MyRaces app for iPhone and Android

Privacy policy

Last updated: October 24, 2026

Who is responsible

MyRaces is an app developed by Haritz Lopez (Spain). For any question about your data, write to hola@myraces.app. Full identification details are in the Terms of use.

What data we process

• Account: your email and password (stored in a way that not even we can read it). If you sign in with Apple, the identifier Apple gives MyRaces and the email you choose to share, which may be a hidden Apple address. If you sign in with Google (on Android), the identifier Google gives MyRaces and your Google account email.
• Profile: name, club, city and photo, if you add them.
• Your races and shoes: what you log in the app (dates, times, positions, bibs, costs, notes, preparation tasks…) and, if the race comes from the directory, its start location.
• Location: if you choose “Near me” in Explore, the app sends the server your location rounded to about 1 km, only to find nearby races. It isn't stored or linked to your account. You can remove the permission at any time in your phone settings.
• Calendar: if you allow it, the app looks in your phone's calendar for races you already have noted down. The search happens on the phone and only what you choose to add to your races is saved. If you add a race to your calendar, your phone creates the event after you confirm it.
• Health and activity data: if you ask for it on a race, we import from Apple Health (iPhone), Health Connect (Android), Strava or Polar the watch time, distance, elevation, heart rate, per-kilometer splits and GPS route of that activity.
• Strava and Polar suggestions: if you connect Strava or Polar, the service notifies us when you create, change or delete an activity. We read it to see whether it matches one of your races and, if it does, we keep a suggestion with the minimum needed to compare it (date, sport, duration, distance, elevation and heart rate) until you accept or dismiss it.
• What you publish: if you make your profile public, your public races, running-partner and bib ads, your reviews and the contact details you choose to share.
• Community safety: reports you send and users you block.
• Proposals and medals: races you suggest for the directory and, if you are an organizer, the official medal images you upload.
• Organizer claims: if you claim a race or organizer, the organization's name, your name and role, your contact email and phone, its website and whatever you tell us so we can verify it. Only we see it, to review the request and contact you.
• Bib alerts (Pro): the filters you save (text, race, distance and maximum price) so we can notify you when a matching bib is listed.
• AI coach (Pro): if you use it, your questions, the name and city in your profile (to find races near you) and the race data it needs to answer you (times, paces, splits and, only if you turn it on, heart rate and route) are sent to Anthropic to generate the answer. Conversations are stored only on your phone; our server only keeps your permission and how many questions you ask each day. We don't give Anthropic your name or email: only an anonymous code per account, so it can detect misuse.
• Notifications: an identifier for your phone to send you alerts, if you allow them. On iPhone they are delivered by Apple and on Android by Google (Firebase Cloud Messaging).
• Purchases: charged by Apple (App Store) or Google (Google Play); we don't receive your payment details. To make MyRaces Pro follow your account (also on other devices) we use RevenueCat, which receives your MyRaces account identifier and your Pro purchase history (which plan, when and whether it is active). RevenueCat notifies our server, which stores whether you have active Pro and until when, for the Pro badge and bib alerts.
• Launch notice: if you ask on myraces.app to be told when the app is released, your email and the language of the website.
• Technical data: the server logs the IP address and time of each request, for security and to fix errors.

To have an account you only need an email (or signing in with Apple or Google); everything else is optional and up to you. If you use the app without an account (guest mode), your data stays only on your phone and is never sent to a server. Locking the app with Face ID, fingerprint or passcode and saving images to your gallery work only on your phone: MyRaces receives nothing from them.

What we use it for, and on what basis

• To provide the service (performance of a contract): your account, saving your races to your devices, account emails, bib alerts and, if you connect Strava or Polar, suggestions.
• Your health data (explicit consent, Art. 9(2)(a) GDPR): only processed when you choose to import an activity. You can withdraw it at any time by removing the watch data from a race or deleting your account.
• To show other runners what you make public (consent, which you withdraw by making it private).
• To tell you when MyRaces is released (consent, when you leave your email on the website): a single email with the notice. No newsletters or marketing.
• To keep the community and the service safe, prevent abuse and fix errors (legitimate interest).
• The AI coach (consent, and explicit consent for heart rate and route, Art. 9(2)(a) GDPR): you withdraw it in Profile › Settings › Coach.
• To review organizer claims and check that the claimant really organizes the race (legitimate interest, so nobody can impersonate an organizer).

We don't use your data for advertising, we don't build commercial profiles and we don't make automated decisions with legal effects on you. Suggesting which Strava or Polar activity belongs to a race is automatic, but nothing is ever added without your confirmation.

Apple Health and Health Connect

The app only reads from Apple Health (iPhone) or Health Connect (Android) when you ask it to import a race, and never writes to them. On Health Connect it only asks to read workouts, their routes, heart rate, distance and elevation. Imported data is stored in your account so you can see it on your devices, is never public, and is not used for advertising or sold or shared with third parties. Use of information received from Health Connect complies with the Health Connect Permissions policy, including its Limited Use requirements.

