Privacy policy

The controller is Ruben Godoy Prats, owner of Trailrunningcal, whose address is Avenida Diagonal 696, 08034 Barcelona, Spain. For any privacy question, email [email protected].

Depending on how you use the service, we may process the following categories of data:

• Account and authentication data, such as email and session identifiers.
• Profile and organizer data, such as name, role, organization, website and social profiles.
• Favorites, managed races and requests to claim ownership of an event.
• Queries sent by email and voluntary product feedback.
• Technical and usage data, such as device, browser, pages viewed, interactions, errors and session recordings when PostHog is active.
• Professional data published by organizers or available from public sources to document races.

We process data only for purposes related to Trailrunningcal:

• Creating and maintaining accounts, favorites and organizer profiles to provide features requested by the user.
• Responding to queries, processing event claims and preventing abuse based on the data subject's request and the legitimate interest in operating and protecting the service.
• Maintaining and improving the calendar, fixing errors and analyzing aggregate use on the basis of legitimate interest, with data-minimization measures.
• Using PostHog for advanced analytics, identification and session recording on the basis of consent where required. Its consent mechanism is currently pending implementation.

Data may be processed by Supabase for database and authentication services, Vercel for hosting and aggregate analytics, Cloudflare for security and web analytics, PostHog for product analytics, flags, errors and session recording, and Resend for operational emails. We do not sell personal data.

Account, profile and favorite data is retained while the account remains active and until deletion is requested. Queries and claims are retained until resolved and, where necessary, for applicable statutory periods. Technical data is retained according to each provider's configuration and retention criteria.

When data is no longer needed, it will be deleted or restricted for the periods required to address potential liabilities.

Some providers may process data outside the European Economic Area. In those cases, adequacy decisions, standard contractual clauses or other safeguards recognized by the GDPR will be used. PostHog is configured to use its European infrastructure.

You may request access, rectification, erasure, objection, restriction or portability, and withdraw consent, by emailing [email protected] with your request. You may also request account deletion this way.

If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency at aepd.es.

Trailrunningcal is not directed at children under 14. If an account created without the required authorization is detected, it may be deleted.

Reasonable technical and organizational measures are applied to protect data. This policy may be updated when the service, its providers or the law changes; the date above shows the latest review.