PRIVACY

Last updated: 5 October 2026.

Who handles your data

The organizer’s identity will be published before live enrollment opens.

Player account

We store your email, a salted password hash, player ID, display name, and account date to operate your account. Your email is private. A session cookie keeps you signed in for up to seven days; only its hash is stored on the server. No X account is connected.

Stripe verification

We store your Stripe account ID and an encrypted restricted key. We read charges, refunds, disputes, customer details, and required account data to verify eligibility, calculate revenue, and review suspicious patterns. Customer email addresses and card fingerprints are stored only as keyed hashes, never as raw customer emails or card numbers. Customer names are compared in memory and are not retained.

Public race data

When you enter, you explicitly agree to public display of your player name, product, revenue, rank, and cards. Your product link can send visitors to another site. Opening the X share button sends only the text you choose to share to X; the service never posts for you.

Retention

Disconnecting deletes the stored Stripe key immediately and withdraws unconfirmed runs. All keys for a race are deleted when results are confirmed. Customer email and card hashes are removed after 90 days. Expired sessions and rate-limit records are cleaned by the scheduled worker. Anonymous race records and review actions can remain for score integrity.

Deletion and your choices

My Run lets you disconnect Stripe or permanently delete your account. Deletion removes your account, email, password, sessions, public identity and product information, and associated charge evidence. Anonymous score totals remain. Shared images and copies already posted by others cannot be removed from their accounts by this service. To request access, corrections, or discuss your data, contact the organizer.

Providers and cookies

Stripe supplies verification data. Frankfurter supplies public historical exchange rates; no customer or player information is sent in those requests. The application host and database process the information needed to run the service. We use a necessary sign-in cookie and no advertising cookies. Hosting locations and the organizer’s contact details must be configured before live enrollment opens.

Your rights

You may have rights to access, correct, erase, restrict, object to processing, withdraw consent, or obtain your data in a portable format. You can also complain to your data protection authority. Withdrawing publicity consent ends an unconfirmed run; ask the organizer about removal of prior published results.