Strava

Connecting Strava is optional. We only read your activities and never post anything to Strava. Access permissions are stored on our server and the data you import is only visible to you. If a race is public, at most a “View on Strava” link is shown, and only if you turn it on. You can turn off suggestions and their notifications, or disconnect Strava, in the app (Profile › Strava). If you revoke access from Strava or delete your account, we delete your permissions and pending suggestions; what you already confirmed stays in your races until you remove it.

Polar

Connecting Polar is optional. We only read your Polar Flow workouts and never post anything to Polar. To read them, Polar requires registering you in its service for apps (AccessLink) with an identifier of your MyRaces account, without your name or email. The permission is stored on our server and the data you import is only visible to you. When you upload a workout, Polar notifies us so we can suggest the matching race (you can turn off suggestions and their notifications). You can disconnect Polar in the app (Profile › Polar): when you disconnect it, or if you delete your account, we deregister you from AccessLink and delete the permission; what you already imported stays in your races until you remove it.

Sign in with Apple or Google

If you sign in with Apple, Apple gives us an identifier for your account and the email you choose (yours or a hidden one that forwards to your inbox). We don't ask for your name. When you delete your account, we revoke MyRaces' access to your Apple ID.

If you sign in with Google (on Android), Google gives us an identifier for your account, its email and, with them, your Google name and photo, which are stored with your account but the app doesn't use or show to anyone. You can remove MyRaces' access at any time from your Google account.

Weather and maps

To show you the forecast for race day, the iPhone app asks Apple (WeatherKit) for the coordinates of the race start and the race time; the Android app asks our server, which builds the forecast from public Open-Meteo data (CC BY 4.0) without sending them to anyone. Your location and account details are not sent for the forecast. To locate places and show the Explore map, the iPhone app uses Apple Maps and the Android app uses Google Maps, which receives the map area you are viewing.

Affiliate links

Some links in the app (for example, to running shoe shops or to places to stay near a race) are affiliate links, and we always say so: if you buy or book, the shop pays us a small commission and it costs you nothing extra. When you tap them they go through myraces.app, which only counts how many clicks each link gets per day, without storing who you are. For places to stay we send the town and the race dates so the destination site opens its search already filled in; we don't store them. From then on, that site's privacy policy applies.

Where it's stored and how it's protected

On our own server hosted by Hetzner in Finland (European Union). The disk is encrypted, all connections are encrypted (HTTPS), a firewall only lets through what is needed and database rules prevent anyone from seeing your private data. We make daily backups, also encrypted.

Who we share it with

• Hetzner (Germany, server in Finland), server hosting, as data processor.
• Brevo (France), to send account emails (the code to confirm your email or change your password) and the launch notice.
• Apple, for Sign in with Apple and, on iPhone, notifications, weather forecasts, maps and purchases.
• Google (Ireland and USA), on Android, for Sign in with Google, notifications (Firebase Cloud Messaging), maps and Google Play purchases.
• RevenueCat (USA), to manage MyRaces Pro purchases on your account, as data processor.
• Strava, only if you connect it.
• Polar (Finland), only if you connect it.
• Anthropic (USA), only if you use the AI coach, as data processor: it doesn't use this data to train its models and deletes it within 30 days. If its systems detect use that breaks its policies, it may keep that conversation for up to 2 years.
• Other users only see what you make public.

Some of these services are provided by US companies. When they involve transferring data outside the European Union:

• Apple and Google participate in the EU-US Data Privacy Framework.
• RevenueCat and Anthropic process data on our behalf under a data processing agreement that includes the European Commission's standard contractual clauses.
• Strava processes your Strava account data as a controller, under its own privacy policy, and covers transfers of your Strava data with standard contractual clauses.

The myraces.app website

The website only uses two technical cookies that it needs to work: myraces-session, which keeps your visit going (for example, the language you choose), and XSRF-TOKEN, which protects the launch-notice form against forged submissions. Both expire after 2 hours. We don't use analytics or advertising cookies, so we don't ask for your consent. If you choose the light or dark theme, it's saved in your browser and never reaches us. Fonts are served by Bunny Fonts (Slovenia, European Union), which receives your IP address to deliver them and doesn't use cookies.

How long we keep it

• Your data, for as long as you have an account.
• Strava and Polar notifications, 30 days; suggestions, until you accept or dismiss them.
• The launch-notice email, until we send that notice; then it is deleted. If you want us to delete it sooner, write to hola@myraces.app.
• Technical server data, about 4 weeks.
• When you delete your account (Profile › Account and security › Delete account), your account, races, profile, photos and everything you published are deleted immediately. Backups rotate and disappear within about 14 days. If someone reported something of yours, the report is kept, but without data that identifies you. We also keep how many coach questions were used during the free Pro trial, linked to the purchase and not to you (without your account or your messages), so the trial can't be repeated.

Your rights

You can access, correct, delete or take your data with you, object to or ask us to restrict its use, and withdraw your consent at any time. Almost everything can be done from the app (which also exports your races as CSV); for anything else, including a full copy of your data, write to hola@myraces.app. If you think we haven't handled your data properly, you can file a complaint with the Spanish Data Protection Agency (AEPD).

Minors

You must be at least 16 years old to create an account. Posting running-partner or bib ads, or getting in touch through them, requires being an adult.

Changes

If we change this policy, we'll update the date above and, if the change is significant, let you know in the app.