Privacy

Who is responsible for it

This site is made and run by one person, Wessel Willemsen, in the Netherlands, who decides what it stores and answers for it under the EU's General Data Protection Regulation. Anything about your data can go to contact@marathontrip.com.

Without an account, nothing reaches us

Every race you save and every trip you plan on My races is kept by your own browser, including what you type into the trip, such as a flight number, a hotel's name or a note. It is not sent anywhere, and we cannot read it. Anybody who uses the same browser after you can, though, so on a shared computer keep the trip in an account instead: when an account takes it, the copy kept here without one is cleared. Your browser also keeps a short list of the race pages you opened, up to twelve with their names and when you opened them, and the last search you typed, each for 90 days, only so the home page and the search box can offer them again. Neither is sent anywhere, and Forget, beside either, clears both. The one thing that does reach us is a trip you ask us to email to you, and only for as long as it takes to send it (below). That is still how the site works if you never make an account, and it is why the backup link on that page is a link rather than a button: the part after the # in a web address is never sent to a server, so a plan you share with a training partner goes from your browser to theirs and past nobody.

What an account stores

Making an account adds three things to a database we run, and a fourth only if you ask for it.

• Who you are. Your email address, the name you typed if you typed one, and your password in a scrambled form that cannot be turned back into your password. If you signed in with Google instead, we hold the account identifier Google gives us and no password at all. Choosing Google sends you to Google to say yes, and Google then tells us your email address, your name and that identifier; Google also learns that you signed in here.
• Your races. The list you build on My races, exactly as that page holds it: the races you saved or typed in yourself, the city you set as home, and everything you wrote against each race. That now includes the trip you plan around one, so it can hold the flight numbers and times you typed, the name and confirmation code of the place you are staying and its two dates, how you are getting in from the airport, the bib pickup and start time off the race pack, who is coming with you, the days either side, and the dates, goals, notes, budget lines, checklists and finish times as before. All of it is typed by you and none of it is a booking: nothing here reserves anything, and nothing is added to your list that you did not enter.
• What keeps the door shut. The row that remembers you are signed in also holds the internet address your device connected from and the name your browser gives itself. A session stops working thirty days after you last opened the site, and signing out or deleting your account deletes it. Separately, and with no name or account attached to it, a counter against that same internet address is what stops somebody trying passwords at a machine's pace. It is a number and a time, it belongs to the address rather than to you, it is deleted within two days, and it is the one thing on this page that deleting your account does not reach. Drawing postcard previews is held to a pace the same way, with a number and a time kept against your account, and that one does go when your account does.
• Postcard links, if you make one. A copy of exactly what is on that card and nothing else. Taking the link down deletes the card at once, and so does the link ending thirty days after race day (within a day); a note that the link existed, with its race and its dates, is deleted thirty days after that. More on postcards below.

Your race list is not used for any purpose other than showing it back to you, and never for advertising. We sell nobody's data to anybody. Planning a trip does send two questions out of the building, and neither one is about you: our own server asks Open-Meteo what the weather does at the race city's coordinates on that date, and the European Central Bank's published rates for one exchange rate. Your browser never speaks to either of them, and what leaves here is a latitude, a longitude, a date and two currency codes, with nothing attached that says who asked.

Comments, and what is public

Everything else on this page is private to you. Comments are the exception, and it is worth being blunt about it: what you post under a race is published on the internet at an address anybody can open, under the name on your account, and search engines are meant to find it. That is the point of it. The name is the one you can change on your account page, and changing it later does not rewrite comments you have already posted, because the name is copied onto a comment when you write it.

Alongside the words we keep which race it was under, when you wrote it, whether you have edited it, and the high fives and passes it has collected. If you have marked that race as run on My races, the year is copied onto the comment as a badge. Nobody checked it: it says what you said.

Posting also writes two kinds of record you do not see. If the filter refuses or holds something you wrote, we keep a note of the category it matched, the race and the date, never the sentence itself, and enough of those inside a month means what you write next waits to be read before it goes up. A note is deleted once it is a month old, because from then on it can no longer count. If somebody reports a comment, we keep who reported what, so that one person clicking five times counts once. A report is never shown to the person reported, and it is not in the export for the same reason.

Deleting your account deletes your comments. Where somebody has replied to one of them, the words, your name and the badge all go and an empty space is left where the comment was, because deleting it outright would delete the replies other people wrote. Your votes and your reports go with it.

