The Out LapBy Appie
Privacy

What leaves your phone.

Effective · 12 October 2026

The Out Lap is made by one person in the United Kingdom. This page says what the app, its widgets and this website do with data, in the order it happens. The short version: no accounts, no names, no emails and no payment details reach us from the app, and nearly everything it knows about you never leaves your phone.

01Who is responsible

The controller for any personal data described here is David Overmeer, United Kingdom, who makes and publishes The Out Lap. Questions, requests and complaints go to hello@appie.ooo or through the support page.

02No accounts, no sign-in

There is no account to create and nothing to sign in to. The app never asks for your name, email address, phone number or payment details, and none of them reach us. You pick a driver, answer three questions about how you watch, and the season is yours.

03Subscriptions and the paywall

The Out Lap Pro is bought from Apple through the App Store. Apple takes the payment, holds your billing details and runs the subscription; Apple's privacy policy governs all of that. We are never shown your payment details - only whether a subscription is active.

The app uses the Superwall SDK to show its paywall and to receive purchase events. Superwall receives:

  • a device-generated identifier - a random ID created on your phone, not your Apple ID, name or email. Apple's "identifier for vendor" (IDFV), which is specific to our apps on your device, is also sent;
  • whether your subscription is active, the date the app was first installed, and a count of how many times the paywall has been shown - so it is not shown to a subscriber, and so it can be worded differently on a second look;
  • paywall and purchase events - the paywall was shown or dismissed, a purchase started, succeeded, failed or was restored;
  • basic device information - iOS version, device model, app version and locale;
  • your onboarding answers - the driver you picked, how you follow a season, your chosen rival and how much of the next round you said you would watch - stored as short labels against that identifier so the paywall can be worded around them.

Superwall does not receive your name, email address or payment details. Superwall is a United States company; its handling of this data is described in Superwall's privacy policy.

Our sub-processors, in full: Apple (payments, subscriptions, and notifications through Apple Push Notification service), Superwall (the paywall), Fly.io (the servers that hold season data, recordings and the push tokens in section 06), Cloudflare (this website, its contact form, and the front door to our servers), Google (the inbox that support email lands in), Open-Meteo (weather) and Apple Maps (the radar backdrop). None of them is given anything that names you, unless you choose to write to us (section 12). Each of them protects what it is given at least as well as this page promises, under its own published terms.

04What the app fetches

Season data - results, standings, calendars, session recordings - and the 3D circuits are downloaded from our own servers, hosted on Fly.io: relay.theoutlap.app, viewer.theoutlap.app and maps.theoutlap.app, which reach Fly.io through Cloudflare, and flive2.fly.dev and gridcast-live.fly.dev. Like any web request, a download carries your device's IP address, which appears in ordinary server logs. Those logs are kept briefly, to run and debug the service, and then discarded. Nothing else about you is attached to a download: no identifier, no account, no name. What the app sends us for notifications is in section 06.

05Track weather

The TRACK WEATHER widget asks Open-Meteo for the conditions at the next circuit. The request carries the circuit's coordinates - never yours; the app has no location permission and never asks for one - and, as any web request does, your IP address. Open-Meteo's data is licensed under CC BY 4.0, and its privacy policy is at open-meteo.com/en/terms. The map behind the numbers is an Apple Maps snapshot rendered by iOS on your device, to which Apple's Maps terms apply.

06Notifications and the lock-screen card

Race reminders are local. If you tap Remind me, the app asks iOS for permission and schedules a reminder on your device fifteen minutes before each upcoming qualifying, sprint and race, straight from the season calendar. Nothing about them is sent to us. Switch them off in the app at any time.

Everything else comes from our server, relay.theoutlap.app, through Apple Push Notification service: a card on your lock screen (a Live Activity) half an hour before each session, which follows the session live and ends on the result; an alert when a qualifying, sprint or race starts, and another when it finishes, saying where your driver ended up; and an alert when a session's replay is ready. To send them, the app gives our server:

  • push tokens - random strings Apple issues so that a server can reach this app on this phone: one for alerts, one that lets us start a lock-screen card, and, while a card is up, that card's own. A push token is not your Apple ID, your name, your phone number or anything else that names you;
  • the driver you follow - his car number, three-letter code and team colour - so the card shows him and an alert can say where he finished;
  • while a card is up, the session it belongs to - which session, the Grand Prix and the number of laps;
  • whether the app is an App Store build or a test build, which tells us which of Apple's two push servers to use.

