Privacy policy

Account and registration information. When you create an account or register for an event, we collect your name and email address, and — depending on the event — your mailing address, phone number, date of birth, gender, and the organization or team you’re participating with. Date of birth and gender are used for age-group and category standings; mailing address is used to ship event merchandise.

Activity information. Records of physical activity you log manually in the app, and — only if you choose to connect a fitness tracker — records synced from that tracker.

Payment information. Event registration fees and donations are processed by Stripe. We receive a confirmation and the amount. We never receive or store your full card number.

Technical information. Standard web server logs, including IP address and browser type, and cookies used to keep you signed in and remember your preferences.

HealthCode can connect to Google Health, Strava, Garmin Connect, Fitbit, and MapMyFitness. These connections are entirely optional. You can use HealthCode and log every activity by hand without connecting anything.

When you connect a tracker, you are taken to that provider’s own sign-in and consent screen, where you choose whether to grant access. We never see or store your password for that provider. We store an access token that lets us read the data you approved.

What we read from Google Health. With your consent, using the activity_and_fitness.readonly permission, we read:

• Exercise sessions — the activity type (run, ride, walk, yoga, and so on), start and end time, duration, distance, and calories burned.
• Daily step totals and daily distance totals.

We request read-only access. We cannot write to, modify, or delete anything in your Google Health account. We do not read medical records, clinical data, sleep, heart rate, blood glucose, body measurements, nutrition, or any health data type other than the activity and fitness records listed above.

We use the information above to:

• Credit your activity toward the events you have registered for, and show your progress against your goals.
• Calculate team, organization, and event leaderboards and standings.
• Report aggregate totals — miles, minutes, calories, participant counts — to the organizations that sponsor teams, and publicly on our own site.
• Ship event merchandise and send you event-related email.
• Operate, troubleshoot, and secure the service.

We do not use your activity data for advertising, we do not sell it, and we do not use it to train machine-learning or artificial intelligence models.

• Publicly, on leaderboards. Your display name, the organization or team you registered with, and your activity totals appear on event and organization leaderboards, which are visible to anyone with the link. Your email address, mailing address, date of birth, and payment details are never shown publicly.
• With your organization’s administrators. If you register as part of an organization or team, that organization’s administrators can see your name and your activity totals for the events you participated in with them.
• With service providers who process data on our behalf. Google Cloud Platform (hosting, databases, and analytics infrastructure) and Stripe (payments). These providers are bound to use the data only to provide their service to us.
• When required by law. We may disclose information in response to a valid subpoena, court order, or other legal process.

We do not sell, trade, or rent your personal information.

HealthCode’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained through the Google Health API is used only to provide and improve the activity-tracking features described in this policy. It is not transferred to third parties except as necessary to provide those features (our hosting infrastructure), to comply with applicable law, or as part of a merger or acquisition with notice to you. It is not used for advertising or any advertising-related purpose, and it is not sold. No human at HealthCode reads your individual Google Health data except with your explicit permission — for example, when you ask us to investigate a syncing problem — for security purposes, or to comply with applicable law.

Disconnecting a tracker. You can disconnect any connected tracker at any time from the Trackers page in the member app. Disconnecting immediately revokes our access token with that provider and stops all further syncing. You can also revoke HealthCode’s access from your Google Account at myaccount.google.com/permissions.

Activity already synced. Activity records already credited to an event remain on your account and in that event’s historical totals after you disconnect, so that past results stay accurate. If you want them removed, contact us.

Deleting your account and your data. To request deletion of your HealthCode account and the personal and activity data associated with it, email contact@healthcode.org. We will confirm and complete the request within 30 days. Some records may be retained where we are required to keep them — for example, donation and payment records retained for tax and accounting purposes.

Retention. We keep account and activity information for as long as your account is active, and afterward only as long as needed for the purposes described in this policy or as required by law.

Data is transmitted over HTTPS and stored in Google Cloud Platform with encryption at rest. Tracker access tokens are stored encrypted and are accessible only to the systems that need them to sync your activity. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

HealthCode is not directed at children under 13, and we do not knowingly collect personal information from children under 13. Participants under 18 should have a parent or guardian’s permission to register. If you believe a child under 13 has given us personal information, contact us and we will delete it.

We will post any changes on this page and update the “Last updated” date above. Material changes affecting how we handle your data will be communicated by email to registered participants.

Questions about this policy, or requests to access or delete your data: contact@healthcode.org.

Our Terms & Conditions cover use of the site and events.