Privacy Policy

When you sign in with Google we receive your email, display name, profile picture URL and a unique account id, so we can show your account and let you sign back in.

When you upload a GPX file we store the route geometry, elevation and any waypoints/checkpoints. We don’t keep the original file beyond the parsed representation.

If you connect Strava we receive your athlete id, name and the metadata for run-like activities (distance, duration, elevation, date, type), used to import races and fit your pace. We don’t store full GPS traces from Strava activities.

When your crew uses a share-code we store the code, race id and expiry; the crew session is scoped to that one race.

We use Firebase Analytics (Google Analytics 4) to understand how the app is used: page views and key actions (e.g. creating a race, logging a checkpoint). Events are tied to a pseudonymous account id, never your email or other directly-identifying details, and aren’t used for advertising. Analytics only runs if you accept it in the cookie banner, and you can change that choice at any time in the Cookies section below.

• We don’t sell your data.
• We don’t share your data with advertisers or use it for ad targeting.
• We don’t email you marketing — only transactional messages (sign-in, invites).

Your data is stored in Google Cloud Firestore (US multi-region) and the app runs on Firebase App Hosting. Strava OAuth tokens are stored encrypted at rest by Google Cloud.

You can export your data, delete your account, or revoke Strava access from your settings at any time. Deletion removes your races, route data, splits, pantry, Strava tokens and access state; crew sessions for codes you generated stop working. See how to delete your account.

If you’re in the UK or EU you have rights under UK/EU GDPR including access, rectification, erasure and portability, and can withdraw consent at any time. Some activity and route data may be treated as special-category data; email us to exercise your rights (see Contact).

Essential. __session holds your signed-in session and is required for the app to work (httpOnly, secure, same-site). pacr-theme remembers your theme and pacr-active-race remembers which race you were looking at. None of these track you, so they don’t need consent.

Analytics (optional). If you accept analytics, Google Analytics sets _ga cookies to tell visits apart. If you decline, or before you choose, these are never set; if you withdraw consent, they are removed.

Questions or data requests? Email privacy@sub24.run. We aim to reply within 7 days.