The site races.co.il ("the site") respects the privacy of its visitors and registered users. This policy explains what details we collect, the purposes for using them, how we protect them, and your rights.
This document is written in accordance with:
- Privacy Protection Law, 1981.
- Privacy Protection Regulations (Information Security), 2017.
- EU GDPR Regulation (EU 2016/679), applicable as long as visitors from the European Union browse the site.
1. What details we collect
1.1 Details provided by the user
- When logging in with Google or Apple: email address, profile name if provided, profile picture if provided, and a unique user identifier from the login provider.
- When connecting a Strava account: athlete ID and access/refresh tokens.
- Profile picture uploaded by the user to the site.
- Links to social networks the user chose to add.
- Race attendance status ("going", "interested").
- Friend requests between users and race sharing settings with friends.
- Discount codes users submit for admin approval.
Required fields during login come from the identity provider (Google / Strava). We do not collect ID numbers, credit card details, or bank account numbers.
1.2 Details collected automatically
- IP address (server logs only; retained up to 30 days).
- Browser and operating system information (User-Agent).
- Site activity (pages viewed, filters applied) - collected in Google Analytics only after explicit consent.
2. How we use information
- Display the race calendar and operate the site.
- Maintain your profile and personal status (friends, attendance status, sharing settings).
- Security, abuse prevention, and system maintenance.
- Improve the interface based on aggregated statistics only.
- Fulfill legal obligations.
3. Cookies
The site uses necessary cookies (login, security) and statistical cookies (Google Analytics) only after explicit consent via the cookie banner. Full details on the Cookie policy.
4. Sharing with third parties
We do not sell or rent personal information. Sharing occurs only in the following cases:
- Essential infrastructure providers: Cloudflare (hosting, CDN, security, R2 for profile images), Google and Apple (login, and statistics for Google with consent), Strava (optional login), Anthropic (AI service for automatic race description summaries - receives race text only, no user data). Use of these services is subject to the privacy policies of the service providers.
- Friends you approved: Users you approved as friends can see the races you registered for - only when you actively enabled the "Share with friends" setting on your profile page. Default is off.
- Legal obligation: In case of a binding legal request, court order, or legal proceeding.
- Organizational changes: In case of merger, sale, or acquisition, information will transfer to the receiving entity subject to the same policy.
We may share aggregated, statistical, and non-identifying data without limitation.
5. Legal basis for processing (GDPR)
- Consent (Section 6(1)(a)) - Login, statistics, sharing with friends, Strava connection.
- Legitimate interest (Section 6(1)(f)) - Security, abuse prevention, experience improvement.
- Contractual obligation (Section 6(1)(b)) - Providing the service you requested.
6. Retention period
- Active account: As long as the account exists.
- Inactive account over 24 months: Automatic deletion.
- Server logs: Up to 30 days.
- Deletion request: Within 30 days of request.
7. Your rights
Under Israeli law and GDPR you have the right to:
- Access information stored about you.
- Request correction of inaccurate information.
- Request deletion of your account and data ("right to be forgotten").
- Request your data in portable format (JSON).
- Object to or restrict processing.
- File a complaint with the Israeli Privacy Authority or the relevant European supervisory authority.
Requests under this section must be submitted in writing to support@races.co.il.
8. Data security
All traffic to the site is encrypted with HTTPS and HSTS. Passwords are not stored (login is via OAuth from Google, Apple, or Strava only). Access tokens are stored encrypted. We implement reasonable security measures but cannot guarantee absolute protection against hacking attempts.
9. Minors
The service is not intended for children under 13, and we do not knowingly permit opening an account for children under 13.
Users aged 13 to 18 may use the service only with approval and supervision of a parent or legal guardian. If a user under 18 creates an account or uses the service, we assume they received such approval.
We do not knowingly collect sensitive personal information about minors, and we do not ask users to provide ID number, credit card details, medical information, or precise location information.
The information that may be collected from registered users, including minors, is the information necessary to operate the account and service, such as email address, profile name, profile picture if uploaded, participation or interest indicators for races, friend requests, and sharing settings.
If a parent or guardian believes a child under 13 provided us with personal information, or a user under 18 used the service without appropriate approval, you can contact us at support@races.co.il and request a review, deletion, or restriction of the account and information.
10. International Data Transfers
Cloudflare and Google operate servers outside Israel and the European Union. Data transfers are made under recognized mechanisms: Standard Contractual Clauses, and the European adequacy decision for Israel.
11. Policy Changes
We may update this policy from time to time. Material changes take effect 7 days after publication. In case of changes to statistical or marketing cookie use, we will display the cookie notice again.
12. Contact
Questions, requests, and inquiries regarding this policy or your rights should be directed to support@races.co.il.