Your data is yours, and keeping it private matters to us. This policy explains what we collect and why, who handles it, who can see it, and your rights. We never sell your data, and we never share it for advertising.
Handoff, meaning the website at handoff.run and the Handoff race-day app, is run by Negative Split Software LLC, a Washington company ("we" or "us"). This policy covers everyone who visits the site, has a Handoff account, or has been added to a team by a captain.
What we collect and why
Our rule is to collect only what we need to help you plan and run a relay. In practice:
Your account
You sign in through Clerk, our sign-in provider, using email, Google, or a passkey in the app. Clerk holds your login, and we never see a password. We keep your name and email address, plus a copy of your profile photo in our own storage, so teammates can recognize you and so we can email you about your teams.
Your profile
You can add a phone number, gender, a short bio, where you live, your 10K time, and a link to your Strava profile. From the Strava link we keep only your athlete number. We don't connect to Strava or read your activities.
Badges
When your team times a race with the Handoff app, about two days after the finish we save the awards you earned, a patch for the race and your relay milestones to your profile as badges. A badge keeps the race, the date and the numbers behind it (such as the legs you ran), and it is shown to the same people who can see your profile.
Public trophy case
Your badges are private unless you turn on a public trophy case in your profile settings. It is off by default. When you turn it on, you choose an address, handoff.run/runners/ followed by a name of your choice, and anyone with that address can open the page without an account. It shows your photo, your first name and the first letter of your last name, your badges (with the races and years they were earned at), the timed relays you have finished with the races and years, and your total timed relays and miles. It never shows your email, phone number, bio or Strava link, your teammates, a team's name, or races you haven't finished. Search engines may list the page while it is on. Turning it off takes the page down at once, and changing the address stops the old one from working. We count how many people open these pages, without the address or who you are. Deleting your account removes the page and its address.
Teams and rosters
When you captain a team, we store what you enter: the team, its roster (names, emails, phone numbers, 10K times), leg assignments, money each runner owes, your payment instructions, and race logistics such as vans, lodging and a group chat link. When you join a team, we record your membership.
Volunteers
A captain can keep a list of volunteers, people who help on race day without running. For each one we store what the captain enters: a name, an email address or phone number (or both), and for each team what they are doing, when, and whether their registration is complete. The list belongs to the captain, so the same people can be used for later races. Only the captain can see it: not your teammates, the spectator page, the race-day app or anyone else.
Messages, requests and asks
We store the posts you make looking for a team or for runners, the replies you send and receive, and the team asks you post, answer or claim. We also note when you last read a conversation so we can show what's new.
Race Pass payments
Race Pass payments go through Stripe Checkout. Your card details go straight to Stripe and never reach our servers. We give Stripe your email address and the team and race the pass covers. We keep the amount, the Stripe reference numbers, the receipt link, and whether the pass was refunded.
Race search and your location
When you type a place into race search, your browser sends that text to Google so it can suggest places. If you choose to search near your current location, your browser asks your permission first. We round the location to about a kilometer and put it in the page address so the search works. We don't save it to your account.
Support
When you contact us, the conversation is kept in our help desk (Help Scout) so we have the history if you write again. In the app, you can choose to attach diagnostics: the app version, phone model and operating system, language, your team and race name, and recent timing activity.
Logs
Our hosting provider keeps short-lived request logs, including IP addresses, for security and troubleshooting. Our own logs use account ids rather than your details, although an error log can occasionally include an email address.
Analytics and cookies
Product analytics (PostHog)
We use PostHog to learn which features get used and where people get stuck. On the website, PostHog records:
- The pages you view, and actions such as creating or joining a team, or filtering races.
- Errors that happen on the site.
- Session recordings: a replay of how the page moved as you clicked and scrolled. Every form field and all the text on the page are masked before recording, so a replay shows the page's layout but no names, emails, phone numbers or anything you type.
Before anything leaves your browser, we strip search text, places, coordinates and private links (such as spectator and team invite links) from page addresses. When you're signed in, this activity is tied to your Handoff account id, a random identifier, and never to your name, email or phone number. We use the same id for the actions our servers record, such as buying a Race Pass. Before you sign in, PostHog uses a random id instead.
When a search of the Help page finds no answer, we record the words you typed, without any email address or long number and without adding it to your profile, so we can see which answers are missing.
