Privacy policy

Effective 27 September 2026

lookahead is a speedcubing training and analytics app. This page explains what data it keeps about you, why, who else handles it and what you can do about it. The short version: your data is used to run the app for you, it is never sold, and usage statistics are not linked to you or your account.

Who is responsible

lookahead is run by Patryk Kowalczyk, a private individual based in Poland, who is the controller of your personal data under the GDPR. For anything about your data, write to privacy@lookahead.to.

What we collect

Account: your email address, display name and a hashed password, or your name, email and profile picture from Google if you sign in with Google.
WCA link: if you connect your World Cube Association account, your WCA ID and the public profile data the WCA returns for it.
Training data: solves, times, scrambles, sessions, learning progress and settings. With a smart cube, also the move and orientation data the cube reports during a solve.
Uploads: images you upload as a timer background.
Sign-in sessions: the IP address and browser of each signed-in session, used to keep your account secure.
Emails: sign-in codes and password-reset messages we send you.
Race guests: the nickname a guest enters, a random guest id kept in their browser, and their results in that race.
Server logs: each request to the site, with the IP address shortened before it is written (the last two parts of an IPv4 address are dropped), used to find errors and abuse.

Giving us your data is voluntary, but an account cannot be created without an email address. We do not make automated decisions about you or build profiles of you.

Why, and on what legal basis

To provide the app (account, sync, statistics, learning, races): necessary to perform our agreement with you, Art. 6(1)(b) GDPR.
Security and abuse prevention (sign-in sessions, server logs, backups): our legitimate interest in keeping the service and your account safe, Art. 6(1)(f).
Improving the app with usage statistics: our legitimate interest, Art. 6(1)(f).
Showing your training bests on your competitor page to other users: your consent, Art. 6(1)(a), given by switching it on in Settings → Account. You can withdraw it at any time with the same switch; this does not affect what was shown before.

Your right to object

Where we rely on legitimate interest, you can object at any time, on grounds relating to your particular situation. For usage statistics this takes one switch (see below); for anything else, write to privacy@lookahead.to and we will stop unless we have compelling legitimate grounds that override your interests, or need the data to establish or defend legal claims.

Usage statistics

We run our own copy of Umami, an open-source analytics tool, on our own server. It records which pages are visited, the referring site, an approximate location (country, region and city, derived from the IP address, which itself is not stored), and the browser, operating system and screen size. It sets no cookies, the visitor identifier it computes changes every day, and nothing is linked to you or your account. Ids in page addresses (solves, sessions, race codes, WCA IDs) are removed in your browser before anything is sent. To opt out, turn off Share anonymous usage stats in Settings → Account; the browser you do it in stops sending statistics, signed in or not.

Cookies and local storage

We only use cookies the app needs to work: your sign-in session and short-lived security tokens during sign-up. Your browser also keeps some data locally (preferences, the offline timer, a race guest id and a cache of pages) so the app starts fast and works offline. Nothing is used for advertising or cross-site tracking, so there is no cookie banner.

Public WCA data

Competitor pages in the app show official competition results that the World Cube Association publishes for every competitor. They come from the WCA's public results export, not from you, and we display them on the basis of our legitimate interest in providing statistics about the sport. If you are a competitor and object to your page being shown here, write to privacy@lookahead.to; results themselves are corrected at the WCA.

Who else handles your data

We never sell your data or share it for advertising. These providers process data on our behalf and only on our instructions:

Hetzner Online (Germany): the server and database the app runs on.
Cloudflare (USA): domain name service, forwarding of email sent to our addresses, storage for uploaded images and database backups.
Resend (USA): delivery of sign-in and account emails.

Transfers to Cloudflare and Resend are covered by the European Commission's standard contractual clauses in their data processing agreements; both are also certified under the EU–US Data Privacy Framework.

Some services receive data only when you choose to use them, and handle it as separate controllers under their own privacy policies:

Google, if you sign in with Google.
World Cube Association, if you connect your WCA account.
An AI assistant (such as Claude), if you connect one to your account with an access token: it reads your training data on your behalf. You can revoke the token at any time.

How long we keep it

Deleted data leaves the database right away or within a day, as described below, and leaves our backups within a week, as they rotate.

Account and training data: for as long as you have an account. Deleting the account removes it immediately.
Sign-in sessions: while the session is active. Signing out deletes it immediately; a session that expires (after 30 days without use) is deleted within a day.
Race guests: 30 days after the race was created, the nickname is replaced with "Guest" and the guest id with a random one; the results stay, no longer tied to anybody.
Server logs: with shortened IP addresses only, deleted after 14 days.
Usage statistics: not tied to you, kept in aggregate.

Your rights

You can access, correct, export or delete your data, restrict its processing and take it elsewhere, besides the right to object above. Most of this is self-service in Settings → Data & privacy: Export data downloads a copy, and Delete account removes it. For anything else, write to privacy@lookahead.to. You also have the right to lodge a complaint with a data protection authority; in Poland that is the President of the Personal Data Protection Office (UODO, uodo.gov.pl).

Children

lookahead is for people aged 13 and over. If you believe a younger child has created an account, write to privacy@lookahead.to and we will delete it.

Changes

When this policy changes, the date at the top changes with it. For significant changes we will tell signed-in users in the app or by email. See also the terms of use.