Privacy Policy

1. Data controller

SmoothOperator is a project developed by Geneon. The personal data collected is processed for the sole purpose of providing the functionality described on the platform. For any privacy matter you can contact us through our website or our Discord server.

2. Data we collect

We process the following data:

• Account: your email address and, if you sign in with Google, your public name and profile picture.
• Waitlist: if you join, your email, the date, the language of the page, the page through which you entered the website, the campaign or website that brought you (the utm_ parameters and the domain of the previous page, without its path) and the code of the invite link you arrived with, if any; plus a code of your own to invite others, a secret link to see your place, when you confirmed your email and a fingerprint of your IP address calculated with a key that changes every day (we do not store the IP), used to limit sign-ups from the same network and so that invitations from your own network do not count. The channel is kept in your browser (this website's local storage, no third parties) for 30 days from your first visit. We use it to tell you about your access, to order the queue and to know which channels bring us drivers. It is deleted if you ask us by writing to us or replying to any of our emails.
• Subscription: plan, status, licence key and a Stripe customer identifier. Stripe handles your card details; we never see or store them.
• AI usage: counters of AI calls (daily and monthly) to apply the limits of your plan, and a record of each call that goes through our gateway: when, of what type (text, synthesised voice, speech recognition or Gemini Live), how much it deducts from your allowance, how many tokens it used and how long it took. Without anything of what was said in it.
• Technical: your IP address, used at the time of the request for security and to limit the number of requests (rate limiting).
• Simulator telemetry: the driving data the sim exposes during your session. Detailed in section 3.
• Microphone audio: when you speak to the engineer over the radio. In addition, while the engineer is speaking, the microphone opens to detect whether you interrupt, without recording or sending anything. Detailed in section 4.
• Images of your screen: only if you turn on the incident steward or the Gemini Live screen-sharing option (up to 1.2.4), or if the live dashboard streams your dashcam. Detailed in sections 5 and 8.
• Product analytics: an installation identifier, a heartbeat every 30 seconds while the application is open, and the steps you complete in the welcome wizard. If you have signed in, they are linked to your account and your email. You can turn it off, except if you use the free beta (section 6). Detailed in section 6.
• Summary of each driving session: a row with the simulator, the circuit, the car, the laps one by one (times, fuel, tyres), the final position and the pit stops. Detailed in section 6.
• Your conversation with the engineer, only if you turn it on: the text of what was said over the radio in each session. It is off by default, except in the free beta, where it is mandatory. Detailed in section 6.
• Engineer messages you flag as incorrect, only if you do it yourself: the message, the category you choose and its context. Detailed in section 6.
• Voice report of a radio line: when you tell the engineer that it got something wrong, that line, your objection, about ten surrounding radio lines and a snapshot of the telemetry at that moment. Only if you ask for it. Detailed in section 6.
• Notes, bugs, suggestions and session rating: when you say “note this down”, “report a bug” or make a suggestion, or give a rating from 1 to 5 to one of your first three sessions: what you dictate, about ten recent radio lines and a snapshot of the telemetry at that moment. Only if you ask for it or answer. Detailed in section 6.
• Shared circuit layouts: the drawing of the track that the application learns as you drive, without times or telemetry. Detailed in section 6.
• Answers to the beta questionnaire: what you answer and a snapshot of how you were using the application when you answered. Detailed in section 6.
• Engineer memory: your driving mistakes, with the lap and the point on the track. The record stays on your computer. Detailed in section 7.
• Records, progress and what is learned from your driving: your best laps by simulator, circuit and car, the best lap of each session to count your streak, what the application learns from one session to start the next (consumption, pace, tyre life), the trace of your best clean lap and how much you lose in each corner session after session, and the GT7 circuits it recognises. They stay on your computer. Detailed in section 7.
• Setups, iRacing history and force feedback: the setups you try and what you drove with each one, your iRating and incidents per iRacing session, and the steering wheel force you had in each car. They stay on your computer. Detailed in section 7.
• Race logbook and diagnostic log: two files that the application writes on your computer. The first keeps what is said over the radio; the second, only times and codes, without anything of what was said. Detailed in section 7.
• Session and licence: your email, the token that keeps your session open and your licence key, stored encrypted on your own computer. Detailed in section 7.
• Local recordings: if you press the dashcam record button or turn on its automatic recording, the session video, its telemetry and its radio messages are kept as files on your own computer; and while “Record every session automatically” is on, which it is by default, each driving session is recorded on its own, without video. They are not uploaded anywhere. Detailed in section 5.
• The phone bridge (“Use your phone as the radio”): on Windows it is on by default. While it is on, the application announces this PC on your local network every two seconds, with the name of your computer and, if you have signed in, a fingerprint of your account; once signed in, a random key for your account is also created in our database so that the phone can pair with it; and to the phone you pair, it sends your telemetry and what the engineer knows about you. Detailed in section 8.

The distinction that matters most is between what leaves your computer and what does not. What leaves: the telemetry and the voice you send to the engineer (sections 3 and 4), the frames you ask to have analysed (section 5), the analytics and the summary of your sessions, your answers to the beta questionnaire, the layout of the circuits you have learned, the report of a radio line only when you ask for it by voice, the engineer messages you decide to report as incorrect (section 6) and —only if you turn it on— the text of your conversation with the engineer (section 6); and, if you turn on OpenClaw, what you delegate to it leaves through your OpenClaw to the services you have connected in it (section 3). What does not leave: the engineer memory, your records and what is learned from your driving, your setups, your iRacing history, your saved session, the session and dashcam recordings, the race logbook and the diagnostic log (section 7), except for the parts of the memory, the setups and the history that enter the context sent to the AI (sections 3 and 7) and what, with the bridge on, is sent to the phone you pair (section 8). The live dashboard, the LAN pairing and the phone bridge are a separate case (section 8): the first two only work if you turn them on yourself; the bridge, on Windows, is on by default.