When the filter acts, one counter is sent to the analytics company named below, whether or not you accepted the banner. It carries what happened, the race, and an identifier derived from your account that only this site can resolve. It never carries your address, your name or a word of what you wrote.

Postcards and share links

A postcard is a picture of your race that you make on My races, choosing what goes on it. To draw it, your browser sends the details you switched on to our server, which draws the picture and sends it back. Nothing is kept: the picture is in your hands and wherever you choose to share it.

A share link is different, because a link has to open something. When you copy one, we keep a frozen copy of what is on the card, and only that: the race and the details you switched on. Changing your plan afterwards does not change a link that is already out; copying the link again updates it.

Anyone holding the link can open it, the way anyone holding a photo can look at it. The address is long and random so nobody can guess it, and search engines are told not to list the page. It ends by itself thirty days after race day. You can take it down whenever you like from the same place you made it, and it stops answering within minutes. What nobody can do is call back a copy: a picture someone saved, or a screenshot of the page, stays with them.

The preview a chat app shows when the link is pasted carries the race, its date and your goal or finish time. It never carries your name, your note or anything about your trip.

How many nights you are away, your flight, where you stay and your budget all start switched off, because together they say when your home is empty. Switched on, the most a card says is a number of nights, two airport codes, a neighbourhood you type yourself and a rounded budget. Some things are never offered for a card at all: flight numbers, booking codes, bib numbers, the name of the place you are staying, your surname and your email address.

Asking for your own film

For a race we can film from open aerial photos, we can make you your own film of its course. The first step asks your name, your email address and your race. Until you ask for the film they stay in your browser tab only (its session storage), and they are gone when you close the tab. Asking for the film stores, in the database described under "Where it is kept": the name you want in the film, your target time or pace, your start wave if you gave one, the voice you picked for it and how strong, your email address, the race, which wording of the consent under the email field you saw, and when you asked and confirmed. If you are signed in, the request is also tied to your account.

We use them to make your film and to email you the link, and for nothing else. Your name is drawn into your own film only, and that film goes only to you, by a private link. It is never put on YouTube or any of our channels, and never shown to anyone else, unless you say yes to that separately. On your film's page, "Anyone with the link can watch" is off until you switch it on; while it is on, anyone with that link can watch the film. Switching it off, or making a new link, ends the old link at once, and every link ends with the film's 30 days.

The film is made on our own computer from the race's base film and the details above. The finished file is kept in private storage run by Supabase in Frankfurt, reached only through the link we send you, and the mails about it leave through Resend, like all our mail. If you picked a voice, the few lines it speaks, written from your times and with your first name in one or two of them, are sent to ElevenLabs to be read aloud. Nothing else about you goes with them.

The film of your own run: the file from your watch is read in your browser, and it never reaches us. When you order, the page sends only your times every 100 metres along the course, worked out from that file, the name and line you typed and, for a run from another day than this year's race, the day you ran it, so the film shows your date. Your route, your heart rate and the rest of the file stay on your device.

The mails, and only these: the one you ask for with "Email me this page", sent once, with your address kept nowhere; if you tick "Email me my preview and one reminder", the page at once and one reminder two days later, dropped if you order first, with your address and first name kept until then and deleted after; with an order, the receipt (with the time you ticked "make and deliver my film now"), the mail when the film is ready, and one the next morning with the other versions; with a gift, one to you, the buyer, never to the runner; with an order before race day, a mail the day after the race to add your run, one reminder a week later and, three weeks after the race, one asking whether to refund you, each dropped as soon as your run is in. A mail that waits keeps your address and the few words it needs until it goes, then those are deleted and only which mail went, and when, stays with the order.

"Email me", in the pop-up when free films are paused or when your race isn't on the list, and on the page for a film of any run: we keep the race (or "any run") and your email address, nothing else, and only after you press the link in the one mail that asks you to confirm. Unconfirmed, the address is deleted after seven days. Confirmed, it gets one mail, when we're ready for new films, and is then deleted. It is kept until that mail goes, 12 months after you confirmed at most, also after race day.

How long: a request nobody confirms is deleted after a day. The download link works for 30 days. The film, your name, your pace and the rest of the request are deleted a year after race day.

"Email me this page" sends one mail through Resend to the address you type, with the page's link and the export steps. The address is not stored, and nothing is added to any list. The file from your watch is read in your browser for the preview and is not uploaded.

