Privacy Policy

Introduction

Running.org ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you use our services - the Running.org website and web app and our mobile apps, together covering running clubs, events, race photos, training plans and the tools around them.

We only collect the information we need to provide these services. We never sell your personal information.

Information We Collect

Account Information

• Email address - used for account authentication and important notifications.
• Name - displayed to other club members, event organisers and, where you buy or sell photos, to the other party in a transaction.
• Phone number (optional) - for club communication purposes.
• Profile photo (optional) - displayed on your profile and in member lists.

Emergency Contact Information

• Emergency contact name and phone (optional) - stored securely and accessible only to club administrators for safety purposes during events.

Club & Event Data

• Club memberships - which clubs you belong to and your role.
• Event attendance - your RSVPs, pace group selections and attendance history.
• Forum posts and messages - communications you make within clubs and events.

Race Photos & Photo Search

• Uploaded photos - photographers who upload event galleries provide the photos, along with the event and gallery details attached to them.
• Face and selfie search data - to help you find yourself in an event gallery, we compute numerical face embeddings (mathematical representations of faces) from the photos in a gallery, and from the selfie you provide when you search by face. This data is biometric-adjacent; we use it only to match your selfie against the gallery you are searching, we do not use it to identify you elsewhere, and you can search without it by browsing or searching by bib number instead. Selfies you submit for a search are used for that search and are not published.
• Purchase and sale records - when you buy or sell photos through the photo marketplace, we store the transaction records (which photos, buyer and selling photographer, amounts and payment references).

Third-Party Integrations

• Activity services (Strava, Garmin) (optional) - if you connect an activity account, we store the service's athlete/account identifier and authentication tokens to display and sync your running activities and training.
• Photo libraries (Flickr, OneDrive, Google Photos) (optional) - if you connect a photo library to import photos, we use the access you grant to read the photos you choose to import and store authentication tokens for that connection. You can disconnect any integration at any time.

Payment Information

• Transaction records - we store records of payments for event fees, photo purchases and subscriptions.
• Payment processing - payments are processed securely through Stripe. We do not store your full card details. Photographers and clubs who receive payouts are onboarded through Stripe Connect and share the account information Stripe requires directly with Stripe.

Preferences

• App settings - your preferred units (km/miles), notification preferences and display settings.

How We Use Your Information

We use the information we collect to:

• Provide and maintain the functionality of the web and mobile apps.
• Enable club membership management and communication.
• Facilitate event organisation and attendance tracking.
• Help you find and buy your race photos, and let photographers sell them.
• Build and sync training plans with your connected activity services.
• Process payments, payouts and refunds for events, photos and subscriptions.
• Send important notifications about your clubs, events and purchases.
• Improve and personalise your experience.
• Ensure safety during events (emergency contact information).

Information Sharing

We share your information only in the following circumstances:

• With club members - your name, profile photo and attendance are visible to other members of your clubs.
• With club administrators - administrators can access member information including emergency contacts for safety purposes.
• Between buyers and sellers - when you buy or sell photos, the transaction details necessary to complete and account for the sale are shared with the other party.
• Service providers - we use trusted third parties who are contractually obligated to protect your data: Supabase (data storage), Cloudflare R2 (photo storage), Modal (machine-learning processing for photo and face search), Stripe (payments and payouts) and Resend (transactional email).
• Legal requirements - we may disclose information if required by law or to protect rights and safety.

We never sell your personal information to advertisers or other third parties.

Data Security

We implement appropriate technical and organisational measures to protect your personal information:

• All data is encrypted in transit using TLS/SSL.
• Data is stored securely on Supabase with row-level security policies.
• Photos are stored on Cloudflare R2 and served through access-controlled URLs.
• Authentication is handled securely with industry-standard protocols.
• Payment processing is PCI-compliant through Stripe.

Your Rights

You have the right to:

• Access - request a copy of the personal data we hold about you.
• Rectification - update or correct your personal information through the app.
• Deletion - request deletion of your account and associated data.
• Portability - request your data in a portable format.
• Withdraw consent - disconnect third-party integrations (such as Strava, Garmin or a connected photo library) at any time.

To exercise these rights, please contact us using the details below.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal or accounting purposes (for example, transaction records for completed photo and event purchases). Face embeddings computed for a photo search are retained only as needed to power gallery search and are removed when the underlying gallery is removed.

Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at privacy@running.org.