Privacy Policy

Quick contents: Who we are · Data we collect · Legal bases · Sharing · Your rights · U.S. state rights · Contact

1. Who we are

Controller: National Running Club Database LLC
Contact email: nationalrunningclubdatabase@gmail.com

We operate the National Running Club Database website and Affiliated Platforms described in the Terms (including the CRC Coaches Poll and CCC Discord community spaces we administer). The CCC Discord is closely related to Coaches Poll operations. NRCD is based in Michigan. We own the Service and Database Content. University collaborations (including with the University of Notre Dame and other institutions) support research and community work but do not transfer ownership of the website or data to those institutions.

Operational Coaches Poll / CCC email: nircacoachespoll@gmail.com (supplementary NRCD inbox). Privacy and legal requests: nationalrunningclubdatabase@gmail.com.

2. Scope

This Policy covers personal information processed when you use the Service, create an account, subscribe, submit results, claim profiles, join Team Pro, vote in polls we operate, connect optional health/fitness integrations, or communicate with us.

It does not control third-party sites we link to (Stripe, Google, Discord, wearable platforms, meet results sites, etc.). Their policies apply when you use those services.

2.1 Sources of personal information

• You — account setup, submissions, claims, support emails, poll ballots, Team Pro actions, health-connection consent
• Automatically — logs, cookies/local storage for security and session, approximate location from IP, device/browser signals
• Other users and clubs — results, rosters, and edits they submit that include your name or team
• Public / third-party sports sources — meet results and club information already published elsewhere that users or we import into the database
• Processors and platforms you use — Google OAuth, Stripe, Discord, and (if you connect them) wearable/fitness APIs

3. Information we collect

3.1 Account and identity

• Name, email, and profile identifiers from Google OAuth or other login methods we enable
• Username/display choices, athlete or team claim links, role (e.g., Team Pro owner/officer/member)
• Admin flags and subscription status

Account emails are not a public field. We do not display your login email on public athlete, meet, team, or results pages, and we do not publish, sell, or freely give out account email addresses as a directory or mailing list. You can see your own email in account settings.

You may still be contacted at your account email. We (and systems we use, such as Stripe) may email you for account, security, billing, subscription, Team Pro, invite/join-request, and other service messages. Team Pro owners/officers may see and use emails of members, invitees, or join requesters for that club to manage seats and club communications—not to publish a public email list. Site administrators may access emails to operate and secure the Service. Processors such as Google OAuth or Stripe receive email as needed for login and payment. See Section 6.

3.2 Competition and club database content

• Athlete names, competition gender categories (as recorded for sport classification), teams, meets, events, results, disciplines, course details, and related sports data—often already public from meets or results platforms
• User-submitted additions and edits, approval status, and pending-edit history

3.3 Payments

• Billing metadata, plan type, renewal status, overage ledgers, and customer IDs
• Card and bank details are processed by Stripe; we do not store full card numbers

3.4 Connected Health Data (optional)

• We do not collect Connected Health Data when you create an account, log in, or agree to the general Terms/Privacy at registration or checkout
• If you later authorize a wearable/fitness/health platform connection in the product, we may receive activity, workout, biometric, or related health metrics via that platform’s API, plus tokens needed to keep the connection working
• Connecting authorizes both feature/service use and research/statistical use of that Connected Health Data while connected (see Section 4 and the Terms §17). There is no separate research toggle
• This may be treated as sensitive/special-category data under GDPR and similar laws

3.5 Usage, device, and security

• Log data (IP address, timestamps, URLs, user agent), approximate location derived from IP, session identifiers
• Rate-limit and abuse-prevention signals
• Cookies or local storage needed for login, CSRF protection, preferences, and (if enabled) analytics

3.6 Communications

• Emails and support messages you send us; poll or Discord messages in communities we administer (also subject to Discord’s policies)

3.7 Research and derived data

• Aggregated or de-identified statistics; pseudonymized or anonymized datasets for research; published research releases under their own licenses
• Consent/withdrawal records for integrations (retained as compliance evidence)

