RacespotPrivacy policy
Racespot is all about your location during a race. That's personal, so we handle it with care: we only use what's needed to let people follow you live, we don't sell anything and we don't track you outside your race.
This is a translation of the Dutch privacy policy. If the two differ, the Dutch version prevails.
Who we are
Racespot is a service of MARSSLOT, the sole proprietorship of Marcellino Sloterdijk, based in the Netherlands (Piet Soerstraat 35, 5703 GM Helmond, Chamber of Commerce number 84018445). We are the controller of the data described in this policy. You can reach us at info@racespot.app.
In short
- Your location is only shared during your race: from the moment you start until you finish or stop. Not outside of that.
- Only people who have your link can follow you.
- Recorded cheers are kept for as long as the runner's race exists, so the runner can listen back, also on a new phone. If the runner deletes the race or their account, they are deleted.
- No ads, no trackers, no selling of data.
- You can delete your account and everything that comes with it yourself in the app.
When you run with the app
Your account
For an account we use your email address, a password (only stored encrypted, we can't see it) and the name you give us. If you go through the introduction in the app, we also keep your answers to a few questions, such as how you found Racespot and how often you run races. Legal basis: performance of the contract (your account) and, for the introduction questions, our legitimate interest in improving the app.
Your profile photo (if you set one)
If you set a profile photo in the app, we keep a reduced version (256 by 256 pixels). Your supporters see it in your dot on the follow page map, so anyone with your link. You turn that off with "Show my photo to supporters" in Profile, and you can remove the photo there too. If you delete your account, we delete it. Legal basis: consent (you choose whether to set a photo).
Your races
For each race we keep the name, date, distance, course, your goal time and the names you give to runners. This is needed to create the follow page. Legal basis: performance of the contract.
Your location during the race
When you tap I'm in my start pen, the app uses your phone's GPS. The app only starts sending location points (position, time, distance and speed) once you actually start running, and stops after the finish or when you stop yourself. We use them to show where you are on the follow page, to work out your time and distance, and to tell you when you're close to a supporter. We keep your route and result with your race, so you can look back at them in the app. The app first asks for location permission; you can always withdraw it in your iPhone's settings. Legal basis: performance of the contract and your consent for location.
During the race the app also sends your phone's battery level. If your battery is nearly empty (20% or less), your supporters see that on the follow page, so they know why your dot might stop.
To be able to fix problems, the app also sends technical data during a race, such as how many GPS readings come in per minute and whether the app is running in the foreground or background. No content, no contacts, nothing outside the app. Legal basis: legitimate interest (a reliable service).
Notifications
If you allow notifications, we keep a push address for your phone and your phone's language (so notifications arrive in your language), to let you know when someone is following you, shares a spot or records a cheer. Reminders in the week before your race are scheduled by the app itself on your phone. Legal basis: consent. You can turn notifications off in your iPhone's settings.
Strava (if you connect it)
If you connect Strava, we keep the keys Strava gives us and your Strava name. After a race we look up your run (time, distance and kilometre splits) to complete your result. Runs you marked as Race in Strava, including ones from earlier years, are added to your races as completed races (name, date, distance, time, kilometre splits and route); they stay until you delete them or your account. We only ask for read access and don't fetch heart rate or other health data. You can disconnect in the app or at Strava. Legal basis: consent.
Requesting a race
If you request a race in the app or on the website that isn't listed yet, we keep what you fill in (the race, city, date, website and your note), your language and your email address and name: in the app those of your account, on the website only if you fill them in yourself. Once the race is in, we email you once to let you know. Legal basis: legitimate interest (completing the race list and letting you know your race is in).
Using the app
The app counts per day how often it's opened, which screens are viewed and how far people get in the introduction, as plain numbers. Nothing is sent that could identify you or your phone: no account, no device ID, no location. This shows us what's useful and what could be better. Legal basis: legitimate interest. We keep these numbers for 400 days.
Weather
For the running weather we request a forecast for the location of the race (not yours). No personal data goes to the weather service.
When you follow or cheer
Following works without an account. What we use then:
- Your name, if you enter it. The runner then sees who's following. Without a name you're anonymous and only count towards the number of viewers.
- Your spot along the route, if you share it. Your spot is visible live to the runner (and possibly other viewers) for as long as you share it. After the race, the runner can look back at who was cheering along the course.
- Recorded cheers. Your recording goes to the runner and is kept on our server for as long as the runner's race exists, so the runner can listen back, also on a new phone. If the runner deletes the race or their account, we delete it. For old races without an account we delete it after 7 days. Our server automatically turns the recording into text (speech recognition by Cloudflare), so the runner can read back what you said; the text is deleted together with the recording. The runner's app can keep cheers and their text on their own phone, to listen back or share them in a race story.