PostHog sets a first-party cookie and uses your browser's local storage to recognize a returning browser. Data is processed in the United States (PostHog Cloud US). It travels through our own address (handoff.run/ingest), which passes on your IP address and browser type but not your cookies. PostHog uses the IP address to estimate your rough location, such as your city. PostHog keeps events for up to a year and session recordings for 30 days.
To opt out, use the button below. It turns PostHog off in this browser until you clear this site's data. If your browser sends Global Privacy Control or Do Not Track, PostHog doesn't run at all. Our servers still record a few actions against your account id, such as buying a Race Pass.
When you delete your account, we ask PostHog to delete your analytics, including your events and recordings. To have them deleted without closing your account, email privacy@handoff.run.
Site performance (Vercel)
Vercel Web Analytics and Speed Insights count page views and measure how fast pages load. They set no cookies and aren't tied to your account.
Error reports (Sentry)
When something breaks on the website or our servers, an error report goes to Sentry so we can find and fix it. A report says what failed and where in our code, the address of the page or request with its search terms removed and spectator and invite links blanked out, and your browser type. It doesn't include your name, email, phone number, IP address, cookies, what you typed or what was on the page, and it isn't tied to your account. Coordinates are never included in an error report: any that appear in an error message or an address are replaced before it is sent. Sentry sets no cookies, processes reports in the United States, and keeps them for up to 90 days.
Cookies and browser storage
- Clerk sets the cookies that keep you signed in. Handoff doesn't work without them.
- PostHog sets one cookie and uses local storage, as described above.
- We cache your profile, your teams and the race list in your browser's local storage so pages load quickly. Your profile and teams are cleared when you sign out.
- The races map and place search load from Google, which handles that data under its own privacy policy.
We don't use advertising cookies or ad trackers.
The race-day app
On your phone: the app downloads your team's race plan so it works without signal. That includes the roster names, legs, vans, 10K times and logistics. It also keeps the timing it hasn't sent yet and your settings, and holds a support message for 30 days after sending it. If you use Find Van, the app also keeps the last position it saw of the other van on your phone until you sign out, so it can show where the van was without signal. Your login token is kept in the phone's secure storage. Signing out wipes the race data from the phone.
What it sends us: the exchanges and timing corrections you record, tied to your account and device. It also sends a random device id, a device label made of your first name and phone model (such as "Casey's iPhone") so teammates know which phone is timing, and a push notification token if you allow notifications. Notifications are delivered through Expo and Apple or Google.
Permissions: notifications (optional), the camera to scan a team's QR code, and location only if you opt in (see Find Van below). The app doesn't save photos, and it doesn't ask for your contacts. The app has no analytics library of its own: our server counts when Find Van is opened and when sharing starts or stops, with your account id, your team and the van number, and never a position.
Find Van (sharing your location): so teammates can find your van, the app can share your phone's precise location with your team. It asks first, and shares nothing unless you opt in. It shares only while the app is open and never in the background, from 30 minutes before to 30 minutes after a van exchange and while a teammate is looking for your van. While it shares, your phone sends its position about every 15 seconds, or every few seconds while the van is moving. On our servers we keep only the latest position of each van, and only your team's registered race-day phones can see the latest position. Teammates see it with your phone's label (such as "Casey's iPhone") and how long ago it was taken. A teammate's phone keeps the last position it saw of your van until they sign out of the app. It is never shown on the spectator page, the web team page or in analytics. A banner shows while you are sharing, and you can stop at any time with Stop on the banner. Stop pauses sharing until the end of that window, or for 30 minutes when you are sharing only because a teammate is looking, and a button lets you resume. You can also turn off location for Handoff in your phone's settings.
Crash reports: when the app crashes or hits an error, it sends a report to Sentry so we can fix it, as the website does. A report says what failed and where in the app's code, the app version and update, the phone model and iOS version, and the addresses of the app's recent requests to us with their codes and search terms removed. It doesn't include your name, email, phone number, the phone's name, your team's name, the roster or timing, your location, screenshots or what you tapped. It carries a random id for the app's installation, so we can count how many phones a crash affects, but it isn't tied to your account. A report made without signal waits on the phone and is sent once you're back online.
Who can see your details
- A captain sees the details they entered for you. Once you join their team, they and your teammates see your profile, including your email and phone number.
- When you post or reply to a request to join a team or find runners, captains at that race can see your profile without your email or phone number. Whether you then share contact details is up to you.
- A team's spectator page is public to anyone with its link, which the captain shares. It shows the team, the race, each leg's runner and times. Runners appear by first name unless the captain chooses full names. Spectator pages need a Race Pass and are hidden from search engines.
