Privacy policy

Who we are

RaceTale (racetale.com) is the service described on this page, and we are responsible for the personal data it handles. You can reach us at contact@racetale.com.

What we collect

It depends on how you use RaceTale.

• Owners (people who create a race): your email address, the name you give, your profile picture choice, and your races, results, routes, settings and purchases.
• Friends and family who add moments, without an account: the name and relationship you type, and the photos, clips and cheers you upload. We store a random device token in a cookie, and keep only a hash of it, so you can remove your own uploads later.
• Photo details: when a photo has a time and place in it, we read them to put the photo on the timeline and the route. We remove the place from every version we show to others.
• Anyone opening a story: your IP address reaches our servers and our service providers when a page loads. We use it briefly to limit abuse.
• Visitors to our home page and to our blog (blog.racetale.com): our own Matomo server counts the visit without cookies, using the page name, the site you came from, your approximate country and your browser type, with your IP address shortened before it is stored. If you also say yes to our analytics question, Google Analytics sets cookies and receives the page name, your approximate location, and your browser and device details. Neither runs on story, invite or account pages, or in the Android or iOS app.
• Email list subscribers (from the blog or the home page): your email address, the page you signed up on, the time you confirmed and, only if you choose to give it, your race date. We add it only after you confirm it by email, use it only to send you our guides and news, and you can unsubscribe from any email. The blog also keeps the guides you choose to save in your own browser; that list never leaves your device.

We do not use advertising trackers, and we do not sell personal data.

Why we use it

We use personal data to run the service you asked for, which is needed to provide it (GDPR Article 6(1)(b)):

• to sign owners in with an email link and keep their races;
• to place moments on a timeline and map, build the story, share cards, replay and downloads;
• to take payment for Pro and send a receipt;
• to email an owner before a race is deleted, and to answer messages sent to us.

We also rely on our legitimate interests (Article 6(1)(f)): letting a runner collect moments from friends and family who have no account, keeping the service secure and free of abuse (rate limiting, error reports with personal details removed), and answering reports. You can object to this at any time (see Your rights). We keep payment and tax records because the law requires it (Article 6(1)(c)). Where the law asks for your consent, we ask for it, and you can withdraw it at any time.

You do not have to give us any of this, but without an email address we cannot create an account, and without a name and a link a friend cannot add a moment.

If you join our email list, we send it because you asked and confirmed (Article 6(1)(a)), and you can withdraw that at any time by unsubscribing. We count visits to the home page and the blog with our own Matomo server, without cookies and with your IP address shortened, because we have a legitimate interest in knowing which pages help people (Article 6(1)(f)); you can object at any time by turning on Do Not Track in your browser or by writing to us, and we will stop counting you. We use Google Analytics there only if you say yes.

Who sees what

A story is private by default. It can only be opened through an unguessable link, and the owner can replace or close that link at any time. The page asks search engines not to index it.

The owner sees every upload first and chooses what is published. Friends are told this before they upload. Anyone with the story link can see the published moments, the runner's name and result, and the route. The owner can hide the first and last 200 metres of the route and delete a moment or the whole race, including every file.

Photos of other people and from organizers

If you upload a photo, you are responsible for having the right to share it and for taking care when it shows other people, especially children. Official race photos usually come with personal-use terms, so check that yours allow sharing online.

Anyone who sees a photo on a story can report it with the report button, and the owner is told. A photographer, or a person in a photo, can also write to contact@racetale.com. We will remove the photo unless a legal reason stops us, and we will answer within one month.

Who handles data for us

We use these services to run RaceTale. Most of them act only on our instructions and for the purpose given. Stripe also uses payment data for its own fraud prevention and legal duties, as its own controller, and Gravatar and OpenFreeMap receive a request from your browser directly.

