KPM Sim Kit Privacy Policy

Effective date: When first published at simkit.net
Last updated: October 30, 2026

1. Who we are and what this policy covers

KPM Sim Kit (“we,” “us,” or “our”) provides a sim-racing dashboard and overlay service. This policy explains how personal information is handled when you use simkit.net, the KPM Sim Kit desktop app, related account and community features, or contact us.

The legal operator is Kyle McDonald, an individual based in Illinois, United States, operating under the KPM Sim Kit name. References to “we,” “us,” or “our” identify that individual as the operator of the Service.

Where applicable data protection law uses the term, we are the controller of personal information for which we determine the purposes and means of processing. This policy distinguishes data our software processes on your device from information we actually receive.

Contact us through the contact form for questions or requests about information we handle. You do not need a Sim Kit account to report a privacy concern, including a concern about simulator or chat information concerning you.

This policy does not govern the independent practices of iRacing, SimHub, Discord, payment services, or other third parties. Their own policies govern information they independently collect or use. Our use of providers to process information for us is described in this policy; this distinction does not remove our responsibilities for that processing.

Quick guide

• Saved desktop designs and replay files stay on your computer unless you choose a feature that sends them. Local processing.
• Accounts, billing, Community publishing, and support use online services. Information we handle.
• Website usage analytics starts off. Desktop analytics controls depend on your app version, as explained below. Your choices and rights.
• Publishing to Community makes the selected package available for public reuse under the rights explained in our Terms. Review included files before sharing. Community sharing.
• You can use the contact form for privacy questions or requests, including if you do not have an account. Request handling.

2. Information you provide and information associated with your account

Account and authentication information

When you register or sign in, we use WorkOS for account authentication and process your WorkOS user identifier, email address, first and last name, display name, profile picture URL, role, plan, and access permissions. This information is used to create your account, authenticate you, associate content and entitlements with you, and protect access.

Where a YouTube connection flow requests a policy acknowledgment, we record the Privacy Policy version and the acknowledgment time for that integration. Older connection flows do not provide this record.

Browser sign-in uses WorkOS-hosted authentication. Our authentication service receives the resulting session and stores it in a sealed, HTTP-only cookie. It reads and refreshes the session to provide your account profile and access permissions to Sim Kit. This flow handles account identifiers and profile information, sign-in and verification requests, authentication/session tokens, and security information associated with authentication. WorkOS also receives connection information, such as IP addresses and browser/device information, when you use its hosted sign-in pages. Our native app exchanges device-authorization codes and refresh tokens with the authentication service to obtain account permissions.

Dashboards, widgets, themes, overlays, and images

The Service handles the content you create, import, save, or publish, such as design settings, text, images, and associated item information. These materials can contain personal information you choose to include.

The desktop host stores saved dashboard documents, settings, imported images, Community installation records, and replay files on your computer. Publishing to Community sends the selected package, included assets, and listing information to our online catalog. Support submissions also send any design text, images, or logs you choose to attach. Eligible Alpha and Pro accounts can use private cloud backup. Sim Kit shows an in-app notice before the first upload. Automatic backup then saves your configurations after editing stops. You can turn it off in Profiles & backups.

When you publish an item to Community, the selected item and its included assets become available to other users under the CC0 dedication of rights you control, as explained in our Terms. This does not grant rights in third-party material that you do not hold. The public listing displays an author identifier, item name and description, tags, content type, publication and update dates, release information, reuse policy, and download and installation counts. The item and its assets may include additional information that you place in them. Publishing flows that support a separate license and rights acknowledgment record it with the release. Older publishing flows do not provide that acknowledgment record.

Community also sends account-linked installation reports to our catalog. These include account, device and installation identifiers, the item and release installed, whether it remains installed, revision, and update time. They support installation reconciliation and aggregate counts. They are separate from local design files and optional PostHog analytics. Local designs are uploaded only when you publish or submit them, or when private cloud backup is available and enabled for your account.

Purchases and billing

If you buy a paid plan, we use Stripe to process the payment. We receive or retain account and payment-provider identifiers, subscription status, billing interval, paid-through date, cancellation status, and plan eligibility to manage purchases, subscription status, refunds, fraud prevention, and financial records.

