Privacy policy
Last updated October 30, 2026
RaceTale helps a runner collect photos, clips and cheers from the people who were there and turn them into a private race story. This page explains what personal data we handle, why, who else handles it, and what you can do about it. Questions: contact@racetale.com.
Who we are
RaceTale (racetale.com) is the service described on this page, and we are responsible for the personal data it handles. You can reach us at contact@racetale.com.
What we collect
It depends on how you use RaceTale.
- Owners (people who create a race): your email address, the name you give, your profile picture choice, and your races, results, routes, settings and purchases.
- Friends and family who add moments, without an account: the name and relationship you type, and the photos, clips and cheers you upload. We store a random device token in a cookie, and keep only a hash of it, so you can remove your own uploads later.
- Photo details: when a photo has a time and place in it, we read them to put the photo on the timeline and the route. We remove the place from every version we show to others.
- Anyone opening a story: your IP address reaches our servers and our service providers when a page loads. We use it briefly to limit abuse.
- Visitors to our home page who say yes to our analytics question: Google Analytics sets cookies and receives the page name, your approximate location, and your browser and device details. It never runs on story, invite or account pages, and not in the Android app.
We do not use advertising trackers, and we do not sell personal data.
Why we use it
We use personal data to run the service you asked for, which is needed to provide it (GDPR Article 6(1)(b)):
- to sign owners in with an email link and keep their races;
- to place moments on a timeline and map, build the story, share cards, replay and downloads;
- to take payment for Pro and send a receipt;
- to email an owner before a race is deleted, and to answer messages sent to us.
We also rely on our legitimate interests (Article 6(1)(f)): letting a runner collect moments from friends and family who have no account, keeping the service secure and free of abuse (rate limiting, error reports with personal details removed), and answering reports. You can object to this at any time (see Your rights). We keep payment and tax records because the law requires it (Article 6(1)(c)). Where the law asks for your consent, we ask for it, and you can withdraw it at any time.
You do not have to give us any of this, but without an email address we cannot create an account, and without a name and a link a friend cannot add a moment.
Who sees what
A story is private by default. It can only be opened through an unguessable link, and the owner can replace or close that link at any time. The page asks search engines not to index it.
The owner sees every upload first and chooses what is published. Friends are told this before they upload. Anyone with the story link can see the published moments, the runner's name and result, and the route. The owner can hide the first and last 200 metres of the route and delete a moment or the whole race, including every file.
Photos of other people and from organizers
If you upload a photo, you are responsible for having the right to share it and for taking care when it shows other people, especially children. Official race photos usually come with personal-use terms, so check that yours allow sharing online.
Anyone who sees a photo on a story can report it with the report button, and the owner is told. A photographer, or a person in a photo, can also write to contact@racetale.com. We will remove the photo unless a legal reason stops us, and we will answer within one month.
Who handles data for us
We use these services to run RaceTale. Most of them act only on our instructions and for the purpose given. Stripe also uses payment data for its own fraud prevention and legal duties, as its own controller, and Gravatar and OpenFreeMap receive a request from your browser directly.
- Supabase: accounts, races, uploads and storage. Hosted in the EU.
- Vercel: hosting and delivery of the site, which handles request data such as IP addresses.
- Stripe: payments for Pro. You enter your card on Stripe's page; we keep only a reference to the payment.
- Resend: email, such as receipts and reminders before a race is deleted.
- OpenFreeMap: the map tiles, which receive the viewer's IP address and the map area being shown.
- Gravatar: if the owner leaves it on, a hash of their email is sent to show their picture in the dashboard. It is never loaded on story or contributor pages and can be turned off on the Profile screen.
- Sentry: error reports with personal details removed.
- Google Analytics: only if you say yes on the home page. It counts visits to that page and receives the page name and your browser and device details.
Some of these providers may process data outside the European Economic Area. Where they do, the transfer relies on the safeguard the law requires, such as the EU-US Data Privacy Framework or standard contractual clauses, and you can ask us for a copy of the safeguard in use. We keep an up-to-date list of these services and review it before adding another.
How long we keep it
A race and everything in it is deleted one month after the race date on the free plan, and one year after the race date on Pro. We email the owner 7 days before (and 30 days before as well on Pro) so they can download what they want or upgrade.
Owners can delete a race, or their whole account, at any time, and friends can remove their own uploads. When something is deleted we remove its files too, apart from short-lived backups held by our database provider, which expire on their own. The device token that lets a friend remove their own uploads is kept for a year. Payment records are kept by Stripe and by us for as long as tax and accounting rules require.
Your rights
Depending on where you live, you can ask us to:
- show you the personal data we hold about you;
- correct it or delete it;
- give you a copy you can reuse (owners can download their data from the Profile screen);
- stop or limit how we use it, or object to a particular use.
Write to contact@racetale.com and we will reply within one month. You also have the right to complain to your local data protection authority.
Children
RaceTale accounts are for adults. We do not knowingly collect personal data from children through an account. A child can be a friend who adds a moment through a link, with a parent's agreement. A photo of a child can appear on a story if an adult uploads it, so the owner and the uploader are responsible for sharing only what they are comfortable with. If you see a photo of a child that should not be there, use the report button or write to us and we will act on it quickly.
Cookies and local storage
We use only what the service needs: a sign-in cookie for owners, a device token cookie that lets a friend remove their own uploads (kept for one year), and small settings in your browser such as your colour theme and which panels you left open. We do not use advertising cookies. If you say yes to our analytics question on the home page, Google Analytics also sets cookies (named _ga and _ga_…, kept for up to two years) so it can count visits; you can change your mind from the link at the foot of the page, which removes them. If you say no, or on any other page and in the Android app, no analytics script is loaded.
The Android app
The Android app shows the same website inside the app, so everything on this page applies to it. It uses the phone's share sheet to share a link or a card, and may keep a temporary file in the app's cache while it does. It does not read your contacts or location, and sends no data to us beyond what the website does. Google Play, which distributes the app, has its own privacy policy for the store. To request that your account and data be deleted, use the delete-account option on the Profile screen, or write to contact@racetale.com.
Security
Uploads go over an encrypted connection. Access to stored files is limited and short-lived links are used to show them. No service is perfectly secure. If a breach puts your rights at risk, we will tell the data protection authority and, where the law requires it, you.
Changes
If we change this policy in a way that matters, we will update the date at the top and, for owners, tell you by email.
Contact
Questions, requests or complaints about your data: contact@racetale.com.