3. Telemetry and artificial intelligence

Simulator telemetry is processed mainly on your device. It comprises the data the sim itself exposes during the session: speed and engine revs, track position and standings, your inputs as a driver (throttle, brake, clutch, steering and gears), tyre and fuel status, car damage, lap times and the relative position of the surrounding cars. It describes how you drive inside the simulator; it is not information about your life outside it.

When you use the AI engineer, fragments of that context —relevant telemetry, your voice and your radio messages— are sent to AI providers —Google (Gemini, as well as speech synthesis and recognition)— to generate the answers. This data is transmitted solely to produce the answer and is not used to profile you.

From 1.3 the application no longer offers the setting for entering your own keys; the ones you saved in 1.2.4 or earlier continue to be used as explained here. If you use your own Google key (“Power User / BYOK” mode), not everything goes directly. The reasoning —and, in 1.2.4 or earlier, Gemini Live— does go from your computer to Google without passing through our infrastructure, with one exception in the reasoning: if your key runs out of quota and there is a signed-in session or an activated licence, that request is repeated through our gateway. Synthesised voice and speech recognition, by contrast, go through our gateway as soon as there is a signed-in session or an activated licence, even if you have your key; they only go directly to Google with it if there is neither. Up to 1.2.4 you could also enter your own ElevenLabs key: with it, the text of the phrases synthesised on the spot was sent to ElevenLabs, on your account and under their terms. From 1.3 the application no longer uses ElevenLabs: it does not read the key you may have saved nor send anything to it.

Since 1.3 the engineer’s voice is, by default, a local voice (the voices marked “LOCAL” in Settings → Voices). With it, the engineer’s phrases are synthesised on your own computer, with an engine that runs in a separate process: the text of those phrases does not leave your computer to be turned into voice. A new installation starts with the local voice for your language. If you already used the application and had not chosen a voice by hand, 1.3 prepares the local voice for your language in the background and only switches to it when it has been fully downloaded and checked; until then the previous one keeps sounding. If you had chosen a voice by hand, it is respected. You can choose a network voice again in Settings → Voices. If the local engine fails with a phrase, with a paid plan that phrase is synthesised over the network like any other (above), with a different voice; without a paid plan, a pre-recorded notice sounds or nothing sounds. To use it, the application downloads the engine, the voice and its pre-recorded notices: the engine, the notices and the samples for listening to each voice, from our storage on Supabase; the voice model, from the public releases of the sherpa-onnx project on GitHub. Those downloads carry no data of yours; as with any download, the server that serves it sees your IP address.

Something similar happens with OpenClaw, a third-party assistant that you have to install yourself and that the application ships turned off. If you turn it on (section 9), whatever you ask over the radio that is not about the race and that the application cannot do by itself —sending or reading a message, looking something up— is handed to your OpenClaw, which resolves it with the AI provider and the services you have connected in it (WhatsApp, Telegram…), on your account and under their terms; if you use your own Google key, the application passes it on for it to use. What OpenClaw answers —a message it reads out to you, for example— appears in the panel, is turned into voice by the same route as any other phrase (above) if it still arrives in time to be spoken, and, outside Gemini Live mode, stays in the recent conversation that accompanies your next questions to the engineer.

4. Microphone and voice

These are the cases in which your microphone opens. You decide those that send audio out of your computer, by pressing or turning something on. The last one is automatic, but it does not record or send anything.

• Voice questions (push-to-talk): audio is recorded from when you press the talk button until you release it —or, if you have it set to press once, until you press it again—, plus a few tenths of a second so as not to cut off your last syllable. That fragment is sent to Google’s speech recognition service: through our gateway if you have signed in or have an activated licence, even if you also use your own key, and directly from your computer with your key only if there is neither. What comes back is the text transcription. The audio is not stored on our servers; neither is the transcription, and in this mode it does not go to the race logbook either (section 7). So that the next question does not lose its first word, when you release the button the microphone stays open for about 30 seconds without recording or listening to anything —Windows shows it meanwhile as a microphone in use— and then closes by itself. In 1.2.4 it closes on release, without those tenths of a second or those 30 seconds.
• Gemini Live mode, only up to version 1.2.4: from the next version it is not available. In 1.2.4 and earlier it was also push-to-talk: the microphone opened when you pressed the radio button and closed when you released it (or when you pressed it again, as above); with the session open and without pressing, nothing was captured. What you said in the meantime travelled directly from your desktop to Google over a connection of its own: it did not pass through our servers and we neither saw it nor stored it. With a subscription, our gateway only handed over the permission to open that connection and counted the minutes.
• Voice activation (“Engineer”), only up to version 1.2.4: this is the one worth reading in full. From the next version it can no longer be turned on, and if you had it on the application turns it off at start-up. In 1.2.4 and earlier it came off, and while it was off absolutely nothing was captured. If you turned it on in Settings → Audio, the microphone stayed open for as long as the application was running and the application continuously measured the sound level of the room. That measurement did not leave your computer, but every time the level exceeded the threshold —whether you spoke, someone else spoke, or the TV was on— about 1.6 seconds were recorded and sent to Google to be transcribed, by the same route as a voice question. The keyword (“Engineer”; “radio” and “engineer” also worked) was checked after transcribing, not before sending: that is, audio was sent even if you had not said it. If the transcription did not contain it, it was discarded there and then and nothing else happened.
• While the engineer speaks: outside the Gemini Live mode of 1.2.4 or earlier, while a phrase from the engineer is playing the application opens the microphone to detect whether you start to speak and, if so, to silence it instantly. This happens on its own, without you turning it on. It only measures the sound level, on your computer: it does not record, transcribe or send anything, and the microphone closes when the engineer finishes. While it is open, Windows shows it as a microphone in use.

