ULO Privacy Policy

Version of this text: 03.11.2026.

1. Who we are

Axel Leknes, Oslo, Norway is the controller of the personal data described here. Contact: leknesaxel@gmail.com.

2. Summary

• ULO runs on your PC. It keeps its settings, logs and saved licence on your PC.
• ULO sends data to other places in three cases only: team sharing, the licence check and update checks. Nothing else leaves your PC.
• ULO has no analytics, advertising or crash reporting.

3. Data kept on your PC

• Settings (%APPDATA%\ULO\config.json): widget positions, colours, your choices.
• Licence key (%APPDATA%\ULO\licence.json): your key, sealed with Windows DPAPI, so it can only be read by your Windows account on this PC.
• Team login (%APPDATA%\ULO\team.json or the saved login): the broker login used for team sharing.
• Log (%APPDATA%\ULO\ulo.log, and ulo.old.log): what ULO did and any errors. Licence keys and passwords are not written to it. The log is capped in size.
• Recordings only if you start one yourself (ulo.exe record). They stay on your PC unless you send them.

You can delete these files at any time. Uninstalling ULO does not remove them.

4. Team sharing

When your team uses team sharing, ULO sends messages to a message broker that the drivers in your team connect to. The broker is operated by EMQX Cloud. Each message can contain:

• your iRacing team ID, subsession (race) ID and your iRacing user ID;
• your driver name and car number, as iRacing gives them;
• your fuel level, fuel per lap, laps and time left, and box calls you make;
• your lap times and the car you drive (the car path), and stint summaries;
• a sequence number to order messages.

The messages go to the topic of your team and race only. Every driver in that team, and anyone who has the team's login, can see them while the race runs.

Known limitation. Today the server cannot check that a driver really belongs to the team they claim. A driver who changes ULO could read messages for another team. We accept this risk and will report it to the team if it is used.

Retention. ULO does not ask the broker to keep messages (no retain flag is set in the code). Your team's messages stay only on the PCs of the drivers in the session.

5. Licence check

When you enter a key, and then about once a day, ULO asks our licence server (a Cloudflare Worker with a Cloudflare D1 database):

• your licence key;
• the ULO version;
• a hash of your PC ID, which is a hash of the Windows MachineGuid. The server never receives the GUID itself;
• whether this is a request to move the key to this PC.

The server stores keyed hashes of your key and of your PC ID, not the values themselves, and:

• your subscription and checkout IDs from our payment provider;
• the times of your PC moves, for the 30-day limit;
• whether a trial has been used on this PC;
• a move counter, used to issue your team login. The login itself is not stored.

The server does not store your name, email address or payment details. Those are held by Creem (see section 7).

Retention. Hashes and move times are kept while the subscription exists. You can ask for them to be deleted (see section 9).

6. Update checks

ULO fetches its update information and files from a public address hosted on Cloudflare R2 (pub-9490d74ca3734f73b41507bef2c67b57.r2.dev). The request contains no account or licence information. Like any web request, the host can see your IP address.

7. Payments

Payments are handled by Creem, our merchant of record, which collects your name, email, billing details and payment information and issues invoices. Creem acts as an independent controller for those data. Their privacy policy applies. We receive the payment outcome and the IDs described in section 5.

8. Other data processors

We use these service providers to run ULO:

Where data is moved outside the UK or EEA, we rely on the safeguards the law requires, such as Standard Contractual Clauses.

9. Your rights

Depending on where you live, you may ask us to access, correct, delete or restrict your data, to move it, or to object to processing. Send requests to leknesaxel@gmail.com. You may also complain to your data protection authority. To delete your licence records, contact us from the email you used for the purchase; we will remove the hashes and move history, and cancel the subscription if it is still active.

10. Children

ULO is not aimed at children under 16. Do not give a licence key to a child who is not old enough to agree to this policy and the EULA.

11. Security

Licence keys and PC IDs are stored only as hashes on our server. Keys on your PC are sealed by Windows. Team messages are sent over an encrypted connection (TLS) to the broker. No system is perfectly secure; tell us at leknesaxel@gmail.com if you find a problem.

12. Changes

We will post changes to this policy in the app and on our site, and show the date at the top.