4. How we use information

• Provide, secure, and improve the Service and Affiliated Platforms
• Authenticate users; prevent fraud, abuse, and scraping
• Process subscriptions, Team Pro seats, and overage billing
• Display and curate Database Content; run approval and data-quality workflows
• Operate the CRC Coaches Poll and related displays using Database Content (names, teams, etc.)
• Provide Pro Tools (estimates and planning aids—not official scoring or medical advice)
• If you connect a health/fitness platform: process Connected Health Data for features you enable and for scientific, statistical, or academic research and Service improvement while connected (including with research collaborators under written arrangements and safeguards)
• Communicate about accounts, security, billing, Team Pro (including invites and join requests), and material policy changes (transactional/service messages). We do not send third-party advertising emails by default; any optional marketing would require separate consent where required
• Comply with law and enforce our Terms

5. Legal bases (EEA/UK and similar)

Where GDPR/UK GDPR applies, we rely on one or more of:

• Contract — providing the Service you request (Art. 6(1)(b))
• Legitimate interests — securing the Service, preventing abuse, improving products, operating a public sports results database, editorial poll operations (Art. 6(1)(f)), balanced against your rights
• Consent — optional marketing (if any), optional Connected Health Data connection (features + research while connected), and certain non-essential cookies (Art. 6(1)(a)); for health/special-category data, explicit consent in the connection flow (Art. 9(2)(a)), with research/statistics safeguards where they apply (Art. 9(2)(j) / Art. 89-style frameworks)
• Legal obligation — tax, accounting, or lawful requests (Art. 6(1)(c))

You may withdraw Connected Health consent by disconnecting (and/or contacting us) without affecting prior lawful processing. Disconnect stops new collection and new identifiable research use as described in the Terms.

6. How we share information

• Affiliated Platforms — Database Content and operational data may be used across NRCD-owned products (CRC Coaches Poll, CCC Discord administration, etc.) as described in the Terms. These are not sales to unaffiliated companies. Account emails are not posted as public Database Content.
• Processors — vendors who help us run the Service (e.g., hosting/cloud, Stripe, email delivery, error monitoring such as Sentry, Redis/cache providers, OAuth providers). They process data on our instructions under contractual safeguards.
• Team Pro / club roles — owners and officers of a Team Pro account may see email addresses of members, invitees, or join requesters for that team and may contact them for club administration (invites, seat management, roster messages). Those emails are for that club’s Team Pro operations, not for public posting, resale, or unrelated spam.
• Third-party platforms you connect — Google (login), Discord (community), wearable/fitness APIs you authorize, payment flows on Stripe.
• Research releases — datasets we publish under a stated license may include de-identified or permitted fields only; we do not intentionally include account login emails in public research releases.
• Legal and safety — if required by law, or to protect rights, safety, and integrity of the Service.
• Business transfers — in a merger, acquisition, or asset sale, information may transfer subject to this Policy’s protections or a successor privacy notice.

We do not sell personal information for money. We do not rent or freely distribute account email lists. We also do not knowingly “share” personal information for cross-context behavioral advertising as those terms are used under the CCPA/CPRA. If that ever changes, we will update this Policy and provide a required opt-out.

7. Retention

• Account data — while your account is active and typically up to 24 months afterward for security, billing disputes, and legal compliance (longer if a dispute or legal hold is pending)
• Competition Database Content — retained as part of the historical sports record; account deletion does not always erase public results (see Section 8.3)
• Payment records — generally 7 years or as required for accounting and tax
• Connected Health Data — while the connection is active; after disconnect/deletion request, identifiable data is deleted or de-identified within about 30 days (except consent/security logs and legal holds); irreversibly anonymized derivatives may be retained; consent logs retained as needed for compliance
• Logs / security — typically 30–180 days unless needed for investigations

8. Your choices and rights

8.1 All users

• Update account information via settings / linked athlete profile tools where available
• Disconnect optional integrations (including Connected Health)
• Delete your account in Settings (self-serve): we set the account inactive (account_active=false), cancel individual Pro if active, unclaim athlete/team profiles, and remove Team Pro roster memberships (billing owners must transfer or cancel Team Pro first). Race results are not deleted and stay linked to the same athlete records. If you claimed an athlete, you choose whether that athlete page stays publicly visible or is hidden. Closed accounts cannot sign in with Google; reactivation is by email request to us only
• Request access, correction, deletion, or a portable copy of account personal data by emailing us (we aim to respond within 30 days)—including if self-serve deletion is blocked
• Request hide/suppression of an athlete profile for privacy or safety (we aim to review and act within about 30 days when the request is clear; hiding may leave underlying historical marks in the sports record—see Section 8.3)
• Cancel subscriptions via the flows we provide (Stripe customer portal or in-product controls)

8.2 GDPR / UK GDPR

Where applicable, you may have rights to access, rectification, erasure, restriction, objection, portability, and to withdraw consent. Erasure is limited where we must keep data for legal claims, compliance, public sports archives, or anonymized research. You may lodge a complaint with your local supervisory authority.