Checkout and subscription-management pages are hosted by Stripe. We send your email address, display name, and WorkOS user identifier to Stripe to create and link your billing customer. Sim Kit uses Stripe's API to reconcile subscription and invoice status. Our billing service also sends Knock your WorkOS identifier, email, display name, Stripe customer and subscription identifiers, subscription status and interval, entitlement and paid-through information, billing source, and update time to synchronize account/billing profiles for service communications.

Support and communications

When you contact us, we receive the information you provide, such as your contact details, messages, screenshots, attachments, and logs you choose to submit. We use it to respond, investigate problems, and maintain a record of the request.

If you choose Send report to Sim Kit staff in the app, you must be signed in. The report includes your account ID, name, email address, optional issue description, app and system versions, output status, and recent diagnostic logs. We redact common credentials and personal file paths, but logs may still contain names or other personal information. Cloudflare relays the report to Linear, where staff can review the ticket and its private diagnostic attachment. We do not automatically attach saved settings, dashboard files, screenshots, or telemetry recordings.

If you join our alpha-interest list, we store your email address, the time you joined, and your most recent request time to handle your interest and prevent repeated signups. Cloudflare Turnstile processes a verification token and connection IP to protect signup from automated abuse. This list is separate from an online account. You can request removal through the contact form.

If you participate in a community channel, such as a Discord forum, your posts and profile may be visible to other participants according to that channel's settings. Do not post passwords, payment details, or information you do not want other participants to see.

Private cloud backup and restore

Cloud backups are linked to your account and contain saved profiles, dashboards, screens, widgets, themes, overlay scenes, custom widget templates, supported preferences, Community item origins, and referenced imported images. Recovery-point records include a library identifier, revision, computer name, app version, save time, and change summary. Any text or personal information you place in a design or image can be included. Avoid placing passwords or other private connection information in design labels, text, or images.

Backup does not include separate sign-in credentials, account tokens, analytics consent, physical display assignments, device connection settings, raw simulator telemetry, or replay recordings. Backups remain private to your account. Community publication is a separate action. Restoring is a manual action; backup does not automatically activate changes on another computer.

Turn off automatic backup to stop automatic uploads. You can still choose Back up now. Existing recovery points follow the retention rules below. Delete cloud backups in Profiles & backups to remove your account's cloud history. Removal takes time to finish, and new backups remain paused during that work. Local files and exported copies remain on your computer. Verified account deletion includes cloud backups; your account export can include a download of retained backup files.

3. Simulator data, local files, and connected displays

The desktop app processes simulator information to provide dashboards, overlays, and related race tools. Depending on the feature, that information can include vehicle inputs and measurements, lap and session information, and driver names, identifiers, ratings, or standings made available by the simulator. Information about other drivers can appear in shared sessions even when those drivers do not have KPM Sim Kit accounts.

What stays on your device and what leaves it: The desktop host reads simulator telemetry on your computer and provides it to local dashboards and overlays. Replay Lab saves recordings locally. Product analytics sends sampled summaries of runtime and race-dashboard use, as described in Section 4, rather than raw telemetry, driver names, simulator session identifiers, or replay files. Information can also leave your device when you enable optional track map sharing, enable a connected display or integration, publish content, submit a support attachment, or share a recording or livestream. Account authentication, billing, Community requests, downloads, and update checks contact online services separately from the local telemetry feed.

Information about other drivers: Names, simulator identifiers, ratings, positions, and other session information about drivers may be processed in memory, shown in your layout, and included in locally saved replays. A driver does not need a Sim Kit account to appear in simulator session data. Do not publish recordings, screenshots, design files, or support logs containing other drivers’ information unless you have an appropriate basis to share it. We handle driver information we receive in support or other submissions for the purpose of that submission and under the retention rules below.

Local files and simulator assets: The app reads and writes its settings, saved dashboards, imported assets, installed Community packages, and replay files. File import and image-selection features read the files you choose. Simulator integrations read the simulator interfaces and supporting files needed for the selected features. Content and replay files can contain driver information, file paths, images, and text. Local storage is not automatically deleted by signing out.

Music widgets and conditions: If you add a Music widget or music visibility condition, Sim Kit reads the current track's title, artist, album name, playback status, and available album cover from Windows on your PC. Sim Kit keeps this information in memory while the feature is in use and does not send it to our servers or save a listening history. Your overlay can show this information in a recording or livestream if you choose to capture it.

