In short: we collect what you give us and the public race results you link, to show your scores and help you find people to race. Your profile, scores and race history are public. We don't sell your data or show ads. You can delete your account and its data at any time from your profile.

1. Who we are

Someone2Race (https://someonetorace.com) is run by Someone2Race LLC, a Virginia limited liability company in the United States ("we", "us"). For anything about your data, email hello@someonetorace.com.

2. What we collect

From you

Account: your email address and password (stored by Google Firebase as a secure hash; we never see it), or your Google account's name, email and photo if you sign in with Google.
Profile: name, photo, short bio, home location (as you type it, e.g. a city) and main sport, and, if you add them, your Strava profile link and Instagram handle.
Races: the races you add as ones you're racing on Someone2Race (this doesn't enter you in the race itself), the distance and any goal time you set for them (shown to other signed-in athletes in that race, and used to match you with rivals), and races you submit.
Challenges: who you challenge, the messages you and the other athlete send each other (only the two of you can read them; we read them only if one of you reports a message, and you can send them until 30 days after the challenge is settled), stakes, head starts, the results you report and whether a stake was paid. If you turn on money stakes, your confirmation that you are 18 or older and any payment handles you add (e.g. a Venmo username).
Linked results: which official race results you say are yours. On the day of a race you have an accepted challenge for, we look for your sign-in name in that race's results: one match is linked to you, and if several runners share your name we keep that short list (name, time, age, hometown, bib) for you to pick from.
Results you add: for races we have no results for (such as IRONMAN events), the race, date, distance, your time, splits and places, and an optional link to the official result. They're public on your profile, marked as added by you. If you use a screenshot or certificate to fill these in, it's read and then discarded.
Activity files: when you verify a result or dispute one, we read the file from your watch or app and keep only a summary: when it started, how long it lasted, its distance and how far its start was from the race. We don't keep the file or its GPS track. We keep a fingerprint (hash) of the file so the same file can't back two athletes.
Strava, if you connect it: read-only access to your activities, used only when you ask to verify a result. We look at your activities around that race day and keep only the same summary as for an uploaded file (start, length, distance, distance from the race) and the activity's id, so it can't back someone else's result. Your Strava data is never shown to others: they see only that a result is verified. The access is stored on our servers, never in your browser, and we disconnect automatically 5 minutes after you last use it; you can also disconnect on My results (or on Strava), and it's removed when you delete your account.
Settings: your email and app notification and challenge preferences, miles or kilometers, and your progress through account setup.
Share cards: if you share a challenge, a score or an open challenge for a race, we make a public card and link (someonetorace.com/s/…) that anyone with the link can see. A challenge card shows both athletes by first name and last initial, the race, its date and the result; never stakes or messages. An open challenge shows your first name and last initial, the race, and your goal time if you set one; whoever accepts it is registered for that race and in a challenge with you. Either athlete on a card can remove it, and cards are deleted with either athlete's account.
Charity stakes: the charity you name and the link to its donation page, shown to the other athlete (and publicly if you both make the challenge public). We don't receive or see your donation.
Reports: if you report an athlete, the reason and details you give. The athlete isn't told who reported them.
App notifications: if you allow notifications in our app, your phone's notification token, its platform (iOS or Android) and the app version, so we can send you notifications. They're removed when you sign out of the app.
Blocked athletes: the athletes you block. Only you can see the list; we use it to stop challenges and messages between you, and the athlete isn't told.
Feedback and messages: what you send with "Send feedback" (with the page you were on, your browser and screen size) or by email.

Automatically

Server logs: your IP address, browser and the pages and requests you make, which our hosting keeps for security and troubleshooting.
How you found us and use the site: the link you came from (for example someone's share card or a printed QR card) and when you first did key things, such as adding results or sending a challenge. Only we see this, to understand what helps people get started. When something on a page seems not to work (several quick clicks on the same spot, or a click on a button that changes nothing), the page, the button's label and your type of device are sent to us so we can fix it; never anything you typed.
Error reports: if the site hits an error in your browser, the error, the page address and your browser type.
Our app: Firebase Analytics records which screens you open and general device information (phone model, system version, country), without your name, email or account ID, and not for ads. If the app crashes or hits an error, Firebase Crashlytics records the error with your phone model, system and app version and your account ID, so we can fix it. Feedback you send from the app includes the app version and phone system.
Analytics: Google Analytics records which pages are viewed and general device and location information (country, city), using cookies. We don't send it your name, email or account ID, and it isn't used for ads. In the European Union, the UK and Switzerland we only set these cookies if you accept them; anywhere, you can turn them off with "Cookie settings" at the bottom of every page.
Ad measurement: Meta's pixel tells Meta (Facebook and Instagram) which pages you view and when you create an account, with your browser and device details and Meta's cookies, so we can see whether our ads there bring people who sign up. Meta may link this to your Facebook or Instagram account under its own privacy policy. We don't send it your name or email. In the European Union, the UK and Switzerland it only runs if you accept it; anywhere, you can turn it off with "Cookie settings".
Bot protection: Google reCAPTCHA checks that requests come from our site, using information about your browser and device.
Your device's location, only if you allow it, to sort races near you. It's used in your browser and not saved.
Your device's time zone and language setting, read in your browser to guess whether to show miles or kilometers. They aren't sent to us.

