optional remembered-email local storage, and ordinary website hosting and security records described above. If we later introduce advertising pixels, nonessential tracking cookies, or other materially different analytics or tracking, we will update this policy and implement any legally required choices before enabling that activity.
8. Optional marketing messages
Marketing enrollment is separate from account creation: the selection is optional and not pre-checked. You can opt in, opt out, or change your selection at any time through the Member Profile screen without ending membership. The current preference is stored in your profile and each actual change is recorded in a preference-history event. Account-specific preference history is deleted when you permanently close your membership.
You may also contact support@hcralabs.com for help changing your marketing preference. Before HCRALabs sends promotional campaigns, its sending system must honor current preferences, provide a functioning unsubscribe mechanism, and maintain any legally required suppression records. We will not send promotional campaigns until these controls have been implemented and tested. Opting out does not stop essential sign-in, security, or account-administration messages; discussion-reply notices and event subscriptions are not current features.
9. Retention and account closure
We retain information for no longer than reasonably necessary for its disclosed purpose, subject to security, valid legal obligations, disputes, backups, and other applicable exceptions. Self-service closure deletes the authentication identity, profile, report claims, and account-specific marketing preference history. Separately maintained historical PDF-download, security, and account-removal audit records may remain where law permits or requires. The table below summarizes category-specific retention criteria; exact periods and deletion schedules are still subject to owner and legal approval.
Retention approach by information type
| Information type | Retention criteria |
|---|---|
| Member identity and profile | Authentication identity, member profile, and report claims are deleted through ordinary self-service account closure. Separately retained security, download, or removal audits and scheduled backups are governed by their own retention criteria and applicable law. |
| Published comments | Ordinarily retained while published; public author byline becomes exactly “Non-Member Comment” following account removal, subject to privacy rights and moderation. |
| Policy acceptances and security records | Account-linked policy acceptance data stored in a deleted member profile are removed with that profile. Independently maintained security or compliance records may remain only as reasonably necessary and legally permitted. |
| Personalized PDF and download audits | Audit records may retain report identity, member UUID, unique download reference, Display Name snapshot, and processing state after account closure for traceability, IP enforcement, security, disputes, or legal duties. A “READY” status is not evidence of receipt or opening. Retained records are subject to lawful privacy requests and an approved retention schedule. |
| Account-removal administrative audits | Historical records documenting account closure may survive deletion of the member account to establish operational integrity, prevent misuse, meet security/legal obligations, and manage disputes; retention must be justified and limited to what is necessary. |
| Marketing preferences | The current marketing selection and its change-history events are held in account-linked records and deleted when that membership is permanently closed. A separate minimal unsubscribe/suppression record may be retained when required to honor legal or marketing opt-outs. |
| Support correspondence and system backups | For as long as reasonably needed for support, security, continuity, backup rotation, or legal needs. |
| Optional remembered email (browser local storage) | Until removed using browser/site-data controls, or otherwise overwritten or cleared on that browser profile; stored locally on the selected device. |
| Website analytics — Cloudflare Web Analytics | According to Cloudflare’s published documentation, unsampled Web Analytics beacon data is retained for seven days, after which analytics data is aggregated for longer-term reporting. The retention and availability of these analytics records are governed by Cloudflare’s applicable service practices. These records are distinct from HCRALabs membership, authentication, and personalized-report audit records. |
10. Your choices and privacy requests
You may request access to, correction of, or removal of personal information by submitting a written request to support@hcralabs.com. Requests to remove personally identifiable information from public comments or retained audit records are handled separately from ordinary member account closure. Depending on your location and applicable law, you may have additional rights, including rights to know about processing, object to or limit certain uses, appeal a denial, or withdraw particular consent.
We may take reasonable steps to verify your identity. We will review and resolve written personal-information removal requests within 30 calendar days of receipt, subject to applicable law; any shorter legally required period or applicable permitted extension takes precedence. A valid request does not necessarily require deletion of every record: we may retain information where permitted or required for legal obligations, security, fraud prevention, intellectual-property protection, disputes, or legal claims. We will communicate the outcome in accordance with applicable requirements. Account closure does not waive statutory privacy rights, and legally enforceable deletion requirements supersede the ordinary comment-retention policy.
11. Security
We use administrative, technical, and operational safeguards appropriate to the information and services involved, including authentication and access restrictions. No online service or data transmission can be guaranteed completely secure. Please notify us at support@hcralabs.com if you believe your account or information has been compromised.
12. Age restriction
Membership is intended only for people age 21 or older. Our free registration uses an age declaration rather than collecting a date of birth. If we discover an ineligible account, we may disable it, assess the information involved, and take action required by law. HCRALabs does not knowingly seek personal information from children under age 13.
13. Third-party services and locations
Links on HCRALabs to external websites are governed by those websites’ privacy practices. Depending on the service providers and their configurations, information may be processed in a state or country other than where you reside.
14. Changes to this policy
We may update this Privacy Policy to reflect operational changes, new features, or legal requirements. We will post the revised policy with an updated effective date and provide additional notice or obtain consent when required by applicable law. Material changes to existing download tracking, payments, additional tracking, or sharing practices will be addressed through appropriate advance disclosures or consent where required by law.
15. Contact
For privacy inquiries, membership questions, and written requests concerning personal information, contact HCRALabs at support@hcralabs.com.