OBS monitoring: If you enable OBS monitoring, Sim Kit reads video from OBS Virtual Camera or the currently selected OBS scene through the optional Sim Kit OBS plugin and source names, audio levels, and streaming, recording, and virtual-camera status from OBS on your computer. Video, levels, and status are held in memory for local display; this feature does not record video, capture microphone audio, or play audio. Sim Kit saves the local OBS port and password using encryption tied to your Windows account. Disconnecting OBS in Sim Kit removes that saved connection. This feature does not send the video, audio levels, status, or OBS password to our online services.

Connected displays and integrations: Information displayed through an enabled integration is made available to that integration or the selected display. Your configuration may allow another device on your local network to receive dashboard information. The host binds its normal manager endpoint to your own computer. A separate local-network listener is enabled only when LAN access is enabled. Devices allowed to reach that listener can receive dashboard information exposed by its display endpoints. Use a trusted network, keep LAN access disabled when you do not need it, and do not expose the listener to the public internet.

Connected Twitch and YouTube accounts

Connecting a streaming account is optional. WorkOS Pipes manages the authorization connection; our authentication service retrieves an access token and supplies it to the desktop host. The host contacts Twitch or Google directly to read the connected channel's live chat and stream information. This can include participant identifiers, display names, message text, timestamps, badges and emotes, and Twitch stream metadata and viewer counts. The host holds rolling chat messages in memory for display; authorization records are handled separately by WorkOS and the relevant platform.

Sim Kit uses YouTube API Services. Google's independent practices are described in the Google Privacy Policy. You can disconnect in Sim Kit's Integrations settings. Disconnect removes the connection used by Sim Kit. To revoke platform authorization, use the Google or Twitch account controls linked below. App versions with platform-revocation support also request revocation when disconnecting an active connection and report a failure so you can retry. You can also revoke Google authorization in Google account permissions, or Twitch authorization in Twitch Connections. A privacy request can also address records retained by us. Revoking access does not erase recordings you have made or information independently controlled by a platform.

Displayed chat or dashboard content in a recording or livestream can be seen by its viewers, including participants' or drivers' information. Review your layout and capture settings before sharing a screen publicly.

Background operation: Closing the desktop manager window leaves the telemetry engine running while the tray application remains open. Connected chat services can remain active. Desktop runtime analytics can continue while a signed-in account uses live dashboards or overlays, even with the manager closed. Where your app includes a Usage analytics setting, turn it off to stop future desktop collection. Choose Quit KPM Sim Kit in the system tray to stop the application and its connections.

Stopping the application does not, by itself, delete saved information or cancel a paid subscription.

Optional track map sharing

Track sharing is off until you accept the Home prompt or turn it on in Settings → Account. It is separate from Usage analytics. Declining sharing does not stop you receiving published map updates. Availability can be limited to selected accounts through WorkOS feature flags; eligibility alone does not enable uploads.

When sharing is enabled, Sim Kit reads finished iRacing telemetry recordings on your computer while you are out of the car and the app is idle. It extracts track ID and simulator track version, lap progress and local relative coordinates, collection software and extraction versions, random contribution and source-group identifiers, and a service request identifier. It checks complete laps, pit activity and off-track samples locally. Sim Kit sends these observations to our Cloudflare track service using your signed-in account. We use the account and contribution records to authenticate uploads, limit abuse, separate evaluation groups and handle privacy requests. Account separation does not prove that recordings are authentic or that accounts belong to different people.

The observation payload excludes driver names, simulator driver identifiers, simulator session identifiers, lap times, recording filenames, full recordings and absolute GPS coordinates. Your original recordings stay on your computer and are not changed or deleted by this feature. The service receives ordinary connection information described in Section 4 when handling requests.

Observations and account-linked admission, receipt and evaluation records are private. We use them to evaluate and prepare shared map corrections. Published map packages and version histories contain map sources, annotations and aggregate evaluation summaries, rather than your account-linked observation files. Published corrections are available to other users, and previously downloaded copies can remain available.

You can decline the first prompt or change your choice in Settings → Account. Turning sharing off stops new processing and uploads and clears unsent observations. Signing out or changing accounts stops uploads under the previous account; another account must make its own choice. These actions do not delete previous server records. Verified account privacy requests include locatable contribution records, stop new contributions and prevent their use in unpublished map candidates. Published aggregate maps and copies already downloaded by others can remain available. Retention periods and local queue limits are below.

