Privacy Policy

The race catalog, BQ Course Finder, guides, verdicts and comparison pages are usable with no account and no sign-in. If you never sign in, we do not create a record for you. Any goal, division or race time you enter on those pages is kept in your own browser's local storage and never sent to us.

• Account details — your email address, and a display name if you provide one. Authentication is handled by Supabase Auth; we never see or store your password.
• Profile you enter — home city (which we convert to approximate coordinates so we can estimate travel), year of birth, sex, and your unit preferences. Year of birth and sex are used only to determine your Boston/NYC qualifying division, which is defined by age and sex.
• Training plans you save — the plan, the target race, and the finish time we projected when you saved it.

Connecting Strava is optional, and everything except the training features works without it. If you do connect it, we request read access to your activities and store, for each run:

• distance, moving and elapsed time, elevation gain, cadence, and average and maximum heart rate
• start and end coordinates and the route polyline — this is location data about where you run, and we treat it as the sensitive data it is. It is used to attach historical weather to a run and is never displayed publicly or shared
• the device name reported by Strava, and the raw API response for that activity
• your Strava access and refresh tokens, encrypted at rest under a key held outside the database

You can disconnect at any time from your dashboard. Doing so revokes our access at Strava and deletes every activity we imported, along with the fitness state computed from it. You can also revoke access directly in your Strava account settings. We do not sell, licence or publish your Strava data, and we do not use it to train machine-learning models.

• Database — Supabase (PostgreSQL), hosted in the United States. Row Level Security is enabled on every table, so one account cannot read another's rows.
• Application hosting — Vercel.
• If you are outside the United States, your data is transferred to and stored in the United States.

• Strava — only to fetch your activities, with your authorisation.
• Open-Meteo — receives coordinates and timestamps to return historical and forecast weather, and receives a city name when you set your home city. No account identifiers are sent.
• Vercel Analytics — privacy-focused, cookieless page and event analytics. It does not use cookies or build cross-site profiles.
• Supabase and Vercel as infrastructure providers, as above.

We do not sell your personal information, and we do not share it with advertisers.

We use a session cookie to keep you signed in. That is the only cookie we set. Our analytics are cookieless, and we run no advertising or cross-site tracking cookies.

Depending on where you live — for example under the GDPR in the UK and EU, or the CCPA in California — you have the right to access a copy of your data, correct it, delete it, or object to processing. We extend these rights to everyone regardless of location.

You can delete your account yourself from your dashboard, which removes everything below immediately. Or email privacy@marathoncompass.com and we will action it within 30 days. Deleting your account removes your profile, connected accounts, imported activities, computed fitness state and saved plans.

We keep your data for as long as your account exists, because the training features depend on your running history. Disconnecting Strava stops new activities being imported; ask us to delete and everything held about you goes.

Marathon Compass is not directed at children under 13 and we do not knowingly collect their data.

If this policy changes materially we will update the date at the top and, for anyone with an account, say so by email before the change takes effect.