Your identity
A User is an email address, a password hash, and an editable display name. Other people in a Race see your display name, never your email. There are no public profiles, usernames, avatars, friend lists, or discovery.
You must verify control of your email before you can use product features or claim an Invitation addressed to it. Changing your email requires confirming the new address; the old one stays authoritative until then.
Location evidence
During an Attempt your phone records Location Observations: coordinates, horizontal accuracy, device time, a sequence number, and whether the platform flagged the location as mocked. Nothing else is collected from the sensor. Observations are evidence that the server uses to accept Post Completions; they are never authoritative progress on their own.
- Observations are only recorded while you have an Active Attempt that you started yourself.
- Accuracy rules are fixed for everyone: a Post counts when you are within its radius and the reported accuracy is good enough. Organizers cannot loosen or tighten this.
- Nothing is interpolated or invented when the signal drops. Gaps are recorded as gaps.
Who can see your trail. You can review your own accepted terminal evidence while it is retained. The Organizer of that Race can review it only after your Attempt has ended and only until 30 days after the Race closes. Other Participants never can. There is no live tracking surface for anyone.
Deletion. Once an Attempt is Completed or Abandoned, you can permanently delete its precise GPS evidence from the app. Deleting evidence does not change the facts of your Result: which Posts you completed and when stay as they were. During an Active Attempt the evidence cannot be selectively deleted; abandoning the Attempt is the available terminal choice.
Results and the Results Board
A Result is the immutable outcome of a completed Attempt: Start, Finish, elapsed time, and cumulative Post times. It has no score, rank, penalties, or correctness, and it cannot be edited by anyone.
The Results Board for a Race is private to its Organizer and its retained Participants and appears only after the Race closes (or is cancelled after it started). It groups people as Completed, Did Not Finish, and Did Not Start, sorts them by display name, and never shows anyone's GPS, answers, media, or detailed Attempt records. If you withdraw or are removed before you start, you are not listed.
Invitations
Organizers invite people by exact email. They are never told whether that email is already registered. An Invitation link grants nothing by itself: you must be signed in with the matching verified email to see even the preview, and you decide whether to accept or decline. Pending Invitations expire when the Race starts.
Sessions and security
Each phone or browser you sign in on gets its own Authentication Session. You can see them in your account and sign out any one of them, all others, or everywhere. Ordinary sign-out ends only the current session. A password reset, a detected refresh-token reuse, account closure, or an operator disablement ends every session at once.
Passwords are hashed with Argon2id and must be at least 15 characters; we block the most common ones but impose no composition rules. Access tokens live 15 minutes; refresh credentials rotate and expire after 30 days of inactivity or 90 days in total.
Closing your account
You can close your account once you have no Active Attempt and organize no Upcoming or Open Race. Closure revokes every session, removes your email and display name from the account, expires Invitations sent to or by you, deletes unreferenced draft Routes and Races, and archives Routes that Race history still depends on. Your detailed location evidence is deleted. Race history that other people's Results depend on is kept in anonymised form and shows you as “Former participant”. Registering again later creates a new account; a closed one is never reopened.
Operators and logs
A small number of trusted service staff can perform narrowly scoped, audited support and safety actions: disabling or reinstating an account, revoking sessions, cancelling an affected Race, or handling evidence under a privacy request. Operators cannot sign in as you or edit Routes, Post Completions, Attempts, or Results.
Ordinary logs reference opaque identifiers and request ids. They exclude coordinates, answers, media, credentials, signed URLs, and unnecessary identity. Database backups run daily; object storage is versioned.
Map backgrounds on this website and in the app come from OpenFreeMap, using OpenStreetMap data. Your browser or phone fetches map tiles for the area you are viewing directly from that service, so it sees your network address and which map area you looked at, never your account, Routes, or Posts. The website's “show my location” map button uses your browser's location only to centre the map; it is never sent to us.
Questions about any of this? See Support. This page describes the private beta and will change as the product does.