4. Technical information, analytics, and device storage

Requests, updates, and diagnostics

We use Cloudflare for hosting. When a device contacts our website or online services, including download and update endpoints, we and the providers operating those services process connection information such as IP address, request time, requested URL, browser or device information supplied with the request, response status, and service error or performance information for delivering requested pages and services, distributing downloads and updates, preventing abuse, and investigating service failures.

Cloudflare operates the website and online service infrastructure, including request routing and storage used for private cloud backups, optional track observations, support submissions, and Community content. Our Cloudflare services use Workers, Durable Objects, KV, D1, and R2 for their respective functions. Cloudflare receives information necessary to handle those requests, and content submitted to those services is stored where that feature requires it.

Requests to online services are separate from local simulator processing. Authentication tokens, payment details, private design content, and driver names are not intended analytics fields. Support files you choose to send may nevertheless contain them; remove secrets and unnecessary personal information before submitting a file. We restrict diagnostic access to people who need it to investigate the service issue.

Analytics

PostHog

We use PostHog's US Cloud service for website and product analytics, to understand feature use and improve the Service. Website collection starts only after you enable it in that browser. Refusing website analytics does not remove core features or paid access. Desktop releases through 0.4.24 enable analytics in packaged production builds and do not include a Usage analytics setting. Website choices do not change collection in those desktop releases. The desktop opt-in and withdrawal controls prepared with these policies require a later app update. In app versions that include those controls, collection starts off and the choice covers both the manager and background runtime collector without removing core features or paid access.

Website analytics records page visits and page exits, selected sign-in and download clicks, signup handoffs, confirmed sign-ins, and successful Community browsing and publishing actions. Events include timestamps, permitted page categories, browser and operating-system information, device category, and permitted display and page-duration or scroll measurements. A click or signup handoff does not establish that a download, installation, or registration was completed.

Desktop analytics records successful editing and profile actions, settings-change counts, installed integration categories, Community actions, and sampled dashboard and overlay composition such as screen, scene, and widget counts and widget kinds. While live dashboards or overlays are being used by a signed-in account, the desktop host also sends sampled runtime activity, session category, whether you are in the car, race activity and observed race-dashboard start/end events, selected adapter and connected integration categories, and active widget or Community-content counts. It creates a separate usage identifier for a race-dashboard interval. These measurements describe observed application use and approximate intervals, not exact racing time or driver performance.

While collection is active, visits before sign-in use persistent device and session identifiers. When you sign in, permitted later events may be associated with a WorkOS-derived account identifier, plan, and role. These identifiers are not anonymous. We do not send your email address, name, private design contents, raw simulator telemetry, driver names, or replay files as analytics fields.

Event names and properties are filtered. Website URLs omit query strings and fragments, private Community item paths are reduced to a general category, and referrers retain only their origin. Desktop URLs are replaced with a fixed logical address. We do not send raw simulator telemetry, simulator session identifiers, driver names or identifiers, private design text, document names or IDs, search text, images, authentication credentials, support attachments, payment details, or full file paths through this analytics integration.

The integration disables session replay, automatic interaction capture, console recording, separate error capture, heatmaps, surveys, remote feature-flag requests, campaign-parameter collection, and IP-based geolocation. It does not collect screen recordings or screenshots for product analytics. PostHog receives network connections needed to deliver events; disabling IP-based geolocation is not a claim that no connection information reaches the provider. Provider-side access, logs, exports, and retention require separate verification. Enabling a materially different collection feature requires an updated disclosure and any consent required for that use.

No separate crash-reporting SDK is integrated in this release. Local host diagnostics and support files you choose to submit are distinct from optional product analytics.

Cookies and similar technologies

The website uses necessary authentication and security cookies. The Sim Kit session and security cookies have a configured lifetime of up to 30 days; the temporary sign-in state cookie lasts up to 10 minutes. These are cookie lifetimes, not promises about how long server records are retained. WorkOS and Stripe may use storage on their hosted sign-in and payment pages under their own disclosures. The native app stores a refresh credential locally to restore sign-in, and stores settings, designs, assets, and replay files on your computer.