You can have it all deleted sooner by writing to us from the same address, or, if you were signed in, by deleting your account. The copy of everything on your account page includes your requests.

Cookies and analytics

Every page you open is counted, whether or not you answer the banner. That count goes to PostHog, an analytics company with servers in the EU, and holds five things: the page, the site that sent you there (its name only, such as google.com), the country your internet connection is in, whether you said no or have not answered, and how many seconds the page was open, which is why it is sent as you leave. If the link you followed carried campaign tags (a source, a medium, a campaign and a content label, such as the ones on the links under our films), those are kept too. It holds no identifier, nothing is stored on your device for it, and your internet address and browser details are not passed on, so two pages you read are two counts nobody can connect to each other or to you. The short addresses on our stickers (marathontrip.com/s/) and Amsterdam running shirt (marathontrip.com/run) are counted the same way when you open one. The shirt address also keeps its three campaign tags so we can distinguish it from a sticker, then sends you to the home page with those tags. The race addresses we give on Instagram (marathontrip.com/ig/ and a race name) are counted the same way, by race and by where on Instagram the link sat, then send you to that race's page. Since your answer to the banner is kept in your browser, that one count cannot say what it was.

Pressing one of the links that lead off this site to book or buy something is counted the same way, whether or not you answer the banner: a hotel or flight search, an Amazon link, the link to support the films. That count holds which kind of link it was, which race, where on the page or in your trip plan it stood (and for a hotel, whether near the start, the finish or in the city, and for Amazon, which product), the page, the country your internet connection is in and whether you said no or have not answered. It holds no identifier either, never the dates, the airports or anything you typed, and nothing is stored on your device for it.

A banner asks, the first time you visit, whether we can count more than that. Say no, or say nothing, and those anonymous counts are all there is. Say yes, and this site sends PostHog four kinds of fact instead: which pages you open and how long each stayed open, how fast each page was for you (page-speed measurements: how long it took to load, how quickly it answered a tap or a key, and how much it shifted about while loading, a few numbers sent as you leave it), your approximate location worked out from your internet address (never the address itself, which is discarded once that is done), and a short, fixed list of named actions: opening entry details, opening one of the ways in on a race's ballot page (which race, and which way in, such as the ballot or a charity place), opening a hotel or flight search from a race page (and which of its places) or your trip plan, pressing a hotel link (which race, whether it was near the start, the finish or in the city, and whether from your trip plan or a race page, and there from the card beside the film, that card opened from the bar at the foot of a phone screen, the line under the film, the block by the entry details or the line on its ballot page, never the dates), using the race fuel block on a race page (pressing a finish time, and which one, or that it was the goal on your saved trip, never the goal itself, opening one of its rows, and which one, and first turning the gel picture by hand, and pressing one of its Amazon links or one of the small Amazon links elsewhere on a race page, on the home page or in your saved trip: which race, which product and which of those places it stood in; pressing one on the Running gear page counts which product, and that it was there), pressing play and how much of a film you then watched (a quarter, a half, three quarters or all of it, and where you pressed play: the film itself, the course map, one of its landmark cards, an Up next countdown or a frame on the Films page), pressing a link to another race at the foot of a race page (which race you were on, which race it led to, which row it sat in and its place in that row), pressing a link to a group of races, such as a continent, a country, a month or Flat and fast, from the tags at the top of a race page (which group, where it was pressed, its place in that row, and on a race page which race you were on), pressing a race on the page of a group of races or on the list of all races (which group, the race's place in the list and which race), using the filters on the list of all races or on the page of a group of races (which kind of filter and which kind of choice, such as a month or a country but never which one, and never what you typed), pressing a link in the trail at the top of a page (only how far up the trail it sat), pressing one of the tabs in the bar at the foot of a phone screen (which tab, and which kind of page you were on, such as the home page or the list of all races), pressing a link to a race's postcard (which race, and whether it stood on the race page before or after race day or on My marathons), pressing a race or a group of races in one of the home page's rows, such as Next on the calendar or When are you free? (which race or which group, which row and its place in that row; of the races you opened before, only the one you pressed, never the list or your last search), being shown the Up next card when a film ends (which race), and whether you then let its countdown run, pressed it or pressed Cancel, pressing Plan this race or Plan my trip (and where: a race page, the header, the home page or a trip preview, or the end of the course map), following a race from its page (which race, never the address), pressing Your own film or its pace band link on a race page (which race), and on the pages that make your own film: which way you came in (the strip above the header and the kind of page it was on, a race page, a shared film, one of our emails, an old link of ours, or none of these) and the campaign tag of that link, which step you reached and whether you went forward or back, the race you picked or that yours isn't listed, whether your run file could be read and which kind it was, or why not (never the file, the times or the route), which help you opened, which voice you picked, playing the preview and turning on sound or full screen, pressing Make my film and the one word of our answer (never the name or the address), the links you pressed there, sharing your story card, and being shown the pop-up for when free films are paused, sending it and confirming your address (which race and why it opened, never the address), on the page that shows where your film is: which stage it showed, whether it was later than we said, which of our emails brought you there, and which link on it you pressed (never your name, your address, your times or the link's code), pressing the support link (whether it was the one in the footer, on the story page or in My marathons, which kind of page it was on, and on a race page which race, never an amount), using the 3D course map on a race page (that a working map appeared, how quickly and in which quality, pressing its play button and how far through the course it played, moving along the course and with which control, opening a landmark card, choosing a pace and whether in kilometres or miles, sending the race-day times on and whether by sharing or copying, never the link, first moving the camera yourself, and making a short video of the course to share: how long it took to make, and whether it was sent on, downloaded, its link copied or sent to WhatsApp, never the video or the link), opening a part of a race page that starts folded, such as the course notes or the full programme, or pressing a section's name in the bar along the top of a race page (which race, which part, and whether by its fold, the bar or the line under the film), opening a trip page for a race for the first time in this browser (which race, or that it is one you added yourself, and whether you were signed in), being shown the Save this trip card (which race, and whether after your first answer or on a later visit), saving a trip (which race, and whether to an account or by email, never the address or anything you typed), opening the sign-in panel and which button opened it, switching it between signing in and creating an account, a sign-up our server turned down (the reason it gave, never the address you typed), signing in or creating an account (with a password or with Google), saving a race or taking it off your list again (where on the site, and whether you were signed in), choosing races to see side by side in My marathons (adding one, taking one out, or a fourth there was no room for, with which race and how many are compared), opening one of My marathons' tabs (which one), adding a race you ran to your passport (which race, never the year or your time), opening a map pin or using its zoom buttons, posting a comment, giving a High five, making or sharing a postcard (which kind of card and how it left, never what is on it), and asking for MARATHON NEWS by email (whether from the news page, an edition or your account, never the address). It never gets your name, your email or anything you typed into an account, because analytics runs whether or not you have one and never checks.

