Privacy

Short, because there is not much to say. APEX has no accounts and sells nothing. It does measure which pages get used, and it asks first where the law requires it. The one thing worth reading carefully is what happens to what you type into the chat assistant.

What APEX does not do

• No advertising and no retargeting. Nothing here feeds an ad network: the analytics below runs with ad storage and ad personalisation switched off, so it measures use and cannot be used to follow you somewhere else.
• No accounts. There is nothing to sign up for and nothing to log into, so there is no profile to build.
• No selling or sharing of personal data. Analytics data is not sold, and Google Signals and ad personalisation are both switched off.

Analytics

APEX uses Google Analytics 4 to answer questions it otherwise cannot: which of these pages are actually used, whether people arrive on a phone or a desktop, and whether things like the race replay and the 3D circuit viewer are ever opened. This is a portfolio project with no accounts and no revenue, and until now it had no way of knowing whether any of it worked.

What is collected:

• Pages viewed and how long was spent on each, device type, browser, language, approximate location to city level (Google discards the IP address rather than storing it), and the link or search that brought you here.
• Eight specific interactions, by name: opening the Pitwall assistant, sending it a message, starting a race replay, showing a second-screen pairing code, opening a 3D circuit view, generating one, selecting a search result, and loading a page whose data failed to arrive.

The message count is recorded; the messages are not. Nothing you type — into the assistant or into the search box — is ever sent to Google. Nor is anything that could identify you: there are no accounts here, so there is no identity to attach. Analytics data is deleted after 14 months.

Consent, and why there is now a banner

Google Analytics sets a cookie named _ga. Unlike the rate-limiting cookie below, it is not strictly necessary, so it is not something to set without asking.

If your browser reports a timezone in the EU, the EEA or the UK, you are asked before anything is stored, and analytics stays switched off until you say yes. Ignoring the banner leaves it off. Everywhere else, analytics is on by default. That is a legal distinction rather than a judgement about who deserves privacy, and it seems better stated plainly here than hidden behind a banner nobody reads.

You can opt out anywhere in the world using your browser's cookie controls, by blocking googletagmanager.com, or with any content blocker — a substantial share of visitors already do, which means the numbers this produces are undercounts.

The other cookie

Using the Pitwall assistant sets a single cookie named f1_agent_sid. It is a signed random identifier, it expires after seven days, and it exists for one reason: rate limiting. Without it, everyone sharing an IP address — which on mobile networks can be thousands of people — shares one request allowance, and one heavy user exhausts it for everybody else.

It carries no profile, records nothing about you, and is useless to any other site. It is set only when you use the assistant, and it is the one cookie here you are not asked about: a strictly-necessary cookie does not require consent, and asking permission for something you cannot decline would be theatre. The analytics cookie above is a different matter, which is exactly why that one is asked about.

Stored in your browser only

Two things are kept locally and never sent anywhere: your display preferences on the Watch page (pinned drivers, density, timing mode), and a marker letting a watch session resume if you reload. Your answer to the analytics banner is kept the same way. Clearing site data in your browser removes all three — and, in the EU and UK, means you will be asked about analytics again.

Chat messages — the real disclosure

This is the part that actually matters. When you use the Pitwall assistant, what you type leaves this site and reaches four places:

Practical advice: do not type personal information into the chat. Messages containing card numbers, national ID numbers or phone numbers are rejected before they reach a model or a trace, but that filter is a safety net for obvious cases, not a guarantee.

Thumbs-up and thumbs-down votes, and any comment you attach to one, are stored so answers can be improved.

Requests your browser makes elsewhere

Loading APEX causes your browser to contact a few other hosts directly, which means those hosts see your IP address: Google Fonts (typefaces), OpenF1 (live timing on some pages), Wikimedia Commons (images), OpenTopoData (circuit elevation), Google Analytics (unless you have declined or blocked it), and Google Calendar only if you use an add-to-calendar link. Where those come from is described on data sources.

Retention

Rate-limiting records expire automatically. The session cookie expires after seven days. Analytics data is deleted after 14 months, which is the longest Google Analytics allows. Conversation threads are currently kept without a fixed expiry — if you want one removed, ask via GitHub Issues, though note that an issue is public, so do not quote anything private in it.

This is a personal project

APEX is built and run by one person, on free service tiers, with no company behind it. It is not a commercial service, and it should not be treated as one. Anything you send to the assistant should be something you would be comfortable being processed by the third parties named above.