Privacy policy

Without an account. You can search races and try the season planner without signing up. A season you build is stored in a cookie in your browser (see Cookies), not on our servers, until you create an account.

With an account, we store what you give us:

• Your email address and username. Your password is stored only as a secure hash by our authentication provider; we never see it.
• Your season: the races you add, their A/B/C priority, and any races you enter yourself.
• Your home location, if you set one. We keep only a ZIP code. If you use “use my location”, your browser's coordinates are used once to find the nearest ZIP code and are not stored.
• Your athlete profile, if you fill it in: sports, experience, weekly training volume, goals, and race results you enter (distance, time, date).
• Races you submit to the catalog, with any notes you include.

Automatically. Our hosting provider records standard server logs (such as IP address, browser type, the page requested and the time) to run and secure the service. We don't use analytics, advertising or tracking cookies.

• To run your account and sign you in, including sending confirmation, sign-in and password-reset emails.
• To plan your season: training blocks, tapers, recovery and conflict warnings.
• To suggest races near you and races that suit your level, and to show how a race fits your season.
• To review races you submit and add them to the catalog.
• To keep the service secure, prevent abuse and fix problems.

We don't sell or rent your personal information, and we don't use it for advertising.

• Sign-in cookies keep you signed in. They're set when you sign in and removed when you sign out.
• Trial season cookie (kr_guest_season) holds a season you build without an account, for up to 90 days. It contains only the races and priorities you chose. When you sign up or sign in, it's moved into your account and removed.

These cookies are needed for the features you use, so there's no option to turn them off. We use no others.

We use a few service providers to run Keyrace. They process data on our behalf and only as needed to provide their service:

• Supabase: our database and account sign-in.
• Vercel: hosting, and the server logs described above.
• Resend: delivers our account emails.
• OpenFreeMap: serves the map tiles your browser loads when you view a map, so it sees your IP address.

Registration sites. Race listings come from public sources such as RunSignup, BikeReg, RunReg, TriReg and ACTIVE, plus races added by hand. When you click a registration link you leave Keyrace, and that site's own privacy policy applies. Some of these links carry a referral code that tells the site you came from Keyrace, and we may earn a commission if you register. We never send them your account details.

We may also disclose information if required by law, or to protect the rights and safety of our users or Keyrace. If Keyrace is ever sold or merged, your information would transfer under this policy, and we'd tell you first.

Race pages can show how fast past editions of a race were. We build these from public results published by registration sites, and we keep only totals and averages (for example, the median finish time of a group of at least five people), never anyone's name or individual result.

We keep your account data until you delete your account. You can delete it any time from your account page. That permanently removes your account, season, home location, athlete profile, results and submitted races that haven't been reviewed. Races we've already added to the public catalog from your submissions stay in the catalog without your name. Server logs are kept by our hosting provider for a limited time.

You can also see and change most of your data yourself in the app. To ask for a copy of your data, or for anything you can't do yourself, email hello@keyrace.app. If you live in a place that gives you privacy rights (such as California or the EU), you can use them the same way, and we won't treat you differently for doing so.

Connections to Keyrace are encrypted, passwords are hashed, and each person's season and profile are only readable by their own account. No system is perfectly secure, so please use a password you don't use elsewhere.

Keyrace is not meant for children under 13, and we don't knowingly collect their information. If you think a child has given us personal information, email hello@keyrace.app and we'll delete it.

Keyrace is run from the United States, and your data is stored and processed there.

If we change this policy, we'll update the date at the top. If a change materially affects how we use your information, we'll tell account holders by email or in the app before it takes effect.

Questions or requests: hello@keyrace.app.