- Settings in your browser, such as your name and language, only on your own device (local storage), so you don't have to enter them every time.
Legal basis: your consent, which you give by entering your name, spot or cheer yourself. You can stop sharing your spot at any time.
When you visit the website
Racespot.app doesn't place tracking or advertising cookies and uses no analytics service other than Cloudflare Web Analytics (without cookies, see below). Only your language choice is remembered by your own browser, so you land in the same language next time. Our hosting provider (Cloudflare) processes technical data such as your IP address to deliver the site securely and quickly. For the map, your browser loads files from external services (see who we share data with); they see your IP address when doing so. Legal basis: legitimate interest (a working and secure website).
We count per day how often the website and follow pages are viewed and how many races are started, as plain numbers. We keep nothing about you: no IP address, no cookie, nothing that can be traced back to a person. We keep these numbers for 400 days.
On the website (not on follow pages) we also use Cloudflare Web Analytics: it counts visits per page, country, device type and the site you came from. Without cookies, without tracking you across other sites and without keeping your IP address. Legal basis: legitimate interest (knowing which pages are useful).
Beta sign-up
If you sign up for the beta, we keep your email address, your language and when you signed up. We email you about the beta, for example an invitation to test the app through Apple's TestFlight, and once when the app is available. If we invite you to TestFlight, we give your email address to Apple for that purpose. After the launch email we delete your address within 30 days. You can unsubscribe at any time: via the unsubscribe link in the email, or email us and we'll delete your address right away. Legal basis: consent.
How long we keep data
| Data | Retention |
|---|---|
| Account, races, route and results | As long as your account exists. If you delete your account, we delete this. |
| A supporter's live spot | Disappears from the map after a few minutes without an update. |
| Who followed or cheered along the course (name, spot) | Just over a year (400 days), for your race and year overview. |
| Recorded cheers and their text on our server | For as long as the runner's race exists; deleted when the runner deletes the race or their account. Old races without an account: 7 days. |
| Push address | 180 days after last use. |
| Strava connection | Until you disconnect or delete your account. |
| Profile photo | Until you remove it or delete your account. |
| Race request | 90 days after we've handled it, or one year if it's still open. If you delete your account, we delete it right away. |
| Beta sign-up | Until 30 days after the launch email, or until you unsubscribe. |
Who we share data with
We don't sell data and don't share it with advertisers. We do work with service providers that process data on our behalf (processors), with agreements on security and confidentiality:
- Cloudflare: hosting of the website, storage of races, routes, cheers and beta sign-ups, and turning recorded cheers into text (Workers AI).
- Supabase: accounts and signing in, profile photos, the race list and race requests (servers in Ireland, EU).
- Resend: sending email, such as the beta emails, your account's confirmation code and the email that your requested race is in.
- Expo: sending push notifications to your phone, together with Apple (Apple Push Notification service), and delivering app updates (your phone downloads them from Expo). Apple also provides TestFlight, if we invite you to test the beta.
- Strava: only if you connect it yourself.
- OpenFreeMap (OpenStreetMap data): map tiles; unpkg and jsDelivr: map software. These services see your browser's IP address. We serve our fonts ourselves.
- MET Norway: weather forecast for the location of a race, without personal data.
Everything you share on a follow page (your name, spot or cheer) is visible to the runner, and a shared spot also to other viewers with the same link. The runner decides who the link is shared with.
We only give data to others if the law requires us to.
Outside the EU
Some service providers (such as Cloudflare, Resend, Expo and Apple) are based in the United States or process data there. We only use parties that offer appropriate safeguards, such as certification under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Security
Connections are encrypted (https). Passwords are not stored in readable form. A follow page can only be found with its link. On your phone, the app keeps sensitive keys in iOS's secure storage. If we discover a data breach that poses a risk to you, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, where needed, to you.
Your rights
You may access your data, have it corrected or deleted, have processing restricted, object, and receive your data in a common format. You can always withdraw consent; that applies from that moment on. You delete your account and everything that comes with it yourself in the app, under Profile. For everything else, email info@racespot.app; we respond within a month. We may ask you to confirm that the request comes from you.
Age
You can create an account from the age of 16. If you're younger, you need permission from a parent or guardian. Following works at any age; if you're a minor, it's best not to enter your full name.
Changes
If something important changes in how we handle your data, we update this policy and let you know in the app before it takes effect. The top of the page shows when the text was last updated.
Contact and complaints
Questions or a complaint? Email info@racespot.app. If we can't resolve it together, you can file a complaint with the Dutch Data Protection Authority or the data protection authority in your own EU country.