If you accept, your browser stores an anonymous analytics identifier in local storage, separate from your account. Analytics sets no cookie. We remove query parameters and fragments from page and referring URLs before sending them, so password-reset tokens, planner backup links and the trip links in a trip email are not counted. Two things survive. One is the four campaign tags that say where a visit came from, such as the ones on the link under a shared postcard. The other is, when a link opens a race page on a film chapter or a point on the course, which of the two it was, never the time or the kilometre. A postcard's own address is blanked before anything is counted, whether or not you accepted, because that address is what lets somebody see the card. So is the private part of the address of your film, a gift card or the page you shared your film on. Your browser's Do Not Track setting is respected even if you accept the banner, and it, or Global Privacy Control, turns off the anonymous counts too.

Your browser never talks to PostHog directly either: every one of those facts goes to our own server first, the same door the weather and exchange-rate questions go through, and our server is what passes it on. That is a design choice, not a hiding place, since PostHog is still named here, and its own practices are its own to describe at their privacy policy. Nothing is recorded about how you use a page beyond the named actions above: there is no session recording and no watching where the mouse goes. How long a page stayed open and how fast it was are the two exceptions: a number of seconds and a few page-speed measurements, never what you did in that time.

One more count goes to PostHog, and it is about our own mail rather than any visitor: when we email an organisation about one of our films, or it answers, we count that mail by race, kind of organisation, language and the kind of answer, never the address, the organisation's name or anything either side wrote.

The choice is yours to change at any time from the "Cookie settings" link in the footer of every page, which reopens the same banner. Saying no there, having once said yes, stops the identifier and the named actions from that moment on and leaves only the anonymous counts; it does not reach back and remove what was already counted, because none of it named you in the first place.

The thin strip above the header about your own race film has a "Hide" button. Pressing it stores one small note in your browser's local storage, not a cookie, so the strip stays hidden on your next visit. It never leaves your machine, and clearing your browser's site data brings the strip back.