Nothing else is stored with them: no name, no email, no IP address, and not the identifier Superwall holds. A new driver pick replaces the old one; no history of picks is kept. The server runs on Fly.io in London and keeps all this on an encrypted disk, which Fly.io backs up daily, keeping each backup for five days. Requests to the server pass through Cloudflare on the way. Apple sees each token and the words of each notification as it delivers them, under Apple's privacy policy.

How long we keep them: a card's token is deleted when the card ends, and never later than a few hours after its session. The alert token and the card-starting token are kept while the app is on your phone. Once the app is deleted, Apple tells us the token no longer works the next time we use it, and our server deletes it then. A token Apple keeps refusing is deleted too.

The app does not ask for notification permission on first launch. Instead it uses iOS's quiet ("provisional") permission: alerts land in Notification Center without a sound or a banner, each with Apple's own Keep and Turn Off buttons. Allow notifications from Remind me and they arrive as ordinary banners. Live Activities are on by default in iOS. Turn alerts off in Notification Center, or in iOS Settings under Notifications, The Out Lap; turn the lock-screen card off in iOS Settings under The Out Lap, Live Activities. iOS does not tell us when you do, so the tokens stay with us until the app is deleted, as above - but nothing more reaches your screen.

07What stays on your device

Your chosen driver, your onboarding answers, your widget settings and a cache of season data live on your device - in the app's own storage, and in its App Group container so the widgets can read them. We cannot see any of it, except the driver you follow, which also goes to our server with your push tokens (section 06). Delete the app and it all goes with it.

08What the app does not do

No location permission. No camera, no contacts. No advertising, no advertising identifier, no cross-app tracking - and no tracking prompt, because there is nothing to ask. No analytics beyond the Superwall paywall events in section 03. No cookies. The push tokens in section 06 send notifications and lock-screen cards and do nothing else: they are not used to track you or to advertise to you, and they are not sold.

09Children

The Out Lap is not directed at children and has no age gate. It collects nothing that names anyone, children included. If you think a child has sent us personal data by some route we have not imagined, tell us and we will delete it.

10The legal bases

Where any of the above counts as personal data under the UK GDPR or the EU GDPR - an IP address in a server log, a push token on our server, the identifier Superwall holds - we rely on two lawful bases: performance of a contract, to deliver the app and the subscription you asked for; and our legitimate interests in running, securing and pricing the service. Superwall and Fly.io are United States companies, so that data may be processed in the United States under the safeguards described in their own policies. Nothing here is used to make automated decisions with legal or similarly significant effects on you.

11Your rights

Under the UK GDPR and the GDPR you can ask to see the personal data we hold about you, have it corrected or erased, restrict or object to our use of it, take a copy of it, and complain to the Information Commissioner's Office (ico.org.uk) or to the authority where you live.

In practice: there is no account to close. The only things we hold are the push tokens and driver pick in section 06, stored with nothing that names you, so we cannot look yours up from a name or an email. Deleting the app removes everything it kept on your device, and its tokens leave our server as section 06 describes. Your subscription record is Apple's, managed from Settings under your name, then Subscriptions. The identifier and events Superwall holds are covered by Superwall's policy and its own contact details. Ask us anyway at hello@appie.ooo and we will answer within a month.

If you are in California: we do not sell personal information, and we do not share it for cross-context behavioural advertising.

12This website

This site sets no cookies and runs no analytics. It is served by Cloudflare, whose infrastructure logs requests the way any host does, under Cloudflare's privacy policy.

If you use the contact form, it sends what you type - your name, your email address, the topic and your message - together with the page you sent it from and the country Cloudflare sees the request coming from. Cloudflare passes it on as an email to our inbox, which is hosted by Google. We use it only to read your message and reply, keep it no longer than we need to help you, and you can ask us to delete it at any time. Writing to hello@appie.ooo directly works the same way.

13Changes

If the app starts doing something this page does not describe, this page changes first. The date at the top moves, and the current version always lives at theoutlap.app/privacy.

14Contact

David Overmeer, United Kingdom.
hello@appie.ooo, or the support page.