Privacy Policy

What eachrace is

eachrace turns your workout history into a map of everywhere you've been. This policy explains what data it collects, how it's used, and who else sees it.

How you sign in

There's no password - you sign in via OAuth through a fitness platform you already use (Suunto, Strava, Garmin, Coros, or Polar, depending on what's enabled). We never see or store your password for that platform. We receive an access token (and a refresh token, where the provider issues one) that lets us fetch your workout data on your behalf, and a provider-issued account identifier used to recognize you on future visits.

Those tokens expire if they aren't used, so we refresh them periodically in the background even when you haven't recorded anything - without that, a quiet few months would silently disconnect your account. If a provider tells us the authorization has expired for good, we record that (along with the reason the provider gave) and ask you to reconnect the next time you visit. Nothing about this gives us any access beyond what you originally granted, and disconnecting a provider from your account page stops it entirely.

Where a provider lets you choose what to share (Garmin does), we also record which of those permissions you granted, so we can tell you when something you've asked for needs a setting changed on their side rather than silently doing nothing. We only ever read that list - changing it is done in your provider's own account settings, never here.

What we collect

• Account info: a display name (taken from your connected provider account, or one you set yourself), and the provider account identifiers/tokens described above.
• Workout data: GPS traces, sport type, distance, duration, and timestamps - either fetched automatically from a connected provider, or from a .fit file you upload directly.
• Derived map data: which map grid squares and geographic boundaries (countries, cities) your workouts have passed through, computed from the data above to render your coverage map and track progress on any challenges you've joined.
• Derived training data: a score for each workout, computed from its heart rate, power or pace against a threshold estimated from your own earlier workouts in the same sport, and the fitness, fatigue and form figures on your dashboard that are summed from those scores. The score appears on a workout's shared link; the threshold behind it, and the dashboard, are shown only to you and the app's administrators (see "Sharing your data" below).
• Workouts you plan: the title, sport, day, notes and blocks of each workout you plan on your dashboard's training calendar. They are shown only to you and the app's administrators, and are never included in a shared link.
• Training plans you build: each plan's title, length, notes and workouts, shown only to you. When you put a plan on your calendar, we also keep a record of which plan it was and when it started, so the workouts it added can be moved or removed together. Those workouts carry the plan's title, so they are visible to the app's administrators like any other workout you plan.
• Your gear: the shoes, heart-rate belts and other equipment you add - each item's name, type, brand and model, the dates you started and stopped using it, the distance it had before you added it, any replacement limits, the sports it is your default for, and your notes - and which of your workouts used which item. How far each item has gone is worked out from those workouts every time it is shown, not stored. Your gear is shown only to you and the app's administrators, and is never included in a shared link.
• Your uploaded/fetched file, and what our own decoder reads from it: the original .fit file is kept, and we store a summary of what it contains - its header, whether it is internally consistent, how many messages of each kind it holds, and its file_id message, which includes the manufacturer, product and serial number of the device that recorded it, and the UTC offset the device was set to when recording. This is shown only to you, on your own workouts, and only if you turn on "Geek mode" in your account settings - and then also to the app's administrators, who see your workouts as you do. It is never included in a shared link.
• Basic technical data: standard web server logs, and - only when something goes wrong - error/crash reports (see "Error monitoring" below).

We don't collect your email address, real name, or payment information - none of that is needed for anything this app does.

How your data is used

Solely to run the app for you: authenticating your sessions, fetching and displaying your workouts, and rendering your personal coverage map. We don't sell your data, use it for advertising, or share it with anyone beyond what's described below.

One use goes beyond your own account: how many of the app's users, and how many of their workouts, have been in each country - counted together, never who - helps decide which countries' races to add to the races calendar first. Only the app's administrators see those counts.

Sharing your data

Your map and workouts are private by default - visible only to you and the app's administrators, who can view your map, workout list, dashboard and gear read-only to check how the app shows them to you. You can generate a shareable link to your map or an individual workout; anyone with that exact link can view it without signing in. Treat it like any other link you'd only hand to people you trust - if you don't want a workout or map visible to others, don't share its link. A shared workout link never exposes the FIT-file details described above, including your device's serial number - those are visible only to you, signed in, on your own workouts, and to the app's administrators.

Third parties

• Suunto / Strava / Garmin / Coros / Polar: used only to authenticate you and fetch the workout data you've authorized. See their own privacy policies for how they handle your data on their end.
• Error monitoring: in production, unexpected application errors may be reported to an error-tracking service, which can include technical request details. This only happens when something breaks - not for routine browsing.

Cookies

We use a session cookie to keep you signed in, and an optional "remember me" cookie (valid up to 30 days) so you're not signed out every time your session expires. Neither is used for tracking or advertising.

Data retention and deletion

We keep your data for as long as your account exists. There's no self-service "delete my account" button yet - if you'd like your data removed, contact us (see below) and we'll take care of it by hand.

Gear is the exception: you can delete an item yourself, from its edit page. That removes the item and its links to your workouts; the workouts themselves stay.

Children's privacy

eachrace isn't directed at children, and we don't knowingly collect data from anyone under 13.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page and keep the previous version, linked below.

Contact

Questions about this policy, or a data deletion request, can be sent to privacy@eachrace.com.