What this site keeps about you, why it keeps it, and how to have it changed or removed. The short version: an account is an email address, a display name and your mashups; nothing is sold; there is no advertising or analytics service watching you; and the only third-party script on the page is the accessibility menu.
MixTheGrid.com is published and operated by Connect Bench, LLC, a limited liability company registered in New York, United States. It is the controller of the data described here, and it is who a request about your data goes to.
It is an independent fan project: not affiliated with, endorsed by or connected to Formula 1, the FIA, any team, any driver or any championship.
There are no passwords on this site to store or lose. There is no real-name field, no phone number, no date of birth and no postal address.
Every mashup is public on purpose. A saved mashup gets a permalink
(/name/<slug>), appears on the browse page and in
/sitemap.xml, and carries the two drivers' names and the date it
was made. That is the point of the site and it is what a shared link shows.
Your account is not named on it — the archive stores drivers, not people —
but a mashup saved while you were signed in is linked to your account
privately, in the table the leaderboard is scored from.
Drawing without an account is allowed and saves the mashup the same way. An account simply lets it compete.
Page views are counted without cookies and without a third-party script. To tell one visitor from another on the same day, the counter hashes your IP address together with your browser's User-Agent string, using a secret kept on the server; the list of those hashes is emptied when the UTC day changes, so no identifier survives the day it was made. What is kept is the totals: a count of views and visitors per day (400 days), a count per page path, and a count per referring host. Query strings and full referrer URLs are never stored.
rdr_session — the sign-in cookie. It holds
your account id, an expiry and a random token, signed so none of them can
be edited, and it lasts 30 days. Signing out deletes the session row on
the server, which kills every copy of that cookie at once.rdr_csrf — a random value that proves a form
was submitted from this browser. No personal data.rdr_signin_next — 20 minutes, and only when
you asked to sign in from an admin link, so you land back there.Nothing here is used for advertising or profiling, and there is no consent banner because there is nothing to consent to: the cookies above are the ones that make signing in work.
Three outside services are visible in how the site reaches you, and each has its own policy:
Sign-in links are sent through Postmark, which sees the address and the message. The message carries a small image that records when it was opened, so a broken address can be spotted; that is the only tracking in it, and the link inside is not tracked, because rewriting it through a click-redirector would put a single-use sign-in token into a third party's logs.
Your address is used for sign-in and for nothing else. There is no newsletter. If you bought the founding-supporter payment without being signed in, it is also used once to send you the link that puts the star on your account.
Payments are processed by Stripe, Inc., which is the merchant of record for the card data: it takes your card details, holds the payer and emails the receipt. What this server keeps is a record that a payment happened — amount, currency, status, the time, whether it was live or test, and Stripe's own payment and session ids. It does not keep your name, address or card.
A donation buys nothing on the leaderboard and is not tied to your account at all. The founding-supporter payment sets a date on your account row (that is where the star comes from). A subscription, when one is sold, will be one id and an end date on that same row.
For an account and its mashups: to perform the service you asked for (the contract, in GDPR terms). For the visitor count, the session list and keeping the board honest: legitimate interests — running a site and defending it from abuse, using the least data that does the job. For payment records: a legal obligation, because accounting and tax rules require them. Nothing here depends on consent, so withdrawing consent is not a step you need to take; deletion is.
You can ask for a copy of what is held about you, ask for it to be corrected, or have the account deleted. Plus, under the GDPR and the UK GDPR: to object to the legitimate-interests processing above, to ask for a machine-readable export, and to complain to your national data protection authority.
Two of those are self-service. Change your display name from your account page. Delete the account from the same page: the email address is removed, the row is scrubbed, sessions and scores go with it, and it can no longer sign in. The display name stays reserved so nobody else can take it, and draws already made stay in the archive as anonymous history. Removing someone else's account is not a thing you can do.
For anything else, write to info@mixthegrid.com. A request is answered within a month.
The site is not aimed at children. Please do not create an account if you are under 16, and you must be 18 to take part in anything that carries a prize.
Connect Bench, LLC is in New York, in the United States, and the services above (Stripe, Postmark, Hostinger, Cloudflare) process data in the US and the EU. Where a transfer out of the UK or the EU is involved, those providers rely on the safeguards their own terms describe, including standard contractual clauses.
A change that affects what is collected, or why, is noted here with a new date; the code and this page are updated together, because a policy that describes an older version of the site is worse than none.
Privacy questions, data requests and anything on this page: info@mixthegrid.com. Payment and subscription questions go to the same place — see also the terms of sale.
Connect Bench, LLC · Last updated 1 November 2026.