Privacy

What we collect

• Your account: email, name and a hashed password. We never store your password itself.
• If you sign in with Apple or Google: the email and name they share with us, and their ID for your account, so they can sign you in next time. We never see your Apple or Google password. With Apple's "Hide My Email", we only get Apple's relay address.
• If you allow notifications in the app: your phone's push token, so we can send the alerts you've turned on. We forget it when you sign out or turn notifications off.
• Your runner profile and race entries: date of birth, gender, country, shirt size, emergency contact and predicted finish time. Race organizers need these to accept an entry.
• Your home town, if you give it: picked from a search, or from your device's location when you allow it. We keep it to about a kilometer, never an exact address, and use it to show races near you and tell you about races and deadlines nearby. Change or remove it on your account page.
• Races on your Radar and races you mark as running, so we can show them and remind you before entries close.
• While you're signed in: the race pages you view and the filters you search races with (never where you search from). We use these to recommend races and tailor alerts to you, and delete them after 12 months.
• Race Club posts, comments and votes. Posts and comments are public, shown under your handle, not your name or email. A "Running" or "Finisher" badge shows by your handle in a race's club when you've said you're running or ran that race.
• "Where would you finish?" on a race page: the time, gender and age you enter go to raceIQ, our race-results service, to work out the answer. Neither Medal nor raceIQ keeps them.
• AI assistants you connect to Medal (Claude, ChatGPT and others): the app's name and when you connected it and last used it. Connected apps can read your Radar, races and recommendations and add races to your Radar; disconnect them on your account page.
• Usage analytics and error reports (PostHog), with form inputs masked in session replays. When you're signed in, analytics are linked to your account.

How we use it

To run your account, process race entries, send confirmations and the reminders you've opted into, recommend races you may like, and improve Medal. We share entry details only with the organizer of the race you enter. Posts and comments are checked automatically for spam and abuse, and may be reviewed by our moderators.

Email

We send account emails (verification codes, password resets, entry confirmations) and, if you leave them on, alerts about the races on your Radar. Turn reminders off in your account settings.

Your choices

You can update your profile at any time.

You can delete your account on your account page, on the website or in the app. We erase your profile, your Radar and races, your notifications, devices and connected apps, and sign you out everywhere. Your posts and comments stay up, shown as [deleted] with no name or handle; delete any you want gone first. We keep a private record of the email address the account had, so we can deal with abuse and legal requests about those posts, and we keep any race entries you made, as the record of what the organizer was sent.

Contact

Questions about your data, or a request to see or delete it: [email protected].