With your yes, we also note on each page whether that strip was showing or hidden, and whether you pressed it or Hide. When you press Confirm on the link in our email, our own server counts that a film was confirmed, for which race, with no identifier and nothing stored in your browser, the same way as the anonymous visit counts above, so it is counted whether or not you said yes here.

Watching a film

The films live on YouTube. Until you press play, the picture you see is our own copy of the opening frame and nothing on the page speaks to YouTube. Pressing play loads YouTube's player from youtube-nocookie.com, and from that moment YouTube, which is Google, receives what any website you open receives (your internet address and your browser's details) and may keep things in your browser under its own privacy policy. Pressing play is the choice; we learn nothing from YouTube about who watched. When a film ends, an Up next card counts down to the next race's film; if you let that countdown run out rather than pressing Cancel, the next race's page opens and loads YouTube's player for its film the same way, which counts as the same choice. Opening a link to a race page never starts a film by itself.

Pressing a hotel link

The hotel links on a race page and in your trip plan go to Stay22, a company that sends you on to a booking site with hotels near that place, and pays us a referral fee if you book there. Nothing on our page speaks to Stay22 until you press one. The link itself carries a place on the map, the nights, the race and which of our pages it was on, and nothing about you. Once you press it, your browser passes through an address of ours, which adds our Stay22 account to the link, keeps nothing and sends you straight on to stay22.com and then to the booking site. Stay22 and the booking site each receive what any website you open receives (your internet address and your browser's details) and may set its own cookies, on its own domain, under its own privacy policy. What comes back to us from Stay22 is the bookings made through these links, by race and page, so the fee can be paid; never your name or anything else about you.

Pressing an Amazon link

The race fuel plan on a race page links to a few products on Amazon, and the Running gear page to a few more, kit for race day, training and the days after; Amazon pays us a small fee if you buy through one of those links, and the price is the same for you. Two small links on a race page point at the gel: under the course profile, and one card beside the page or between two of its sections, which also opens the plan. A few running products link to Amazon the same way: a row of them at the foot of a race page and on the home page, and one line in a saved trip in My marathons. Nothing on our page speaks to Amazon until you press a link. Closing that card is remembered in your browser's local storage, so it stays closed on the next race page; it is never sent anywhere.

As an Amazon Associate I earn from qualifying purchases.

The link goes first to our own server. It uses the country your connection comes from, as our host, Vercel, works it out from your internet address, only to pick the nearest Amazon store: your own, or in the EU Amazon.nl or Amazon.de where we have no store for your country, or Amazon.com elsewhere (Amazon.nl for the few products Amazon.com does not sell), and sends you on to the product there (or the nearest equal one, where it is not sold) with our partner tag, and nothing about you. That country is not stored, not logged and not passed on.

Amazon then receives what any website you open receives (your internet address and your browser's details) and may set its own cookies, on its own domain, under its own privacy policy. What comes back to us from Amazon is the number of orders and what was ordered, so the fee can be paid; never your name or anything else about you.

Pressing the support link

A short card of our own, in the footer, on the story page and in My marathons, asks for a gift; it loads nothing from Ko-fi. Its link opens Ko-fi in a new tab, where you can give a gift towards the next film. Nothing on our page speaks to Ko-fi until you press it. Once you do, Ko-fi and the payment service you choose there handle the payment, receive what any website you open receives (your internet address and your browser's details) and may set their own cookies, on their own domain, under their own privacy policy. What comes back to us is the gift, the name and message you choose to leave, and the email address the payment was made from; we use that address only to say thank you, and never add it to a mailing list.

The flight drawn on a race page

The flight row in a race page's trip card can draw the flight you would take: the airport nearest you, the one nearest the race and the distance between them. To draw it, the page asks our own server, which uses the position our host, Vercel, works out from your internet address only to pick the airport nearest you. That position and that airport are not stored, not logged and not passed on, and no other company is asked anything.

Where it is kept

In a hosted Postgres database run by Supabase in Frankfurt, reached only by this site's own server code. The site itself is served by Vercel. Both of them hold the data in order to run the site and for nothing else. Nobody else is given access to it.

Vercel, Resend, ElevenLabs and Google are American companies, so what passes through them can be handled in the United States. That is allowed under EU law only with a safeguard in place, which for each of them is the EU-US Data Privacy Framework or the European Commission's standard contract clauses. Supabase keeps the database in the EU and PostHog counts in the EU.