If you do not speak to the engineer over the radio —nor, in 1.2.4 or earlier, have voice activation turned on—, no audio leaves your computer from the microphone at any time. The audio from your microphone is not stored as a file on your computer in any of these cases. What does remain on your computer, as text, is the transcription of what the microphone picks up when you speak to the engineer in the Gemini Live mode of 1.2.4 or earlier —which is not always only your voice—: it goes to the race logbook (section 7).

5. Screen capture (incident steward)

The incident steward judges a contact from images of your screen. It is important that you know this clearly: what is captured is the entire primary monitor, not just the simulator window. If you have an email, a chat or a browser tab in view, they will end up in the frame. That is why the feature is built with these three rules:

• Off by default. As long as you do not turn it on yourself, not a single frame is captured or stored.
• The steward does not touch the disk. With the feature on, the application keeps in memory a rolling window of about twelve seconds so that it can reconstruct the incident. It lives in RAM, is erased when you turn the switch off and disappears when you close the application. The steward leaves no capture files that a backup could pick up; the dashcam recording is something else and does write a file, as we explain just below.
• Nothing leaves without you seeing it. Frames are only sent when you ask for a verdict, and after the panel has shown them to you. In each analysis, at most six JPEG frames are sent to Google, which returns a verdict in text. Neither the frames nor the verdict are kept in our systems.

Up to version 1.2.4, Gemini Live mode also included an option to share the screen with the model during the session, in Settings → Advanced. It came turned off and the same warning applied to it: it captures the entire primary monitor while it is active. With one important difference from the steward — when on, it sends a frame every few seconds (by default, every five) throughout the session, not only when you ask something. From the next version it can no longer be turned on, and if you had it on the application turns it off at start-up.

Apart from the steward, there are three ways for the application to record on your computer. The two for the dashcam come turned off; the third comes turned on. The first, the dashcam record button: if you press it, that session is saved as a video file in the application’s data folder, together with its telemetry and its radio messages. The second, the dashcam’s automatic recording (in the dashcam panel): if you turn it on, it starts recording the screen by itself when it detects the simulator and stops when it loses it; like the button, it captures the entire primary monitor, with the warning above, and it can also save the system audio alongside the video if you turn that on separately. The third, “Record every session automatically” (Settings → General), is on by default, also when updating: 1.3 turns it on once and, from then on, respects whatever you choose. While it is on, each driving session is recorded on its own —telemetry and radio messages, without video— so that you can relive it at the end with “Save” or “Discard”. That recording waits as a temporary file on your computer; there is only one at a time, it is deleted if you start another session without saving it, and very short sessions are discarded automatically. If you save it, it remains like any other session of yours. All these recordings are yours and stay on your computer: they are not uploaded anywhere, we do not see them, and they are deleted like any other file (the unsaved temporary recording, in addition, with “Delete local memory”, section 7).

6. What leaves your computer and is stored

We measure how the application is used to know what to fix. This is what leaves your computer and is stored in our database:

• Installation identifier and heartbeat. The first time you open the application a random identifier is generated, stored on your computer and reused on all subsequent launches: it is not a single-session datum, it identifies your installation on a continuing basis. While the application is open, every 30 seconds a heartbeat with that identifier, the screen you are on and the system the application runs on (Windows, Android, iOS…) is sent to our server. If you have signed in, the heartbeat also carries your user identifier and your email address. It is stored as one row per installation, which each heartbeat overwrites.
• Welcome funnel. Each step of the first-time wizard —that it was shown, that you pressed listen, that you got to hear the engineer, that you finished it or that you closed it halfway— is recorded as an event, with the same identifier and, if there is a session, your user identifier and your email. Here one row per event is stored. It serves to see at which step people get stuck.
• Audio counters. How many engineer phrases have sounded and where they came from: pre-recorded clip, synthesised voice or Gemini Live. They are accumulated totals, without anything of what was said. They travel attached to the heartbeat.
• One row per driving session. When a session ends —you change circuit, car or close the simulator— a summary is uploaded: simulator, circuit, car, session type, laps completed, your best and average time, duration, final position and number of cars, tyre compounds, fuel used, pit stops, how many times the engineer spoke and how many events it detected during the session, the system the application runs on and its version. And, for each lap, whatever your simulator publishes: the time and the splits, whether it was valid, the fuel at the end of it and the fuel used, your position, the compound, whether you pitted, and the average temperature and wear of each tyre. It is tied to your account, so it is only uploaded if you have signed in; without an account nothing is uploaded. Sessions of less than one lap and less than five minutes are discarded. What you say to the engineer does not travel in that row: sending it is a separate option, off by default, explained below.

You can turn off all of the above from Settings → Privacy, with the “Share usage analytics” switch. When off, the heartbeat, the audio counters, the wizard events and the summary of your driving sessions stop leaving your computer. The change applies the moment you press it, without having to save or restart. It does not affect the engineer: the telemetry and the voice you send when you speak to it keep working the same, because without them it cannot answer you.

With those rows and with the log of AI calls (section 2) we see how much each account uses the application: the session hours of each day and in which simulator, and how much AI it spends. We see it, in an internal panel; it is not published or shared.