8.3 Competition results vs. account data

We treat public competition results differently from login credentials and Connected Health Data. We may hide profiles or limit display in product tools without deleting the underlying historical mark when that mark remains part of the athletic record. Hide/suppression requests can still be appropriate for safety or privacy and will be considered in good faith; we aim to process clear hide requests within about 30 days.

Account closure / personal-data deletion. If you request deletion of your account personal data (login identity, settings, and similar), we aim to delete or de-identify that account data within about 30 days of a valid request, except where we must retain information for law, security, billing/tax, disputes, or consent logs. That 30-day account-data target does not mean every competition result mentioning your name is erased from the database; use hide/suppression for public display concerns.

9. Cookies and similar technologies

We use essential cookies/local storage for authentication, security (including CSRF), and preferences. We may use additional analytics cookies or scripts (for example Google Analytics / similar measurement via a site tag) if enabled in our deployment; where required, we will request consent. You can control cookies through your browser; blocking essential cookies may break login. We currently do not use advertising cookies for cross-site behavioral ads.

10. Children

The Service is aimed at collegiate club running communities and adults who support them. It is not directed to children under 13 (or under 16 in some regions). We do not knowingly collect personal information from children in violation of COPPA or similar laws.

User submissions. Other users upload much of the competition and roster data. Those submitters are responsible for not uploading children’s personal information unlawfully (see Terms §§3 and 15). If you believe a submission includes inappropriate children’s personal information, or that we have collected such information, contact nationalrunningclubdatabase@gmail.com; we will review and may delete, hide, or otherwise address it.

11. U.S. state privacy (including California)

Depending on your state, you may have rights to know, delete, correct, or opt out of certain “sales”/“sharing” of personal information, and to not be discriminated against for exercising rights.

• Categories collected (depending on use): identifiers (name, email, IP); customer records / commercial information (subscriptions, overage); internet or network activity; coarse geolocation (from IP); professional or club-related information (team roles); and, if you connect them, health/fitness information from Connected Health Data.
• Purposes: Sections 4 and 6.
• Sale/share: We do not sell personal information for money and do not share it for cross-context behavioral advertising. When you connect Connected Health, sensitive health/fitness information is used for the purposes disclosed at connection (features and research while connected), not for advertising inference.
• Retention: Section 7.
• How to exercise rights: Email nationalrunningclubdatabase@gmail.com with enough detail to verify your request. Authorized agents may contact us with proof of authority. We will not discriminate against you for exercising privacy rights.

12. International transfers

We are based in Michigan, United States. If you access the Service from elsewhere, your information may be processed in the U.S. and other countries where our processors operate. Where required, we use appropriate safeguards (such as standard contractual clauses) for transfers from the EEA/UK. Research collaborations with universities (in Indiana or elsewhere) are conducted under arrangements that keep NRCD as controller of Service data unless a specific project agreement states otherwise.

13. Security

We use reasonable technical and organizational measures (access controls, HTTPS, rate limiting, monitoring, and similar practices). No system is perfectly secure. Report suspected vulnerabilities or incidents to nationalrunningclubdatabase@gmail.com.

14. Automated decision-making

Pro Tools and rankings use algorithms and heuristics on Database Content. They are assistive estimates, not legally binding decisions about individuals with legal or similarly significant effects under GDPR Art. 22. Poll rankings are editorial.

15. Do Not Track

There is no consistent industry standard for Do Not Track browser signals. We do not respond to DNT signals at this time beyond the controls described in this Policy.

16. Changes

We may update this Policy. Material changes will be posted with a new effective date and at least 30 days’ notice when required by our Terms practice. Prior versions appear in the version history on this page when multiple versions exist.

17. Contact

National Running Club Database LLC
Privacy requests: nationalrunningclubdatabase@gmail.com
CRC Coaches Poll & CCC (operational): nircacoachespoll@gmail.com

Also see: Terms of Service · DMCA / Copyright · CCC Community Guidelines