One cookie is set, and only once you sign in: the one that keeps you signed in. It holds a session identifier and nothing about you. Signing out deletes it. The light or dark choice and the metric or imperial choice in the header are remembered by your browser rather than by a cookie, and they never leave the machine you set them on. Until you choose, the units start from your browser's time zone (miles in the United States, kilometres elsewhere), read on your machine and never sent.

The email we send

Two kinds about your own account: one when you make it, asking you to confirm the address, and one if you ask us to reset your password. And four kinds you ask for separately, MARATHON NEWS, a trip emailed to you, the mails about a race you follow, and the mails about a film you asked for, all described below. Nothing else: no announcement and no mail you did not ask for.

A password reset link works for one hour and can be asked for as often as you like from the reset page. Whatever happens to your password in the meantime, your races are recoverable a second way too: the backup link on My races is a complete copy of your list, and opening it in any browser brings it all back.

All of it leaves through Resend, a sending service, which is given the address and the message in order to deliver it and for nothing else.

MARATHON NEWS by email

If you sign up on the news page, tick the box for it straight after creating an account, or switch it on from your account page, we send you each edition of MARATHON NEWS on the day it is published, and nothing else. You do not need an account for it.

What we keep. Your email address; when you signed up, on which page (or that it was from your account), and which wording you agreed to; when you confirmed; which editions have been sent to you; and, for each one, a scrambled form of the unsubscribe link it carried. If you were signed in with the same address when you signed up, the subscription is also tied to your account.

Why, and on what basis. Only to send you the editions. The basis is your consent: you ask on the form, and you prove the address is yours by opening the link we send and pressing the button. Until you do, nothing is sent, and an address that is never confirmed is deleted after seven days. The one exception is asking from your account for your account's own address: confirming that address for the account is the same proof, so it confirms this too, and if it is already confirmed no second link is sent.

What the mail is. Plain text with a formatted copy in our own look: the edition's stories, their sources and a link to the edition on this site. Its one picture, our logo, travels inside the mail itself, so opening it loads nothing from us. No tracking pixel, and no link made unique to you except the one that unsubscribes you. We cannot see whether you opened it.

How to leave, and how long we keep it. Every edition has an unsubscribe link at the foot, your mail program's own unsubscribe button works too, and so does switching it off on your account page. Any of them deletes your address and everything above straight away; there is no list of people who left. Otherwise we keep it for as long as you stay subscribed. Deleting your account ends the subscription for that address as well.

A trip sent to your email

Without an account you can ask for a trip to be emailed to you, from Save this trip on My races. One mail goes to the address you type, and nothing else is ever sent to it because of that.

What is sent. The race, with its name, place and day taken from our own list; where you are with it (a place, the ballot, what is booked); the days you arrive and leave and the part of the day; the nights; how you get from the station or airport and how long that takes; the days around the race; who is coming, in one word; the start time the organiser published; and a link that opens the trip again. The link holds those things and nothing more, after the #, so opening it sends none of it to us. The mail also carries the race's postcard as a picture inside the mail itself, so opening it loads nothing from us, with links to share that postcard on WhatsApp, Facebook or X. If you saved a flight number, it is in the mail with a link to follow the flight on Flightradar24. If you saved where you are staying, the mail has a link to that place on Google Maps, made from what you saved; the name itself is not printed in the mail. To make those two, your browser sends us the flight number and the name of the place with the trip, and our server uses them for that mail only. Never in the mail: booking codes, airports, people's names, your notes or anything else you typed. A race you added yourself cannot be emailed.

What we keep. Not the address. Our server uses it once, to hand the mail to Resend, and does not store it or write it into a log. So that the button cannot be used to fill somebody's inbox, we keep three counters for at most two days (each counts over 24 hours, and the next daily clean-up deletes it): how many trip mails went to a scrambled (hashed) form of the address, how many came from a scrambled form of your internet connection, and how many went that day in total. Resend, which delivers it, keeps its own record of the delivery for a while under its own terms. The mail has no tracking pixel and no rewritten links, so we cannot see whether it was opened or a link in it pressed.

On what basis. You asked for it, so sending the one mail is doing what was asked. The counters rest on our legitimate interest in keeping the button from being misused, and hold nothing that names you.

Following a race

A race page lets you follow the race. Confirm your address and we mail you when the race's date, start time, entry or entry fee changes, or when its course map or race weekend times arrive on the page, and you get MARATHON NEWS as well (described above). You do not need an account for it.