From public race results

We collect official race results: names, finish times, places, gender, age or age group, hometown or country, and the race. They come from RunSignup's public results for the races our athletes sign up for or tell us they ran (including those races' past years). This includes results of people who don't use Someone2Race. We use them to compute scores (how fast each course is, and how athletes compare), to settle challenges, and so you can find and link your own results.

3. How we use it

To run the site: your account, profile, race lists, challenges and leaderboards.
To compute scores, predicted times, rivals and head-to-head odds from race results, and to propose the outcome of your challenges from the official results you've linked or the results you added.
To settle who a result belongs to when two athletes claim it (see the terms).
To send you notifications and emails about your challenges, disputes, account and the races you're racing (for example, athletes at your level a few days before a race). You can turn off each kind of email.
To review reports and enforce our rules: we may remove a photo, bio or name, or suspend an account, and we tell the athlete.
To keep the site secure, prevent abuse, fix problems and understand how it's used.
To follow the law and enforce our terms.

We don't sell your personal information, share it for advertising, or use it to make decisions with legal effects about you.

4. What other people can see

Everyone, including visitors who aren't signed in: your profile (name, or only your first name and last initial if you choose that on your profile; photo, bio, location as you typed it, sport, level), your scores, the results you linked, which of them you verified, your challenge record and your leaderboard places.
Everyone, for a challenge you and the other athlete both made public: both names and photos, the race, the stake (never a money stake), each athlete's charity for a charity stake, any head start, the winner, the official finish times and whether the donation was made. Never your messages, reports or payment handles. Either of you can make it private again at any time, and we may feature public challenges on our home page.
Signed-in athletes: the races you registered for, and the Strava and Instagram links you add to your profile. Visitors who aren't signed in only see how many athletes are racing a race and how many picked each distance, not who. If you share your race calendar, its public card shows your first name, last initial and how many races you have coming up; the link opens the list itself, which only signed-in athletes can see. If someone joins a race from your calendar, we tell you they did.
The other athlete in a challenge or dispute: its details, messages and notes. Your payment handles are shown only to an opponent who owes you a stake.
Only you: your email address, settings, blocked athletes, home location coordinates, notifications and which results you've linked before they're published.

People who haven't joined don't get a profile. Signed-in athletes searching for their own results can see the names and times in those public results. If one of these results is yours and you want it left out of Someone2Race, email us.

5. Who we share it with

Only with companies that run parts of the site for us, under their own privacy and security commitments:

Google (Firebase and Google Cloud): hosting, sign-in, database, file storage, Analytics, reCAPTCHA and app notifications (Firebase Cloud Messaging, which delivers through Apple on iPhone).
Meta: measures our Facebook and Instagram ads (see Ad measurement above), unless you turn it off.
Resend: sends our emails (your email address and the message).
ntfy: sends us a phone alert when someone signs up or sends a challenge (the athletes' display names, the race and the stake; never your email).
Anthropic: if you fill in a result from a screenshot or a finisher certificate, the file is sent to Anthropic's AI (Claude) to read the result. We don't keep the file, and Anthropic doesn't use it to train its models.
Strava: if you connect it, we ask Strava for your race-day activities when you verify a result; Strava learns that you use Someone2Race.
RunSignup: we look up races and their public results there. It receives the race names you search for and, when we check races for your past results, the last name you search under; never your account, email or other details.
OpenStreetMap (Nominatim): turns place names into map coordinates. It receives the place name only, not who you are.
Apple Maps and Google Maps: show the races map in our iPhone and Android apps. They receive the area of the map you look at, not who you are.

We may also share information if the law requires it, to protect people's safety or our rights, or as part of a transfer of the site to a new owner (who would be bound by this policy).

6. How long we keep it

Your account data, until you delete your account. Deleting it removes your profile, photos, registrations, linked results, scores, activity summaries, the messages you sent in challenges and sign-in straight away.
Challenges and disputes you took part in stay in the other athlete's history, with your name replaced by "Deleted athlete".
Server logs for about 30 days; analytics for up to 14 months.
Backups, if any, for up to 30 days.
Public race results for as long as they help compute scores (we use the last 6 years).

7. Your choices and rights

Change your profile and settings at any time on your profile.
Delete your account and data yourself: Profile, Settings, Delete account.
Emails: turn off each kind on your profile, or use the link in any email.
Unlink any result you linked.
Remove a share card you made or that shows you: open it from the challenge or score and choose "Remove this card", or email us.
Ask us for a copy of your data, to correct it, or to remove a public result that's yours, by emailing hello@someonetorace.com. We'll answer within 30 days.

Depending on where you live (for example in Virginia, California or the European Union), you may have more rights, such as to object to how we use your data or to complain to a data protection authority. Email us to use them; we won't treat you differently for doing so. Where those laws require a legal basis, we rely on our agreement with you (to run your account), our legitimate interest (scores from public results, security, improving the site), and your consent (location access, which you can withdraw in your browser).

8. Age

Someone2Race is for people 16 and older. We don't knowingly collect data from younger children; if you think we have, email us and we'll delete it. Money stakes are only for adults (18+).

9. Security and where data is stored

Data is stored by Google Cloud in the United States, encrypted in transit and at rest, and protected by access rules so each piece is only readable by the people above. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.

10. Changes

We'll post any change here with a new effective date. If it's significant, we'll ask you to review it the next time you sign in.

11. Contact

Someone2Race LLC: hello@someonetorace.com, or by mail at 8401 Mayland Dr #11831, Richmond, VA 23294