Privacy Policy — LMU Assister

1. STEAM SIGN-IN — HOW IT WORKS

On both Android and iOS, Steam authentication runs on your device. The App performs a full local emulation of the Steam client sign-in flow for the limited purpose of obtaining a Steam authentication ticket for Le Mans Ultimate.

Your Steam username, password, Steam Guard (2FA) code, Steam session, and Steam refresh token do not leave your device and are not sent to the LMU Assister backend. They are not stored by us, logged by us, or shared with advertisers or analytics providers.

After the on-device sign-in completes, the App sends only a short-lived Steam auth ticket to the backend. The backend exchanges that ticket for a game-backend session so it can read your Le Mans Ultimate profile, ratings, statistics, race history, and leaderboard context on your behalf. The Steam auth ticket is not your Steam password and cannot be used by us to learn your Steam credentials.

Steam Guard prompts, mobile approvals, and any saved Steam sign-in material are handled on your device. If the App keeps Steam sign-in material for convenience, it is kept in the device's secure storage and remains device-side.

2. WHAT WE STORE

The server stores game-backend session tokens (session / refresh) tied to your game account id, needed to read your game data on your behalf.

To make the profile faster and reduce repeated requests to the game backend, the server stores a game-profile snapshot for your account: your game account id, in-game display name, nationality, profile badge, current Driver Rating and Safety Rating rank/tier/progress/score, career total statistics such as races, wins, podiums, top-5 finishes, pole positions, DNFs, fastest laps, laps led and laps completed, suspension counts, and the time when the profile was first stored and last synced.

The server also caches a compact race-history summary for your account: event ids, dates, split number, track/car labels, finishing position, lap/rating changes, category flags, per-track lap/distance statistics, best laps, favorite cars, recent race summaries, and the compact race cards/statistics the App displays.

We do not cache the large raw race-history payload, full per-driver race classifications from history, your Steam username, Steam password, Steam Guard codes, Steam session, Steam refresh token, game-backend session/refresh tokens in any public response, payment information, or the detailed list/reasons/timing of suspensions. The App may store and display only suspension counts, such as active suspensions and total suspensions.

Game data is fetched from the game's official backend when you request it through the App and then reused from this stored profile/history cache where possible. Session tokens are never refreshed in the background or on a schedule — they are renewed only when you actively request your data through the App, and they expire on their own when you are not using it.

The App may also fetch publicly available profile, rating, statistics, and race-history data from third-party racing/profile sources to improve public profile search and external public profile pages. Data from those sources is marked as external/public-source data where the App displays it. The App does not use your Steam credentials or game-backend session tokens to fetch that external public-source data.

3. RETENTION AND DELETION

Server-side game-backend session tokens are kept until you sign out, the tokens become invalid/expire, or you ask us to delete them. Signing out from the App deletes the server-side session token for your account.

The stored game-profile snapshot and compact race-history summary are kept until you ask us to delete them, they are no longer needed for the App, or they are removed as part of operational cleanup. You can request access to or deletion of your server-side profile/history data by contacting [email protected].

Deletion requests remove the server-side account/session/profile/history data controlled by LMU Assister. They do not remove information that remains available from the game's official backend, Steam, leaderboards, or other public third-party sources outside our control.

The backend writes technical diagnostic logs, such as request/RPC names, URLs, response status codes, request/response byte sizes, and timing information. These logs are used for debugging and performance monitoring. They are not intended to contain Steam usernames, Steam passwords, Steam Guard codes, Steam sessions, Steam refresh tokens, or raw race-history payload bodies.

4. WHAT NEEDS SIGN-IN, AND WHAT DOESN'T

You can use the App without signing in at all. Public content — the schedule on the first screen, events, leaderboards, selected synced player profile/statistics data, and external public-source profile/race data — can be viewed without signing in.

Signing in is required to let the App fetch and update your own game profile, ratings, statistics, race history, and your own position in a leaderboard from the game's online backend. After your profile has been synced, selected game-profile information may be visible to other App users, as described in the "Public profile data" section below.

5. PUBLIC PROFILE DATA

After your profile has been synced, the App may make selected game-profile and race-statistics data visible to other App users. This public data may include your in-game display name, game account id, nationality, profile badge, current Driver Rating and Safety Rating rank/tier/progress/score, career totals such as races, wins, podiums, top-5 finishes, pole positions, DNFs, fastest laps, laps led and laps completed, favorite cars, recent race summaries, per-track lap/distance statistics, best laps, and the date your profile was last updated in the App.

Public profile search and public profile pages may also include external public-source results for drivers whose data is available from third-party racing/profile sources. External public-source data may include a driver's public display name, external profile id/link, avatar, team, nationality, public badge, Driver Rating / Safety Rating, career totals, rating history, and paginated race-history summaries. These entries are marked as external/public-source data in the App where applicable.

Public profile data does not include your Steam username, Steam password, Steam Guard code, Steam session, Steam refresh token, game-backend session/refresh tokens, email address, payment information, or the detailed list/reasons/timing of suspensions. The App may show only suspension counts, such as active suspensions and total suspensions.

If you do not want this selected game-profile data to be visible to other App users, do not sync your profile, or contact us to request deletion of your stored profile/history data.

6. SECURITY

The App uses HTTPS for communication with the backend. Steam credentials, Steam Guard codes, Steam sessions, and Steam refresh tokens stay on your device and are not persisted by the backend. Server-side game-backend tokens are stored in backend storage/cache and access is restricted to the backend service. Selected synced game-profile and race-statistics data may be visible to other App users as described above. No system can be guaranteed perfectly secure, but the App is designed to minimize stored sensitive data and avoid receiving or storing Steam credentials.

7. OPEN SOURCE MOBILE APP

The mobile part of LMU Assister is open source. You can inspect the mobile client code to understand what it sends to the backend and how Steam sign-in is handled on device. This does not mean that the backend server, infrastructure, secrets, service accounts, or server-side operational logs are publicly available.

8. SHARING

We do not sell your data or share it with advertisers or analytics providers. The App contacts Steam, the game's official online backend, and publicly available third-party racing/profile sources only to the extent needed to provide App features. However, selected game-profile and race-statistics data described in the "Public profile data" section may be visible to other App users after your profile has been synced, and external public-source data may be visible when returned by public profile search or external public profile pages.

9. RISKS AND YOUR CONSENT

Signing in to Steam through a third-party client (not the official Steam client) and accessing game data outside the game itself are done at your own risk. This may conflict with the Steam and/or game terms of service. All actions are performed as your account and may be visible to the service operators. Consequences up to and including account restriction or ban are possible. By using the App you confirm that you understand and accept these risks and take full responsibility.

10. DATA INCIDENTS

If we become aware of a data incident affecting your data, we will notify affected users where required by law.

11. CHILDREN

The App is not intended for children under 18.

12. POLICY UPDATES

We may update this policy from time to time. The version and updated date above show the latest published policy. Continued use of the App after an update means you accept the updated policy.