What is worth knowing: these rows persist and do not yet have an automatic deletion period. You can delete them yourself whenever you want (section 11).

Apart from the application, the website records each click on the download button: the version and the link of the file you take, the system it is for, the browser and operating system you do it from, the page you click from, where you came from and a random identifier that your browser stores and reuses on each visit; if you were signed in, your user identifier and your email are also stored. This happens on the website, so the switch above —which lives in the application— does not turn it off; what you can do is remove what identifies you from it (section 11).

The website also measures its visits in two ways. With Vercel Web Analytics, which does not use cookies: it counts which pages are viewed, from which country, with what type of device and browser and from which website you arrive, and to tell visits apart it uses a value calculated from the request itself that is discarded every day and cannot be used to follow you between sites. Of the page address, only the campaign parameters (those that begin with utm_) are sent; any other is removed beforehand. And with a heartbeat of its own: while you have the website open, every 30 seconds the random identifier of your browser, the page you are on and, if you have signed in, your user identifier, but not your email, are sent. The team’s internal pages are not measured.

Your conversation with the engineer, only if you turn it on

This is different from everything above and is covered separately. It comes off, and while it is off your conversation does not leave your computer. It is turned on in Settings → Privacy, with its own switch: having analytics turned on does not turn it on. If you turn it on, this is what happens:

• What is sent. When each driving session ends, the text that the race logbook (section 7) has stored for that session is uploaded: each phrase the engineer said to you, with its time and the route by which it came out (pre-recorded clip, synthesised voice or Gemini Live); in Gemini Live mode, also the transcription of what you said to it; and, alongside each line, a snapshot of the telemetry at that instant (where the car was, brake, tyre temperature, fuel, damage). With it go the simulator, the circuit, the car, the time the session started and the version of the application. At most 200 KB per session. No audio is sent.
• What to know before turning it on. The transcription picks up everything the microphone captures while it is open to speak to the engineer, whether or not it is about the race, and it does not distinguish voices: if at that moment another person speaks near you or something in the background that sounds like speech —the TV, a call— is playing, it is also transcribed and recorded as if you had said it, and with sending turned on it would travel with the rest. If you do not drive alone in the room, bear this in mind before turning it on. And if you ask it over the radio for things that are not about the race —for example, to read you a message—, its answer is also stored in the logbook and would travel with it.
• What for. To review what the engineer said, when and with what data in front of it, and to correct what it said wrongly or at the wrong time. It is the most direct way we have to improve the product with real races.
• Who sees it. It is stored in our database tied to your account, so it is only sent if you have signed in: to turn the switch on you must be signed in, and your “yes” is valid only for the account with which you turned it on. If another account signs in on the same computer, the switch appears off for it and nothing is sent in its name until it turns it on itself. Only the SmoothOperator team can read it, from an internal panel: neither other users nor you yourself can read it from the application or the website.
• Queue on your computer. When the session ends, the conversation is first stored in a tray on your computer and sent from there. If there is no connection, it is retried when another session ends and each time you sign in, with a maximum of 5 attempts per conversation; one that has been waiting for more than 14 days is discarded, and the tray holds at most 30 (if there are more, the oldest is thrown away). When you close the application it is only stored in the tray, not sent.
• How it is stopped and how it is deleted. Turning the switch off stops sending from that moment and empties the tray on your computer; what had already been sent is not deleted by turning it off. To delete it there is the “Delete my server data” button (section 11). Like the rest of the rows in this section, it does not yet have an automatic deletion period.

In the free beta, sending analytics and conversation is mandatory

The above (the analytics you can turn off and the conversation that comes turned off) applies to those with a paid plan. If you use the application without paying, within the free beta —with a courtesy beta licence or none—, sending usage analytics and your conversation with the engineer is a condition of the beta:

• How you accept it. The application explains it to you in a notice with a box you must tick (“I understand and accept that, while I use the free beta, my usage analytics and my conversation with the engineer are always sent”). It is stored on your account with the date (the server’s) and the version of the text you accepted. Until you accept, the application does not force anything on you: it sends whatever you have set in Settings → Privacy.
• What changes. Once accepted, the two switches in Settings → Privacy appear turned on and cannot be turned off as long as your account does not have a paid plan. What is sent is exactly what is described in this section —the analytics and, when each session ends, the text of the conversation with its telemetry snapshot, without audio and with your account—, with the same warnings (the transcription does not distinguish voices).
• If you move to a paid plan. The switches become yours again, with their usual value: analytics on unless you turn it off, and conversation off unless you turn it on.
• Your rights do not change. You can ask for what has already been sent to be deleted with “Delete my server data” (section 11) and stop using the beta whenever you want. If you do not accept the notice, sending is not forced on you, but the free beta is granted on that condition.

When you flag an engineer message as incorrect

Each engineer message in the radio panel has a button to tell us it was wrong. It is a gesture of yours, message by message: nothing is sent if you do not press it, and it has no switch because it does not work on its own. This is what happens when you use it:

