Privacy

Privacy policy.

Last updated 29 June 2026.

There are two data stories here. If you just browse, we collect anonymous usage analytics to understand which races people look for. If you create an account, we also store the profile and login data you give us so we can run that account. This page covers both.

Who runs this site

findmynextrace.com ("we", "us") is the operator and data controller for the personal data described here. We are an independent race index, not owned by a race operator or registration platform. For any privacy question or request, email [email protected].

When you just browse

To understand which sports, regions, and race types visitors care about (so we know what to index more deeply), we record anonymous usage events:

• The pages you load and clicks on tracked elements (race tiles, navigation, filters), with referrer and timestamps
• Your browser user agent, approximate device/screen size, and approximate country
• A cookieless session identifier that rotates daily
• A first-party visitor identifier stored in your browser's local storage, so we can understand returning-visitor and signup trends. It carries no name or email and is not used for advertising. Clearing your browser storage resets it.

This usage stream is behavioural and is not tied to your name or email. Where you are signed in, server-side events (for example, completing signup) are linked to your account so we can measure how features perform.

When you create an account

You can sign up with an email address and password, or with Google sign-in. If you use a password, we store it only as a bcrypt hash, never in plain text. If you use Google sign-in, Google shares your account ID, email, and profile picture, and we store the OAuth tokens that keep you signed in; these tokens are sensitive and we treat them as such (see deletion, below).

Depending on what you choose to add, your profile can include:

• Your name and, if you provide it, your birth year (used to show an age line) and country
• Your sport, discipline, and training preferences (these drive recommendations)
• A profile photo or avatar, stored on Cloudflare R2
• Race data you enter yourself: past results, personal bests, and upcoming races you're tracking
• A record of when you accepted these terms, and account timestamps

We use this to run your account, personalise race recommendations, and send the emails you ask for. We don't sell your data or use it to build advertising audiences.

Cookies, analytics, and the services we use

Alongside our own first-party analytics, we use Google Analytics 4 (loaded through Google Tag Manager), which sets analytics cookies and processes your IP address, device and browser details, and the pages you view. We also use Google Search Console to understand search traffic. We do not run advertising pixels and do not sell visitor data.

The third parties that process data on our behalf are:

• Google: sign-in (OAuth), Analytics 4, and Search Console. See policies.google.com/privacy.
• Cloudflare: CDN, security, and R2 image storage; its edge sees request IPs. See cloudflare.com/privacypolicy.
• Amazon SES: delivers our transactional and re-engagement email; your address passes through it.

Account, profile, and analytics data are held on our own servers; images on Cloudflare R2. Some of these providers are based in the United States, so your data may be processed there. Race detail pages link out to operator websites (IRONMAN, HYROX, etc.), where their own privacy terms apply.

Email and newsletters

If you sign up for a newsletter or we send you a reminder, we store your email and the lists you chose. Newsletters are sent with Sendy on our own infrastructure; transactional and reminder email is delivered through Amazon SES. Every email carries a one-click unsubscribe link, and you can unsubscribe at any time.

How long we keep it, and deleting your account

You can delete your account yourself in Settings. When you do, we scrub your profile: your name, photo, race data, and other profile fields are removed, and your email is replaced with an anonymous placeholder so the address is freed up again. Your linked Google OAuth tokens and login sessions are permanently deleted, so no live Google credential survives. We retain only a minimal tombstone (an internal account ID, the creation date, the record that you accepted these terms, and the deletion date) to meet our obligations. Deleted accounts are excluded from everything we serve.

Your rights

You can access, correct, or delete the data we hold on you, object to or restrict certain processing, and unsubscribe from email at any time. Most of this is self-service in your account; for anything else, email [email protected] and we'll respond within 30 days. If you only ever browsed, the data we hold on you is approximately nothing.

Children

findmynextrace.com isn't intended for anyone under 16. If you believe a child has created an account, email us and we'll remove it.

Changes

If we change what we collect or how we use it, we'll update this page and note the change at the top. We won't silently start collecting more.