Privacy Policy

1. Introduction

RaceDayAI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

2.1 Information You Provide

When you create an account, we collect:

• Name and email address
• Password (encrypted)
• Fitness metrics (FTP, threshold pace, resting heart rate, etc.)
• Race information (race name, date, location, goals)
• GPX files for course analysis (optional)

2.2 Third-Party Integrations

If you connect third-party services to your account:

• Strava: We access your activity data, fitness metrics, and profile information as authorized by you
• Connection tokens are stored securely and can be revoked at any time

2.3 Automatically Collected Information

• Device information (browser type, operating system, IP address)
• Usage data (pages visited, features used, time spent)
• Cookies and similar tracking technologies

3. How We Use Your Information

We use your information to:

• Provide and maintain the Service
• Generate personalized race execution plans
• Process payments and manage subscriptions
• Send service-related communications
• Improve our algorithms and features
• Respond to support requests
• Detect and prevent fraud or abuse
• Send marketing communications (with your consent, which you can withdraw at any time)

4. Information Sharing

We do not sell your personal information. We may share your information with:

• Service Providers: Payment processors (Stripe), hosting providers (Vercel), database services (Neon), analytics providers
• API Providers: Weather services (for race-day forecasts), mapping services (for GPX analysis)
• Legal Requirements: When required by law or to protect our rights
• Public Sharing: If you choose to share a race plan via public link, that plan becomes publicly accessible

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (HTTPS/TLS)
• Encrypted password storage (bcrypt)
• Secure database hosting with access controls
• Regular security audits

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update inaccurate or incomplete information
• Deletion: Request deletion of your account and data
• Portability: Export your data in a machine-readable format
• Objection: Object to certain data processing activities
• Withdraw Consent: Withdraw previously given consent at any time

To exercise these rights, please contact us through your account settings or via email.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. When you delete your account, we delete your personal information within 30 days, except where retention is required by law.

8. Cookies and Tracking

We use cookies and similar technologies for:

• Authentication and session management
• Analytics (Google Analytics, Vercel Analytics)
• Performance monitoring (Vercel Speed Insights)
• Preferences and settings

You can control cookies through your browser settings. Disabling cookies may affect functionality of the Service.

9. Children's Privacy

The Service is not intended for users under 13 years of age. We do not knowingly collect information from children under 13. If we learn we have collected such information, we will delete it promptly.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through a prominent notice on the Service. Your continued use after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us through our website or email support.

13. California Privacy Rights

California residents have additional rights under the CCPA:

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of sale of personal information
• Right to deletion of personal information
• Right to non-discrimination for exercising CCPA rights

Note: We do not sell your personal information to third parties.

14. GDPR Rights (EU/EEA Users)

If you are located in the European Union or European Economic Area, you have additional rights under GDPR, including:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with a supervisory authority