• What is sent. The category you choose (false data, wrong language, inopportune moment, repetitive, inappropriate tone, cannot be understood or sounds bad, other), the text you write if you want to add something, and the text of the message you report. With it go the type of notice that originated it, the route by which it came out (pre-recorded clip, synthesised voice, Gemini Live or local voice), the time it sounded, the language and the engineer personality you had set, the simulator, the circuit, the car, the session mode, the application version and a small snapshot of the telemetry at that instant (speed, gear, position, lap, flags, wheels off track, whether you were in the pits, brake, throttle, lateral force, whether there was a car alongside, fuel and damage). No audio is sent, nor the rest of the conversation, nor the names of other drivers.
• In whose name. If you are signed in, the report is tied to your account. If not, it is sent anonymously: without an account, without an email and without your licence key, with a random identifier of this installation that serves only to limit the number of reports a single computer can send and to be able to delete them if you ask. The form tells you which of the two will happen before sending. It is decided when you report: an anonymous report remains anonymous even if you sign in later.
• What for. To know which phrases or notices fail, in what situations and with what data in front of them, and to correct them. Nothing more: it is not used for advertising nor shared with third parties.
• Who sees it. Only the SmoothOperator team can read it, from an internal panel. It is stored in our database; neither other users nor you yourself can read it from the application or the website.
• If there is no connection. The report waits on your computer, in the application’s data folder, until it can be sent (at most 14 days and 5 attempts).
• How it is deleted and how long it is kept. “Delete local memory” (Settings → Privacy) deletes those still waiting to be sent and the installation identifier. “Delete my server data” deletes those you sent with your account and the anonymous ones sent from this installation. They have no automatic deletion period: we keep them as long as they are useful for improving the engineer and delete them when they stop being useful, and whenever you delete your data or your account. You can also ask us to delete one by writing to us.

When you tell the engineer it got something wrong

If you say something like “what you just said is wrong” by voice, the application understands which radio line you mean and sends it for review, so that we can correct the engineer. It is an act of yours, not automatic: it only happens when you say it to it, and it does not depend on the conversation switch or the analytics switch. If it is not clear which line you are talking about, it asks you and, when in doubt, sends nothing.

• What is sent. The line you report (its text, what type of notice it was and what time it sounded); your objection, that is, what you said, already transcribed; about ten surrounding radio lines (those that sounded just before and just after, with what you asked in between, if you did); and a snapshot of the telemetry at the moment the line sounded: speed, gear, position, lap and point in the lap, flag, safety car, wheels off track, whether you were in the pits, brake, throttle, lateral force, whether there was a car on either side, fuel, damage and session phase. With it go the simulator, the circuit, the car, the session mode, the language, the engineer personality and the application version. Never the whole session nor audio.
• What for. To review what the engineer said, with what data in front of it, and to correct what was said wrongly.
• To whom it is tied. To your account, so it requires that you have signed in. If you are not signed in when you report, the report waits in a tray on your computer and goes out when you sign in (with a few retries; if it cannot be sent within a few days, it is discarded). Only the SmoothOperator team can read it, from an internal panel: neither other users nor you yourself can read it again from the application or the website.
• How it is deleted. Reports already sent are deleted with the “Delete my server data” button (section 11), and those still waiting to go out, with “Delete local memory” (section 7). They do not yet have an automatic deletion period.

When you leave the engineer a note or rate a session

If you say by voice “note this down”, “report a bug” or a suggestion, or you answer the question it asks you at the end of each of your first three sessions (“what rating do you give this session?”, from one to five, with an optional comment, by speaking or with a tap on the end-of-session card), the application sends it to the team. It is an act of yours, not automatic: it only happens when you ask for it or answer, it does not depend on the conversation switch or the analytics switch, and a loose number said outside that question sends nothing. Each time, the engineer tells you what it has sent and with which account.

• What is sent. What you dictated, already transcribed (or your rating from 1 to 5 and your comment); about ten recent radio lines from the session, with what you said in between; and a snapshot of the telemetry at that instant: speed, gear, position, lap and point in the lap, flag, safety car, wheels off track, whether you were in the pits, brake, throttle, lateral force, whether there was a car on either side, fuel, damage and session phase. With it go the simulator, the circuit, the car, the session mode, the language, the engineer personality and the application version. Never the whole session nor audio.
• What for. To know what fails and what you think of the product, with the data in front of us.
• To whom it is tied. To your account: without a signed-in session, it stays in a tray on your computer and goes out when you sign in (with a few retries; if it cannot be sent within a few days, it is discarded). Only the SmoothOperator team can read it, from an internal panel. It shares a table with the radio line reports above.
• How it is deleted. What has already been sent, with “Delete my server data” (section 11); what was still waiting to go out, with “Delete local memory” (section 7). It does not yet have an automatic deletion period.

Circuit layouts that are shared

The application learns the drawing of each circuit as you drive. So that you do not have to learn it again if you reinstall or change computer, and so that other drivers have a map from the first lap, that drawing is also stored in our database.

• What is sent. The line of the track: a sequence of between 80 and 600 points (position on the plane and, if the simulator provides it, the height), the simulator, the name and length of the circuit, the number of consecutive clean laps that back it (at least three, without crashes, off-track excursions or going through the pits) and the application version. It carries no times, speeds, your mistakes or telemetry from your laps.
• To whom it is tied and who sees it. One row per account and circuit is stored, tied to your account, and for that reason it is only uploaded if you have signed in. Other drivers receive only a consensus layout, without any data about who contributed it; you recover yours when you reinstall. The SmoothOperator team can see it from an internal panel.
• How it is stopped and how it is deleted. It depends on the same switch as analytics, “Share usage analytics” (Settings → Privacy): when off, it stops being uploaded. What has already been sent is deleted with “Delete my server data” (section 11); if another driver had already downloaded that layout to their computer, that copy cannot be recalled. It does not yet have an automatic deletion period.

The beta questionnaire

While the beta lasts, when you have been using the application with your account for a while we ask you to answer a questionnaire, and until you answer it the application stays locked and the engineer does not speak. We store your answers tied to your account, the application version and the date, together with a snapshot of how you were using the application when you answered, taken from the data in this section and from your account: how many sessions and minutes you have, in which simulators, how many times the engineer speaks and how many notices it detects per session, how many AI calls you have made and how long they take, your plan and whether your licence is a courtesy one, the simulator and the level you declared, the engineer personality you use and how many days have passed since you activated the licence and until your first session. It serves to know what to fix first, by cross-referencing what you tell us with what has been measured. An answer cannot be edited afterwards, and it is deleted with the same “Delete my server data” button (section 11).

