Privacy

Without an account, nothing reaches us

Every race you save on My races is kept by your own browser. It is not sent anywhere, and we cannot read it. That is still how the site works if you never make an account, and it is why the backup link on that page is a link rather than a button: the part after the # in a web address is never sent to a server, so a plan you share with a training partner goes from your browser to theirs and past nobody.

What an account stores

Making an account adds three things to a database we run, and nothing else.

• Who you are. Your email address, the name you typed if you typed one, and your password in a scrambled form that cannot be turned back into your password. If you signed in with Google instead, we hold the account identifier Google gives us and no password at all.
• Your races. The list you build on My races, exactly as that page holds it: the races you saved or typed in yourself, the city you set as home, and everything you wrote against each race. That now includes the trip you plan around one, so it can hold the flight numbers and times you typed, the name and confirmation code of the place you are staying and its two dates, how you are getting in from the airport, the bib pickup and start time off the race pack, who is coming with you, the days either side, and the dates, goals, notes, budget lines, checklists and finish times as before. All of it is typed by you and none of it is a booking: nothing here reserves anything, and nothing is added to your list that you did not enter.
• What keeps the door shut. The row that remembers you are signed in also holds the internet address your device connected from and the name your browser gives itself. It goes when that session goes, so signing out or deleting your account takes it too. Separately, and with no name or account attached to it, a counter against that same internet address is what stops somebody trying passwords at a machine's pace. It is a number and a time, it belongs to the address rather than to you, and it is the one thing on this page that deleting your account does not reach.

There is no advertising on this site, and your race list is not used for any purpose other than showing it back to you. We do not sell anything to anybody. Planning a trip does send two questions out of the building, and neither one is about you: our own server asks Open-Meteo what the weather does at the race city's coordinates on that date, and the European Central Bank's published rates for one exchange rate. Your browser never speaks to either of them, and what leaves here is a latitude, a longitude, a date and two currency codes, with nothing attached that says who asked.

Cookies and analytics

A banner asks, the first time you visit, whether we can count what pages get read. Say no, or say nothing, and nothing here changes: only the two things "Where it is kept" already describes ever run. Say yes, and this site starts sending PostHog, an analytics company with servers in the EU, three kinds of fact: which pages you open, your approximate location worked out from your internet address (never the address itself, which is discarded once that is done), and a short, fixed list of named actions, such as pressing play on a film, saving a race or panning the map. It never gets your name, your email or anything you typed into an account, because analytics runs whether or not you have one and never checks.

Your browser never talks to PostHog directly either: every one of those facts goes to our own server first, the same door the weather and exchange-rate questions go through, and our server is what passes it on. That is a design choice, not a hiding place, since PostHog is still named here, and its own practices are its own to describe at their privacy policy. Nothing is recorded about how you use a page beyond the named actions above: there is no session recording and no watching where the mouse goes.

The choice is yours to change at any time from the "Cookie settings" link in the footer of every page, which reopens the same banner. Saying no there, having once said yes, stops the counting from that moment on; it does not reach back and remove what was already counted, because none of it named you in the first place.

Where it is kept

In a hosted Postgres database run by Supabase, reached only by this site's own server code. The site itself is served by Vercel. Both of them hold the data in order to run the site and for nothing else. Nobody else is given access to it.

One cookie is set, and only once you sign in: the one that keeps you signed in. It holds a session identifier and nothing about you. Signing out deletes it. The light or dark choice in the header is remembered by your browser rather than by a cookie, and it never leaves the machine you set it on.

We send no email

Not one. There is no confirmation message, no announcement and nothing to unsubscribe from. Your address is what you sign in with, and that is all it is for.

That has one consequence worth knowing before you need it: there is no way to reset a forgotten password, because there is nowhere to send the link from. Keep your password somewhere you can find it. Whatever happens to the password, your races are recoverable a second way: the backup link on My races is a complete copy of your list, and opening it in any browser brings it all back.

Taking it back, and deleting it

• A copy of everything. Your account page has a button that downloads the lot as a single JSON file: your account details and your full race list, as stored.
• Deleting the account. The same page deletes it. That removes your account, every session it has open and your whole race list from the database, immediately and for good. There is no thirty day window and no copy set aside. It cannot be undone, so take the download first if you want to keep anything.

Deleting the account does not reach into your own browser. The copy this browser holds stays where it is, yours to keep or to clear, exactly as it was before you ever made an account.

Children

Accounts here are for adults. We do not knowingly keep data about anyone under sixteen, and if you tell us we have, it gets deleted.

If you want something changed

You can see, download and delete everything we hold from your own account page, which is the fastest route and needs nobody's help.