Privacy Policy

What eachrace is

eachrace turns your workout history into a map of everywhere you've been. This policy explains what data it collects, how it's used, and who else sees it.

How you sign in

There's no password - you sign in via OAuth through a fitness platform you already use (Suunto, Strava, Garmin, Coros, or Polar, depending on what's enabled). We never see or store your password for that platform. We receive an access token (and a refresh token, where the provider issues one) that lets us fetch your workout data on your behalf, and a provider-issued account identifier used to recognize you on future visits.

Those tokens expire if they aren't used, so we refresh them periodically in the background even when you haven't recorded anything - without that, a quiet few months would silently disconnect your account. If a provider tells us the authorization has expired for good, we record that (along with the reason the provider gave) and ask you to reconnect the next time you visit. Nothing about this gives us any access beyond what you originally granted, and disconnecting a provider from your account page stops it entirely.

Where a provider lets you choose what to share (Garmin does), we also record which of those permissions you granted, so we can tell you when something you've asked for needs a setting changed on their side rather than silently doing nothing. We only ever read that list - changing it is done in your provider's own account settings, never here.

What we collect

• Account info: a display name (taken from your connected provider account, or one you set yourself), and the provider account identifiers/tokens described above.
• Workout data: GPS traces, sport type, distance, duration, and timestamps - either fetched automatically from a connected provider, or from a .fit file you upload directly.
• Derived map data: which map grid squares and geographic boundaries (countries, cities) your workouts have passed through, computed from the data above to render your coverage map and track progress on any challenges you've joined.
• Derived training data: a score for each workout, computed from its heart rate, power or pace against a threshold estimated from your own earlier workouts in the same sport, and the fitness, fatigue and form figures on your dashboard that are summed from those scores. The score appears on a workout's shared link; the threshold behind it, and the dashboard, are shown only to you.
• Workouts you plan: the title, sport, day, notes and blocks of each workout you plan on your dashboard's training calendar. They are shown only to you and are never included in a shared link.
• Your uploaded/fetched file, and what our own decoder reads from it: the original .fit file is kept, and we store a summary of what it contains - its header, whether it is internally consistent, how many messages of each kind it holds, and its file_id message, which includes the manufacturer, product and serial number of the device that recorded it, and the UTC offset the device was set to when recording. This is shown only to you, on your own workouts, and only if you turn on "Geek mode" in your account settings. It is never included in a shared link.
• Basic technical data: standard web server logs, and - only when something goes wrong - error/crash reports (see "Error monitoring" below).

We don't collect your email address, real name, or payment information - none of that is needed for anything this app does.

How your data is used

Solely to run the app for you: authenticating your sessions, fetching and displaying your workouts, and rendering your personal coverage map. We don't sell your data, use it for advertising, or share it with anyone beyond what's described below.

Sharing your data

Your map and workouts are private by default - visible only to you. You can generate a shareable link to your map or an individual workout; anyone with that exact link can view it without signing in. Treat it like any other link you'd only hand to people you trust - if you don't want a workout or map visible to others, don't share its link. A shared workout link never exposes the FIT-file details described above, including your device's serial number - those are visible only to you, signed in, on your own workouts.

Third parties

• Suunto / Strava / Garmin / Coros / Polar: used only to authenticate you and fetch the workout data you've authorized. See their own privacy policies for how they handle your data on their end.
• Error monitoring: in production, unexpected application errors may be reported to an error-tracking service, which can include technical request details. This only happens when something breaks - not for routine browsing.

Cookies

We use a session cookie to keep you signed in, and an optional "remember me" cookie (valid up to 30 days) so you're not signed out every time your session expires. Neither is used for tracking or advertising.

Data retention and deletion

We keep your data for as long as your account exists. There's no self-service "delete my account" button yet - if you'd like your data removed, contact us (see below) and we'll take care of it by hand.

Children's privacy

eachrace isn't directed at children, and we don't knowingly collect data from anyone under 13.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page.

Contact

Questions about this policy, or a data deletion request, can be sent to privacy@eachrace.com.