7. What stays on your computer

This data is not stored on any server of ours, with a single exception that you decide: sending your conversation with the engineer (section 6). Some of it does travel, in part, within the context sent to the AI so that it can answer you (section 3); it says so for each one. And, if you pair a phone with the bridge, part of it also travels to that phone over your local network (section 8). We list it all anyway because it remains yours and because you should know that it exists.

• The engineer memory. So that the next time you return to the same circuit it can tell you “last time you went off here”, the application notes your driving mistakes —spins, lock-ups, off-track excursions, heavy impacts, punctures, penalties— with the lap on which they happened and the point on the track (the percentage of the lap, or the sector if the simulator gives no more). It keeps the twelve most recent for each combination of simulator, circuit and car. Separately, a driver profile keeps count of how often you make each type of mistake. Both records live in separate files inside the application’s data folder, in your Windows profile, and are not sent to any server of ours. You should know that, when a session starts, a summary of the three most recent incidents is included in the context sent to the AI, like the rest of what is explained in section 3; and that, when the profile has already seen a mistake you clearly repeat, a line with that mistake and how many times you have made it goes into the context of each query to the model.
• Your records and what the application learns from your driving. To alert you to a record, tell you your streak and start each session knowing something, the application keeps in files on your computer, by simulator, circuit and car: your best lap ever (pb_records.json); the best valid lap of each session (progreso.json); what it learned from the previous session, such as average fuel consumption, base pace and laps each compound did (arranque_en_caliente.json); the trace of your best clean lap, so that the coach compares against it (trazas_coach.json); how much each corner costs you session after session (historial_curvas.json); and, in GT7, which circuit each one you have driven is, recognised by the shape of the lap (gt7_circuitos.json). They are not sent to any server of ours, but what was learned from the previous session may enter the context sent to the AI, always presented as data from another session (section 3).
• Your setups, your iRacing history and your force feedback (from the version after 1.2.4). The application remembers the setups you try in each combination of simulator, circuit and car, with the clean laps you did with each one and the track temperature; in iRacing, in addition, your iRating and your licence at the start of each session, your incidents, your laps, the time driven and with which setup, and the maximum steering wheel force you had in each car and circuit. They live in files inside the application’s data folder and are not sent to any server of ours, but parts of them enter the context sent to the AI, like the rest of section 3: with iRacing open, each query to the model carries a line with your latest starting iRatings, your average incidents per lap and how long you have driven in recent hours; up to 1.2.4, in Gemini Live the name of the setup you had on, with its best lap, and that of the others you had tried at that circuit also went along; and the detail of your setups or your history goes when you ask about them.
• Your session and your licence. So as not to ask you for your password at every start-up, in another folder of your Windows profile —the configuration one, not the data one used above— your email, the token that renews the session and your licence key are stored. They are encrypted with the Windows system (DPAPI) and tied to your user account, so copying those files to another computer or another profile is of no use. If encryption were not available, they are not stored in plain text: you will simply have to sign in again.
• Dashcam and session recordings. Those of the dashcam, only if you press the record button or turn on its automatic recording; those of each session, while “Record every session automatically” (Settings → General) is on, which it is by default. See section 5. The automatically recorded session waiting for “Save” or “Discard” lives in the “sessions/pendiente” subfolder of the data folder.
• The race logbook. To be able to review afterwards what the engineer said and whether it was right, the application notes each phrase it says to you, with its time, the route by which it came out (pre-recorded clip, synthesised voice, Gemini Live or text only) and a snapshot of the telemetry at that instant. In Gemini Live mode it also notes the transcription of what the microphone picks up when you speak to it: normally it is what you say, but if at that moment another person speaks nearby or something in the background that sounds like speech is playing, it is also noted, and as if it were yours. And if you ask it over the radio for things that are not about the race —to read you a message, for example—, its answers are also noted. It stores no audio. It is written as text files (carrera-….txt, one each time you open the application) in the “conversaciones” subfolder of the application’s data folder, in your Windows profile, and they are not deleted on their own. It is not uploaded anywhere, unless you turn on sending your conversation (section 6). Message reports waiting to be sent are stored in another folder (“reportes_pendientes”) of the same data folder, and the conversation waiting to be sent (if you turned on its sending), in a tray of its own.
• The diagnostic log. To be able to find out why the engineer is slow to respond or does not sound, the application notes, in the “diagnostico” subfolder of its local data folder, when the engineer spoke, what type of notice it was, by which route it came out, how long each step took, the result of each call to our servers and when the simulator connects and disconnects. These are times, counters and codes: it does not contain the text of what you say or of what the engineer says, and the application is built so that it cannot contain it. It takes up at most two files of 2 MB, which are replaced over time. It is not sent anywhere: it only reaches us if one day you decide to send it to us so that we can investigate a fault. Settings → Advanced → “Diagnostic log” opens its folder.

The engineer memory, the driver profile, your setups, your iRacing history, your force feedback, your records and what is learned from your driving (progress, warm start, coach traces and corner history, GT7 circuits), the automatically recorded session waiting for “Save” or “Discard” and the race logbook —together with the conversation waiting to be sent, if you turned on its sending, the message and radio reports waiting to be sent and the anonymous identifier of this installation— are deleted from Settings → Privacy, with the “Delete local memory” button. The button asks for confirmation and lists what disappears before doing anything; it is irreversible and there is no backup. It deletes the files on disk and, at the same time, whatever the application has loaded in memory — which is what is needed so that they are not rewritten on their own on the next lap. In version 1.2.4 that button only deletes the engineer memory and the driver profile.

