Privacy policy

Last updated: 2026-10-21

This page explains what this site stores about you and why. “We” and “the operator” mean the operator of this site; use the Contact page to reach them. This text describes how the site software behaves today.

The short version

Browsing races needs no account. If you create an account we store your email address and either a password hash or your Google identity, plus the races you follow. We do not sell data, send marketing email, take payments or show ads. Whether analytics cookies are set depends on how this site is configured; see “Analytics and statistics” below.

What we collect

Without an account:

An anonymous session: a random identifier (kept in the sl_session cookie) and a security token that protects forms. The server stores only a hash of the identifier.
Search words and filters you type appear in the page address of the request, like any web request. The site itself does not keep a search history.
A correction report, if you send one: the race it refers to, the category, the message you write (up to 1,000 characters) and the time. It is not linked to your account or session. Please do not include personal information.

With an email account:

Your email address (stored in lower case) and a salted scrypt hash of your password. We never store the password itself.
Your language and time zone preference, the account creation time and whether the email is verified.
Verification codes and password reset tokens, stored only as hashes (see Retention).
The races you follow and when you followed them.

With Google sign-in:

Google’s stable identifier for your account (“subject”) and the email address Google reports as verified. We request the openid, email and profile permissions but store only those two values; Google tokens are discarded and your name and photo are not stored.
If an account with the same verified email already exists, the Google identity is attached to it. The first Google sign-in otherwise creates a new account.

Why we use it

We do not use your data for marketing email. Following a race does not register you, reserve a place, make a payment or notify an organizer.

To create and secure your account, sign you in, and send the one-time code or reset link you ask for.
To keep your personal list of followed races and show your language and time zone.
To protect the site: rate limits use hashed identifiers, and forms require a security token.
To count aggregate usage (see Analytics and statistics) and to review correction reports by hand.

Who processes data

Mail delivery: to send a verification code or password reset link, the site sends your email address and the code or link to the operator’s mail-delivery service (a self-operated mail workbench). It also receives short business events (for example “registration completed”) that carry no personal data.
Google: if you choose Google sign-in, your browser goes to Google and Google returns your verified identity to the site. If analytics is enabled and you have not opted out or declined it, Google Analytics also receives page views (see below). Google handles that data under its own policies.
Site statistics service: the site can send the operator’s own statistics service one daily aggregate: registration count, total accounts and enabled accounts, with the site identifier and domain. It contains no email address, user identifier, IP address or page content.
Hosting: the site software does not write an access log of its own. The server or network that hosts it may keep standard technical logs; that is outside this software.
Official race pages are third-party sites that open in a new tab. They have their own privacy policies. This site tells them nothing about you; it sends no referrer when you follow those links.

Cookies and browser storage

These are all the cookies and storage keys the site sets.

Name	Purpose	Lifetime	Consent
`sl_session`	Keeps you signed in, or identifies your anonymous visit, and protects form submissions against forgery. Set only when you use a feature that needs it (such as loading sign-in or a form action), not when you merely read a page; set before you sign in. HttpOnly, SameSite=Lax, and Secure on https.	7 days	Not asked: needed to run the site
`sl_oauth_locale (/api/auth/google)`	Remembers the page language while you sign in with Google. Only sent to /api/auth/google and removed when the sign-in finishes.	10 minutes at most	Not asked: needed for Google sign-in
`sl_analytics_optout`	Remembers that you chose to stop analytics on this browser. Only exists on a site where analytics is configured, and only after you use the opt-out control on the privacy page.	12 months	Not asked: it stores your opt-out
`_ga, _ga_<measurement id>`	Google Analytics cookies that count visits. Set by Google, not by this site, by default unless you opt out; they are removed when you opt out.	Set by Google	Set by default unless you opt out
`startline.dp003.start-point.v1`	Browser sessionStorage (not a cookie). Holds the city or ZIP text you type as your starting point. It stays in this tab only, is never sent to your account, and disappears when the tab is closed. Selecting “Find races in this place” puts the text in the search address.	Until the tab is closed or you clear it	Not asked: you save it yourself

Analytics and statistics

Analytics is enabled on this site and is on by default. By visiting and using this site you agree to Google Analytics cookies being set in your browser (see the cookie table above for the names, purpose and duration). Google Analytics receives page-view data (page path, language, browser and approximate location) to produce visit statistics. You can opt out at any time with the control below; the operator can change this arrangement, and this page will say so.

Analytics on this browser

Analytics is currently on for this browser.

Google Analytics opt-out browser add-on

How long we keep data

Sessions last 7 days, and are deleted when you sign out, when you reset your password, or when you delete your account. A session that has expired is refused, but the site does not yet delete expired session, rate-limit, verification-code or sign-in-state rows automatically; they remain in the database until replaced, used or removed.
Registration codes are valid for 10 minutes with at most 5 attempts; password reset links are valid for 30 minutes and work once. They are stored only as hashes.
Mail waiting to be sent holds your address and the code or link until it is delivered, then is deleted. Mail that cannot be delivered, or that has expired, has the address and content erased, and its record is removed after 7 days.
Your account, followed races and Google link are kept until you delete the account.
Correction reports are kept for manual review and are not deleted automatically. Daily aggregate counters contain no personal data and are kept.
If the operator keeps backup copies of the database, a deleted account can remain in those copies until they are replaced or deleted.

Your choices and rights

You can delete your account yourself: sign in, open My, and use “Delete my account”. You confirm with your password (or, for an account that has no password, by typing your email address within 10 minutes of signing in with Google). Deletion removes your account, sessions, followed races, verification codes and reset tokens, your Google link, and any waiting mail addressed to you. It cannot be undone. A Google sign-in afterwards creates a new, empty account.

The site has no self-service export or email-change feature. For any other request about your data, such as a copy, a correction or a question, use the Contact page. We will look at the request; we do not promise a particular legal outcome.

You can change your analytics choice at any time with the control described under “Analytics and statistics” on this page, and you can clear cookies and tab storage in your browser.

International transfers

Google and the mail-delivery service may process data in countries other than yours. By using Google sign-in, analytics (when enabled) or email verification you accept that your data goes to those services as described here.

Children

This site is not directed to children and is not designed for them to create accounts. If you believe a child has an account, contact us through the Contact page and we will delete it.

Changes to this policy

We may update this policy when the site changes. The date at the top shows when it was last updated; material changes will be reflected here. See also the Terms of use.