Signing out resets the analytics identity for later events; it does not delete events already held by the provider. Turn website analytics off using the Usage analytics control. For desktop versions with a Usage analytics setting, turn it off in Settings. Those preferences are stored on that browser or installation, and clearing them returns collection to off. Desktop releases through 0.4.24 do not offer that setting; quitting the tray application stops their future collection together with the application. A request to delete existing information is separate; use the contact form. Blocking necessary authentication storage can prevent sign-in or other account features.

5. How we use and disclose information

We use information described in this policy to provide the features you request, maintain accounts and entitlements, process purchases, respond to support requests, protect the Service, and comply with legal obligations. Analytics or marketing uses apply only as specifically described in this policy and subject to required choices and consent.

Service providers

We disclose information to providers that perform services for us, such as authentication, hosting, storage, payments, communications, and technical monitoring. Their access must be limited to the services they perform, subject to appropriate contractual restrictions. A provider may also act independently for some purposes, such as a payment provider’s own legal or fraud-prevention duties.

Community publishing and user-directed sharing

Publishing a Community item makes its selected content and included assets available for other users to copy into their own collection. An image or design file can contain personal information beyond what appears in its preview, so review what you publish.

New public Community items may be announced in the KPM Discord server to help people find shared items. Announcements contain the public name, description, content type, listing link, and an available preview image. This feed reports first-time public shares; editing an item or publishing another release does not announce it again. Discord receives and stores these announcements, and people with access to the channel can read or copy them.

If an item becomes private, is recalled, or is deleted, we queue a change that removes its content from our announcement. Delivery failures can delay that change. We cannot remove copies made by other people or promise that Discord immediately erases retained copies. Contact us if an announcement needs attention. We retain the listing and Discord message identifiers and delivery status needed to prevent duplicate posts and handle removal; the announcement record does not store an account identifier or a copy of the item content.

Making a listing private or removing it does not remove copies that others previously obtained. We handle copies and associated personal information in systems we control according to applicable law and our retention practices. Contact us about privacy concerns involving a listing; do not assume that deleting your account immediately erases every shared asset or independent copy.

Legal requirements, safety, and business transfers

We may disclose information when reasonably necessary to comply with a legal obligation or valid legal process, investigate abuse, protect rights and safety, or establish or defend legal claims.

If we are involved in a proposed or completed merger, acquisition, financing, reorganization, or sale of the Service, relevant information may be disclosed subject to appropriate safeguards. We will provide notice of changes in control or privacy practices where required by law.

Sale, targeted advertising, and other uses

We do not sell personal information or share it for cross-context behavioral advertising. We do not use Sim Kit account information, private designs, or simulator telemetry to build advertising audiences. Providers may process information only for their disclosed service functions and any separately disclosed legal or security responsibilities.

We do not use private designs, support attachments, or simulator telemetry to train our own general-purpose AI models. If you enable optional AI authoring, your selected AI client can request design YAML, saved widget templates, and previews from Sim Kit. Designs and previews can contain text, images, and other content you have added. Authoring previews use sample race data. The AI provider processes the information under its own terms and the data settings you select. Sim Kit keeps your design files locally and does not operate a cloud relay for this integration. Disconnecting the integration stops new requests through the local connection. It does not delete information the AI provider has already received. Providers have their own applicable service, legal, and security terms; this is not a representation that every provider has the same role or never processes information for its independent responsibilities. We request separate permission before using your content in our promotions. This is our commitment, not a restriction on rights other recipients validly receive under CC0.

6. Legal bases where European or UK data protection law applies

Where applicable law requires a legal basis, the basis depends on the particular processing:

Where we rely on legitimate interests, you may object based on your particular situation. You may object to direct marketing at any time. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

If information is necessary to provide an account, process a purchase, or deliver a requested feature, we may be unable to provide that function without it. Optional information and optional processing will be identified as such.

Subscription status and account permissions are checked automatically to control access to features. If you believe a billing or access decision is wrong, use the contact form for human review. We do not intend to use personal information for decisions that produce legal or similarly significant effects solely through automated processing.

7. How long we retain information

We retain personal information only for as long as reasonably necessary for the purposes described here, including applicable legal, accounting, security, and dispute-resolution needs.

