Privacy Policy

1. What Data We Collect

• Account information: Your name, email address, and optionally a phone number and profile photo, provided when you register or are invited.
• Authentication data: Login timestamps, session tokens, and WebAuthn (passkey) credential identifiers for biometric login.
• Race activity: Expenses (amounts, currencies, categories, receipt images), photo challenge submissions, checkpoint arrival and departure records, and journey details you log during the race.
• Uploaded media: Receipt photos, booking documents, and challenge photos uploaded to the platform.
• Payment data: Subscription status and billing history via Stripe. We do not store full card details — these are processed and held by Stripe.
• Technical data: Browser type, IP address, and usage logs collected automatically by our hosting provider (Vercel) and Firebase.

2. How We Use Your Data

• To authenticate you and manage your account.
• To display your race progress, expenses, and photos to your team and race organisers.
• To process expense records, calculate scores, and display leaderboard standings.
• To process subscription payments via Stripe.
• To send you account setup and invitation emails (via Nodemailer).
• To monitor platform health and security.

3. Cookies & Local Storage

This application uses the following cookies, all of which are strictly necessary for the application to function:

• idToken: Stores your Firebase authentication token to maintain your logged-in session.
• sidebar_state: Remembers whether the navigation sidebar is open or closed.
• auth-challenge / reg-challenge: Temporary, short-lived cookies used during WebAuthn (passkey) registration and authentication flows. Deleted immediately after use.

We also use reCAPTCHA v3 (via Firebase App Check) on authenticated routes to protect against automated abuse. This is provided by Google and is subject to Google’s Privacy Policy.

4. Data Sharing

We do not sell your personal data. We share data only with the following service providers who process it on our behalf:

• Google Firebase / Google Cloud — Authentication, database, file storage, and backend functions.
• Vercel — Frontend hosting and edge delivery.
• Stripe — Subscription billing and payment processing.
• Cloudflare — Media CDN caching (via cdn.eurorace.app).
• Google (reCAPTCHA / Vertex AI) — Bot protection and AI-powered features (receipt scanning, photo scoring).

Your race data (expenses, photos, checkpoints) is visible to other members of your team and to trip organisers, subject to the application’s “Fog of War” privacy rules. Global administrators have full visibility for support and dispute resolution purposes.

5. Data Retention

Your account data is retained for as long as your account is active. Race data (expenses, photos, journeys) is retained for the duration of the race event and for a reasonable period thereafter for historical review. You may request deletion of your account and associated data at any time by contacting us.

6. Your Rights (UK & EU)

Under the UK GDPR and EU GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data via your profile settings.
• Erase your data (“right to be forgotten”) — contact us to request deletion.
• Portability — request a copy of your data in a portable format.
• Object to processing for legitimate interests.

To exercise any of these rights, contact us at [email protected].

7. Security

We implement appropriate technical and organisational measures to protect your data, including Firebase App Check enforcement, email verification, account lockout policies, role-based access control, and encrypted transit (TLS) for all data transfers.

8. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us at [email protected].