What the mails are. Plain text with a formatted copy, its logo inside the mail itself: what changed on the race's page, a link to that page, and the race weekend's hotel and flight links, the same ones the page shows. Where a link pays us a referral fee when you book through it, the mail says so; the price is the same either way. No tracking pixel, and no link made unique to you except the one that stops the mails. The page links carry tags saying they came from a race mail, so a visit from one is counted as one, like any other visit.

What we keep. Your email address; the races you follow; when you asked, on which page and which wording you agreed to; when you confirmed; which mails went to you and when; and, for each one, a scrambled (hashed) form of the link that stops them. If you asked while signed in with a confirmed address, no link is sent and the follow is tied to your account; if you asked signed in before confirming it, confirming the account's address confirms the follow too. For each race followed we also keep what its page said when its followers were last mailed, so the next mail says only what changed; that holds nothing about you. So that the button cannot be used to fill somebody's inbox, we keep two counters for at most two days (each counts over 24 hours, and the next daily clean-up deletes it): how many asks came for a scrambled form of the address, and how many from a scrambled form of your internet connection.

Why, and on what basis. To send those mails and MARATHON NEWS. The basis is your consent: you ask on the page, which says what the mails carry, and you prove the address is yours by opening the link we send and pressing the button. Until you do, nothing is sent, and an unconfirmed request is deleted after seven days.

How to leave, and how long we keep it. Every mail has a link at the foot that stops every mail from us, and your mail program's own unsubscribe button works too. Either one deletes your address, every race you follow and your MARATHON NEWS subscription straight away. Otherwise we keep it for as long as you follow a race. A race whose page is taken down is unfollowed for everybody. Deleting your account deletes every follow for its address as well.

Taking it back, and deleting it

• A copy of everything. Your account page has a button that downloads the lot as a single JSON file: your account details, your full race list, your comments, your postcard links with the card each one shows, your MARATHON NEWS subscription if you have one, the races you follow and the films you asked for, as stored.
• Deleting the account. The same page deletes it. That removes your account, every session it has open, your whole race list, every postcard link you made, any MARATHON NEWS subscription, every race you follow for your address and every film request, with its film, from the database, immediately and for good. There is no thirty day window and no copy set aside. It cannot be undone, so take the download first if you want to keep anything.

Deleting the account does not reach into your own browser. The copy this browser holds stays where it is, yours to keep or to clear, exactly as it was before you ever made an account.

If we wrote to your organisation

We email race organisers, running clubs, charities, tourist boards and the running press about the film of their race. We only ever write to an address the organisation publishes itself, and we note where we found it. Each address gets one mail and at most one reminder about ten days later, then the conversation is closed. A reply stops any reminder.

We keep the address, the organisation's name, when we wrote and what kind of answer came back, because that record is what stops us writing twice about the same film. If you say no, or the mail bounces, the address moves to a list of addresses we never write to again and comes off our list of contacts. Ask us to delete the rest and it goes, with that one line on the list kept so the no holds. The mail is sent from a Gmail account, so Google carries it. The basis is our legitimate interest in telling the people around a race that a film of it exists, weighed against yours, which is why it is one mail to a published address and never a list.

Why we are allowed to

The law asks every use of personal data to rest on one of a few grounds, and here is which one each rests on. Your account, your races, your comments and your postcard links are kept because you asked for the service that needs them. A trip emailed to you is sent because you asked for it. A film you ask for is made because you asked for it. The analytics you accepted and MARATHON NEWS rest on your consent, which you can withdraw at any time, as described above. The session row, the password-guessing counter, the moderation notes and reports, the counter sent when the filter acts, the anonymous page and link counts and the outreach mail rest on our legitimate interest: keeping accounts and threads safe, knowing which pages are read and which links are used, and telling the people around a race about its film. Each holds no more than that interest needs, as each section above says.

Children

Accounts here are for adults. We do not knowingly keep data about anyone under sixteen, and if you tell us we have, it gets deleted.

If you want something changed

You can see, download and delete everything we hold from your own account page, which is the fastest route and needs nobody's help. For anything that page does not cover, write to contact@marathontrip.com.

The law gives you the right to see what we hold about you, to have it corrected, to have it deleted, to take a copy away with you, to limit what we do with it, and to object to anything that rests on our legitimate interest. You can ask for any of them, and you get an answer within a month. If you think we have handled your data wrongly, you can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the one where you live.