Privacy Policy

This page explains what personal data Indie Runners collects, why, on what legal basis, who processes it on our behalf, and how you can exercise your rights under the GDPR.

1. Data Controller

Indie Runners – Paulo Morales Castillo
c/o Online-Impressum #9671
Europaring 90
53757 Sankt Augustin
Germany
Email: paulo@indierunners.co

2. What data is collected and why

Google OAuth login

When you sign in with Google, we receive your email address, display name, and avatar URL from Google. Purpose: account creation and identification. We do not receive or store your Google password.

Attendance data

When you mark yourself as going to or interested in a race occurrence, we store your user ID, the occurrence ID, the race date, and the event display name at the time you marked it. Purpose: this is the core product function.

Session cookie

A single signed session cookie is set after login to keep you signed in across requests. It is strictly necessary for the site to function and does not require consent under the ePrivacy Directive.

Server logs

Standard Google Cloud Run and Google Cloud Platform server logs record request metadata including IP address, user agent, timestamp, and requested URL. Purpose: security, debugging, and abuse prevention. Retention follows Google Cloud's standard logging defaults.

3. Legal basis

• Art. 6(1)(b) GDPR — performance of a contract: account creation, login, and attendance features.
• Art. 6(1)(f) GDPR — legitimate interest: security logging and abuse prevention.

4. Third parties and processors

• Google (OAuth provider) — receives the fact that you attempted to sign in to Indie Runners and returns the profile fields listed above. No attendance or usage data is shared with Google beyond what OAuth itself requires.
• Google Cloud Platform — hosts the application (Cloud Run) and database (Cloud SQL Postgres). Data is stored in the europe-west1 region (Belgium).

Google LLC is a US-based company. Transfers of personal data to the United States rely on Google's certification under the EU-U.S. Data Privacy Framework (adopted by the European Commission on 10 July 2023), supplemented by the Standard Contractual Clauses adopted in Commission Implementing Decision (EU) 2021/914 where required. Google Cloud Platform infrastructure used for this service is located in the EU, which reduces but does not eliminate the possibility of transfers outside the EEA for support and administrative purposes.

5. Analytics

Indie Runners uses GoatCounter, a privacy-friendly analytics tool, to measure aggregate site traffic (visits, pages viewed, referring sites, browser type, and country). GoatCounter does not set cookies and does not track individual visitors across sessions or sites, so no consent is required under the ePrivacy Directive. Session tracking is limited to distinguishing repeat page loads within an 8-hour window and does not identify you personally. Aggregate traffic data is retained for 365 days and then permanently deleted. No data collected by GoatCounter is shared with or sold to third parties.

6. Data retention

Account data (web.users, web.auth_identities) and attendance rows (web.attendance) are retained until you request deletion. There is no automatic expiry today. Past attendance rows are deliberately preserved on the delete path so that your race history is not silently discarded when you unmark a future race; a full account deletion request removes them.

7. Your rights

Under the GDPR you have the right to:

• access your data (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data erased (Art. 17)
• restrict processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• lodge a complaint with your local data protection authority.

8. How to request data deletion or access

To request access to your data or deletion of your account, email paulo@indierunners.co. We will respond within 30 days.

A self-service deletion button on your profile is planned but not yet available; until it ships, email is the mechanism.