That button does not sign you out nor touch your licence key: you remain signed in and keep your plan. Nor does it delete your settings, the dashcam recordings, or the sessions you saved with a name, which are files you created and are removed from their folder. Nor the diagnostic log, which is removed by deleting the files in its folder; in 1.2.4, nor the race logbook, which is then deleted the same way. The saved session does disappear from disk if you sign out, which is a different action.

8. Live sharing and local network

These are three different features, and all three make your data leave the application while they are on. The first two come turned off by default; the third, the phone bridge, comes turned on on Windows.

• Live dashboard (Remote Viewer). It is turned on in Settings → Advanced → Remote Viewer, with the “Stream the session” switch, and only works if you have signed in with your account: without a signed-in session nothing is streamed, even if the switch is on. When on, your telemetry (up to twice per second), the radio messages —text and audio—, your laps, the circuit layout and the arrangement of your panels are broadcast in real time through Supabase Realtime, on servers in the European Union (Ireland), to anyone who opens your link; that broadcast is not stored in our database. If you have the dashcam running and the viewer opens their panel, the dashcam video —the camera, window or screen you are capturing— reaches them directly from your computer, without passing through our servers: to connect, the two computers exchange their network addresses over that same channel and query Google’s public STUN servers, which see your IP address. The link uses an opaque, rotatable token instead of your licence key: the “viewer_token” of your licence, which you can invalidate from your account, or, if you have no licence, a random one that the application stores and can rotate. Sharing the link is your responsibility: anyone who has it will be able to see your session while it is active. To stop streaming, turn the switch off. In 1.2.3 and 1.2.4 this switch also worked without an account; what was turned on then is not valid for 1.3: the application turns it off at start-up and, if you want to stream, you have to turn it on again yourself.
• LAN pairing. It needs no account and does not go through our servers. The application starts two local servers that serve your telemetry and your radio history, designed so that you can view them from your phone. By default they only listen on your own computer and no other device can connect. If you turn it on in Settings → Advanced and restart, they start listening on your whole local network: any device connected to the same network can request that data, although it needs the pairing code that the screen itself shows you, which changes every time the application is restarted. That screen also shows a QR code with a link that already carries that code, to open the viewer in the browser of a phone connected to the same WiFi network: anyone who has that link or that code can read your data from your network. Within your network the connection goes over http, unencrypted. It does not leave your network — nothing is sent to the internet by this route — but it does leave your computer.
• Use your phone as the radio (the bridge). It lets the engineer talk to you in the phone app while you drive a simulator on this PC: the PC passes to the phone what it reads from the simulator and the engineer works there. It only exists on Windows, and there it comes turned on by default, also when updating: 1.3 turns it on once and, from then on, respects whatever you choose. It needs no account. While it is on, whether or not you connect a phone, two things happen. The application waits for connections from your whole local network, on a port of its own (which is why Windows may ask you about the firewall). And every two seconds it announces this PC to the whole local network it is connected to —your home one, but also a hotel or university wifi— so that the phone can find it on its own. The announcement carries the name of your computer in Windows and, if you have signed in to the application, a fingerprint of your account: sixteen characters derived from a key of your account, which do not say who you are nor serve to obtain that key, but which are the same on all your PCs and on any network, so they make it possible to recognise that two announcements come from the same account. The fingerprint changes if you change that key, which is done from the phone app. The key is 24 random bytes: when you sign in with the bridge on, the application requests it from our server, which creates it the first time and stores it in our database tied to your account; it is deleted when your account is closed, not with “Delete my server data”. No device on your network receives anything more if it does not pair: it has to prove that it knows this PC’s code —eight characters shown by the setting itself— or, if the phone is on your same account, that key. With a paired phone, and as long as it stays connected, the PC sends it the telemetry of your simulator (the one in section 3), which simulator you have open, the name of your computer and what the engineer knows about you on this PC, so that the phone can show it: your nickname, the engineer memory and the driver profile, your records, your progress and how much you lose in each corner, the setups you marked as reference, what you asked it to remember, your instructions, your favourite cars and circuits and some of your preferences (section 7). What it sends to the phone goes over your local network, without passing through our servers or going out to the internet. It is signed —the phone rejects an altered or repeated message—, but not encrypted: anyone who can see your network traffic could read it. If you do not grant access in the Windows firewall prompt, the phone will not be able to connect, but the announcement will keep going out. For none of this to happen, turn off “Use your phone as the radio” in Settings → General: the port is closed, phones are disconnected and the PC stops announcing itself.