Local files remain subject to your device’s storage and deletion controls. Signing out, canceling a subscription, or requesting account deletion does not erase files stored only on your computer. Remove saved designs, assets, recordings, and exported copies using the app’s available controls or your device’s file controls. Uninstalling may leave user-created files or settings; check your device storage and backups if you want to remove them.

We may retain limited information for a legal hold or another lawful exception. Information retained only for such purposes will not be used for unrelated purposes. Shared copies controlled by other users are addressed in Section 5.

8. Your choices and privacy rights

You may use the contact form to ask about your information or make a privacy request. Depending on your location and the law that applies, you may have rights to access, correct, delete, or receive a portable copy of personal information; restrict or object to processing; withdraw consent; or opt out of specified uses.

We may request proportionate information to verify your identity and authority. Where allowed by law, an authorized agent may act for you. We will respond within the time required by applicable law and explain a refusal or limitation and any applicable appeal process. You will not be unlawfully discriminated against for exercising protected rights.

Account deletion: Use the contact form, choose Privacy or account deletion, and provide the email address associated with your account. Tell us that you want to delete your account. We will verify the request, explain retained exceptions, and confirm completion. A self-service delete button is not required to make a request. Deletion is subject to the retention exceptions described above. Our Terms explain the effect on directly billed subscriptions.

Analytics choices: Use the website's Usage analytics control to enable or disable collection in that browser. In desktop versions that include a Usage analytics setting, the setting covers the manager and runtime collector on that installation. Desktop releases through 0.4.24 do not include it; quitting the tray application stops collection together with the app. A website choice does not control those releases. Stopping collection does not delete information already sent. Use the contact form to request deletion or exercise another applicable right. Where a device identifier is needed to locate records, we will explain how to provide it securely.

Marketing messages: We require a separate opt-in before sending promotional messages. If we introduce promotional email, it will include an unsubscribe method. Use the contact form to withdraw an existing promotional permission. Security, authentication, billing, and requested support messages are separate.

United States residents: Where a state privacy law applies, rights may also include opting out of the sale of information, targeted advertising, or certain consequential profiling, and appealing a request decision. Use the contact form to make a request or appeal a decision. Include the state where you live so we can assess the applicable rights. We will explain any verification needed and the applicable appeal route. We do not sell information or use it for targeted advertising; if those practices change, we will provide any required notice and opt-out method first.

Browser signals: A Global Privacy Control signal or Do Not Track setting prevents optional website analytics collection in this release. This does not cancel an account or subscription, erase earlier events, or stop requests needed to deliver the Service. We do not sell information or use cross-context advertising; our analytics configuration is scoped to Sim Kit and does not authorize advertising tracking across unrelated websites.

EEA and UK residents: Where applicable, you may complain to a relevant data protection authority, including the authority where you live or work, or where an alleged infringement occurred. UK residents may contact the Information Commissioner’s Office. You may contact us first, but are not required to do so before using a statutory complaint right.

9. International processing

Cloudflare may route requests and process information through its global network. WorkOS, Stripe, Knock, Twitch, and Google process information in the countries used for their services, which may include the United States. Optional PostHog analytics uses its US Cloud service. Information may be processed outside the country where you live.

Where European or UK law applies to a transfer, the applicable arrangements must provide an authorized transfer basis and any required safeguards. Use the contact form to ask about arrangements relevant to your information. The provider's location alone does not establish an adequacy decision, signed transfer agreement, or coverage for every use.

10. Security

We use administrative, technical, and organizational measures designed to protect personal information appropriate to its nature and the risks involved. No method of transmission or storage can be guaranteed completely secure. Use the contact form if you believe personal information associated with the Service has been compromised.

11. Children and younger users

Our Terms require users to be at least 18, and we do not offer accounts or purchases to people under 18. Simulator and chat information may include information about people of different ages, including people without Sim Kit accounts. A younger person may also contact us about information concerning them. If you believe an underage account exists or information about a child has reached us, use the contact form so we can investigate and handle it under applicable law.

12. Changes to this policy

We may update this policy to reflect changes in our practices or legal obligations. We will publish the revised policy with an updated date and provide additional notice of material changes where appropriate or required by law. Where a new use requires consent, we will request that consent before beginning the use.

13. Contact

KPM Sim Kit
Privacy contact: contact form

Use the contact form for privacy questions, requests, or complaints. Applicable statutory complaint rights remain available.