• Supabase: accounts, races, uploads and storage. Hosted in the EU.
• Vercel: hosting and delivery of the site, which handles request data such as IP addresses.
• Stripe: payments for Pro. You enter your card on Stripe's page; we keep only a reference to the payment.
• Resend: email we send because of something you did or asked for, such as receipts, reminders before a race is deleted, and the daily summary of new photos on your races (you can turn it off in Profile or from the link in the email).
• OpenFreeMap: the map tiles, which receive the viewer's IP address and the map area being shown.
• Gravatar: if the owner turns it on, a hash of their email is sent to show their picture in the dashboard. It is never loaded on story or contributor pages and can be turned off on the Profile screen.
• Sentry: error reports with personal details removed.
• Matomo, on our own analytics server (analytics.yellowtentacle.com): counts visits to the home page and the blog without cookies, with IP addresses shortened and no data passed to anyone else. Google Analytics: only if you say yes on the home page or the blog. It counts visits to those pages and receives the page name and your browser and device details.
• Our own server: it hosts the blog at blog.racetale.com. Its access log records visitors' IP addresses and is kept for a short time to run and secure the site.
• Brevo, a French email service: our email list for the blog and the home page. It holds the address of each confirmed subscriber, the page they signed up on and the time they confirmed, and it sends the confirmation email and our newsletters. We do not add contributors, runners or account holders to it unless they sign up for the list themselves.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer relies on the safeguard the law requires, such as the EU-US Data Privacy Framework or standard contractual clauses, and you can ask us for a copy of the safeguard in use. We keep an up-to-date list of these services and review it before adding another.

How long we keep it

A race and everything in it is deleted one month after the race date on the free plan, and one year after the race date on Pro. We email the owner 7 days before (and 30 days before as well on Pro) so they can download what they want or upgrade.

Owners can delete a race, or their whole account, at any time, and friends can remove their own uploads. When something is deleted we remove its files too, apart from short-lived backups held by our database provider, which expire on their own. The device token that lets a friend remove their own uploads is kept for a year. Payment records are kept by Stripe and by us for as long as tax and accounting rules require.

Blog subscribers stay on our list until they unsubscribe. Write to us and we will delete the address.

Your rights

Depending on where you live, you can ask us to:

• show you the personal data we hold about you;
• correct it or delete it;
• give you a copy you can reuse (owners can download their data from the Profile screen);
• stop or limit how we use it, or object to a particular use.

Write to contact@racetale.com and we will reply within one month. You also have the right to complain to your local data protection authority.

Children

RaceTale accounts are for adults. We do not knowingly collect personal data from children through an account. A child can be a friend who adds a moment through a link, with a parent's agreement. A photo of a child can appear on a story if an adult uploads it, so the owner and the uploader are responsible for sharing only what they are comfortable with. If you see a photo of a child that should not be there, use the report button or write to us and we will act on it quickly.

Cookies and local storage

We use only what the service needs: a sign-in cookie for owners, a device token cookie that lets a friend remove their own uploads (kept for one year), and small settings in your browser such as your colour theme and which panels you left open. If you arrive from a tagged link (an advert, the blog or a flyer), your browser keeps the link's source tags for that tab only, and they are saved with your account when you sign up, so we can tell which channels bring owners. They hold no personal data. On the blog, your browser also keeps the guides you save and your analytics choice; neither leaves your device. We do not use advertising cookies. Our own Matomo analytics on the home page and the blog sets no cookies and stores nothing in your browser; it also stops counting you if your browser sends Do Not Track. If you say yes to our analytics question on the home page or the blog, Google Analytics sets cookies (named _ga and _ga_…, kept for up to two years) so it can count visits; you can change your mind from the link at the foot of the page, which removes them. If you say no, no Google script is loaded; on any other page and in the Android and iOS apps, no analytics script is loaded.

The Android and iOS apps

The Android and iOS apps show the same website inside the app, so everything on this page applies to them. They use the phone's share sheet to share a link or a card, and may keep a temporary file in the app's cache while they do. On an iPhone or iPad, when you choose to add a photo or video, the system may ask to use your photo library, camera or microphone; this happens only when you pick or record something to add, and what you choose is sent to us like any upload on the website. In the Android and iPhone apps, and in a web browser, you can turn on notifications (Profile, Notifications): the phone's or browser's push address is then stored with your account and sent, with a short message such as the number of new items on your race, to the push service that reaches it: Google Firebase Cloud Messaging for Android, Apple's push service for iPhone, and the browser maker's push service (Google, Apple, Mozilla or Microsoft) for a browser. Turn them off, or sign out, and it is removed. The apps do not read your contacts or location, and send no data to us beyond what the website does. Google Play and Apple's App Store, which distribute the apps, have their own privacy policies for the store. To request that your account and data be deleted, use the delete-account option on the Profile screen, or write to contact@racetale.com.

Security

Uploads go over an encrypted connection. Access to stored files is limited and short-lived links are used to show them. No service is perfectly secure. If a breach puts your rights at risk, we will tell the data protection authority and, where the law requires it, you.

Changes

If we change this policy in a way that matters, we will update the date at the top and, for owners, tell you by email.

Contact

Questions, requests or complaints about your data: contact@racetale.com.