9. What you can turn off, and where

A good part of the above is optional. Summarised in one place so that you do not have to work it out:

• Voice activation, Gemini Live mode and screen sharing in Gemini Live: up to version 1.2.4, in Settings → Audio (the first), Settings → AI (Gemini Live mode) and Settings → Advanced (the third), turned off by default. From the next one they can no longer be turned on, and the application turns off at start-up those that were on.
• Live dashboard: Settings → Advanced → Remote Viewer. Off by default, and it only streams with a signed-in session; what was turned on in 1.2.3 or 1.2.4 is turned off when 1.3 starts. The link can be rotated or invalidated from your account (section 8).
• Incident steward: from its own switch. Off by default.
• LAN pairing: Settings → Advanced. Off by default; the change applies when the application is restarted. It needs no account.
• Use your phone as the radio (the bridge): Settings → General, on Windows only. On by default, also when updating to 1.3 (it is turned on just once); turned off, the PC stops announcing itself on your network and closes its port immediately. “Reset” in Settings → General turns it on again, because it is its default value. It needs no account (section 8).
• Dashcam recording: it does not record unless you press the button or turn on the dashcam’s automatic recording, off by default (section 5).
• Record every session automatically: Settings → General. On by default, also when updating to 1.3 (it is turned on just once); it is turned off right there, and “Reset” in Settings → General turns it on again. It records only on your computer and without video (section 5).
• AI engineer with your own key: 1.3 no longer offers entering it, but it keeps using the one you saved before. In “Power User / BYOK” mode the reasoning (and, in 1.2.4 or earlier, Gemini Live) goes directly to Google; synthesised voice and speech recognition, only if you have neither signed in nor activated a licence (section 3).
• OpenClaw: Settings → Advanced; on a new installation it appears after turning on “Full mode” in Settings → General. Off by default, and it only does anything if you also have OpenClaw installed (section 3).
• Product analytics and session summary: Settings → Privacy. It comes turned on; turning it off stops sending instantly (section 6).
• Reporting an engineer message: the button on each message in the radio panel. It is only sent if you press it and confirm in the form (section 6).
• Sending your conversation with the engineer: Settings → Privacy, with its own switch. Off by default (section 6).
• Voice report of a radio line: it has no switch because it only happens when you say it to the engineer (section 6).
• Notes, bugs, suggestions and session rating: they have no switch either: they only happen when you say it to the engineer or answer its question yourself (section 6).
• Shared circuit layouts: Settings → Privacy, with the same switch as analytics. It comes turned on (section 6).

The only thing that cannot be turned off is what is needed to provide you with the service: your account, your licence and the counters with which the limits of your plan are applied. And, while the beta lasts, the questionnaire: the application stays locked until you answer it (section 6). Nor does the microphone that opens while the engineer speaks to detect whether you interrupt it have a switch; it neither records nor sends anything (section 4).

10. Data processors

We do not sell your data. To operate the service we use providers that act as data processors: Google (authentication, AI, speech synthesis and recognition and image analysis), Stripe (payments and billing), Supabase (database, authentication, real-time broadcast of the live dashboard and storage of voice downloads, in the European Union region) and Vercel (web hosting and visit analytics). Some of these providers may process data outside the European Economic Area under the corresponding legal safeguards. What you connect yourself with your own account —OpenClaw and the services you have linked in it; and, up to 1.2.4, ElevenLabs with your key— are not our processors: you contract them yourself, under their terms (section 3). Nor is GitHub, from where the public models of the local voices are downloaded (section 3).

11. Retention and your rights

We keep your account, subscription and usage data while your account is active and for the time necessary to comply with legal and tax obligations. Neither the audio from your microphone nor the frames of your screen are kept in our systems: they are transmitted to produce the transcription or the verdict and end there. The transcription is not kept either, except within your conversation with the engineer if you have turned on its sending (section 6).

What does persist in our systems is the product analytics, the summary of your driving sessions, your answers to the beta questionnaire, the messages you have reported as incorrect, the voice reports of radio lines, the circuit layouts you uploaded and, if you turned on its sending, your conversations with the engineer (section 6). You can delete it yourself from Settings → Privacy, with the “Delete my server data” button. It requires being signed in, because it is your account that identifies which rows are yours. It deletes the heartbeats of your installations, the welcome wizard events, the summary of all your driving sessions, your answers to the beta questionnaire, all the conversations you have sent, the messages you have reported with your account, the anonymous reports sent from this installation, all the voice radio reports you have sent and all the circuit layouts you have uploaded. It asks for confirmation and is irreversible.

With the download clicks you made while signed in it does something else: it does not delete the row, but removes your user identifier, your email and your browser identifier from it, and leaves what does not say who you are —version, system, page and origin—. This way the download still counts in our download tally and is no longer tied to you.

That button does not delete your licence or your billing data —there is a legal obligation to keep the tax data of a sale—, nor the counters and the log of calls with which the limits of your plan are applied, nor the phone bridge key (section 8), which is deleted with the account, nor your account: deleting your history and closing your account are two different requests. If you want to close your account, write to us.

There is a limit that we prefer to state rather than hide. Heartbeats and wizard events sent before you sign in travel only with the installation identifier, with nothing that ties them to a person. The button deletes those of the installation from which you press it, because the application knows its own identifier; those that left from another computer —or from that same one before reinstalling it— cannot be attributed to anyone and there is no honest way to locate them. If you think one exists, write to us with the details and we will look for it by hand.

What is still missing, said just as plainly: these rows do not yet have an automatic deletion period. Unless you ask, they are kept. We are working on a retention period; until it is in operation we will not announce it here.

What stays on your own computer —the engineer memory, the driver profile, your setups, your iRacing history, your force feedback, your records and what is learned from your driving, the pending recorded session and the race logbook (section 7)— is deleted from the same place, with the “Delete local memory” button (in 1.2.4, only the memory and the profile). The dashcam recordings and the sessions you saved (section 5) and the diagnostic log (section 7) are not: they are files and are removed from their folders.

You can request access, rectification, portability or erasure of your data, as well as close your account, by contacting us. You can also close your account yourself, from the app or at smoothoperator.tech/en/delete-account: it deletes the account and all your history, and keeps only the tax record of the licence, unlinked from you. The service complies with the General Data Protection Regulation (GDPR) applicable in the European Union.

12. Contact

For any query related to the privacy of your data, you can write to us through our website or our Discord server.