- Anyone with a team's invite link sees only the team's name. Joining needs a Handoff account.
- Only the captain who added a volunteer sees that volunteer's name, email, phone number and shifts.
- If you turn on your public trophy case, anyone with its address sees what the Public trophy case section above says it shows, and nothing else from your profile. It is off until you turn it on.
- If you opt in to Find Van, only your team's registered race-day phones can see your van's latest position. Your captain and teammates see it in the app, and nobody else does: not spectators, not other teams, and not anyone on the website.
Runners added by a captain
A captain can add someone to their roster with a name and email address, plus an optional phone number, 10K time and amount owed. The captain is responsible for having that person's permission. We use these details only to show them on that team's roster and, if the captain chooses, to send an invitation to join. Invitations say why they were sent, and we send nothing else unless a captain invites that person again.
When a captain removes someone who doesn't have an account, we delete their name, email and phone number, unless they are on another team's roster.
If a captain added you and you want to come off, ask the captain, or email privacy@handoff.run and we'll remove you.
A captain can also add you as a volunteer with a name and an email address or phone number. The same applies: the captain is responsible for having your permission, we use these details only to show them to that captain, and nothing is sent to you unless a captain chooses to send it. When a captain deletes a volunteer, the volunteer comes off teams whose race hasn't happened yet, and we keep the name and contact details on teams of finished races, visible only to that captain, so their record of who helped stays complete. To have yours removed from that record too, ask the captain, or email privacy@handoff.run.
Service providers
These companies process data on our behalf to run Handoff. All of them process it in the United States.
- Vercel: website hosting, request logs, Web Analytics and Speed Insights
- Neon: our database
- Clerk: sign-in and account security
- Stripe: Race Pass payments
- Resend: sending email
- Help Scout: support conversations
- PostHog: product analytics
- Sentry: error reports
- Amazon Web Services: storing and serving profile photos
- Google Maps Platform: the races map and place search
- Expo: app updates and push notifications
We share data with them only to provide Handoff, never so they can use it for their own purposes.
When we access or disclose your data
Nobody at Handoff looks at your data except to:
- help with a support request you made, in which case we'll ask before we look;
- fix an error that stopped something working;
- investigate abuse or a breach of our Terms of Use; or
- comply with the law. We share data with authorities only when a valid legal order compels us, and we tell you first unless the law prevents it.
We may use aggregated or de-identified data, such as how many teams are entered in a race, for any purpose.
If Handoff is ever sold or merged with another company, we'll tell you before your data is transferred or becomes subject to a different policy.
Your rights
We give everyone the same rights, wherever you live:
- To know and access: what we hold about you, and how it is used and shared.
- To correct: fix anything that is wrong.
- To delete: have your data erased, subject to what the law requires us to keep.
- To portability: get a copy of your data.
- To object or restrict: ask us to stop or limit a particular use of your data.
- To fair treatment: we won't treat you differently for using these rights.
- To complain: to a data protection authority, such as your local one if you are in the EU or UK.
You can do much of this yourself: edit your profile, choose which emails you get in your notification settings, or delete your account. For anything else, including a copy of your data, email privacy@handoff.run. We may ask you to write from your account's email address to confirm it's you, and we'll respond within 30 days.
Deleting your account
Open the account menu, choose Manage account, then Delete account. If you captain a team whose race hasn't finished, make another runner captain first.
Deleting your account removes your login, your profile and photo, your team memberships, the messages and ask answers you posted, your email and phone number on every roster, your badges and public trophy case address, your devices, and any position you shared with your van. The volunteers you saved as a captain are deleted too, and so are their shifts. We also ask PostHog to delete your analytics. You come off the roster of any race that hasn't started, and that team's captain is told.
We keep your name on the rosters and timing of races that have already started, because they are the team's history. We also keep Race Pass payment records, as the law requires. Deleted data can remain in database backups for a short time until the backups expire.
How long we keep data
We keep your account data while your account is active, and team data while the team exists. Rosters and timing from past races stay as the team's history. Support conversations are kept so we can refer back to them, and logs are kept only briefly. A van's last position is deleted from our servers within about a day after the race ends, or when you leave the team or delete your account, and the copy of the other van's last position kept on your phone is removed when you sign out. We may keep data longer when the law requires it or to resolve a dispute.
How we secure your data
Everything travels over encrypted connections (HTTPS). Our database and photo storage are encrypted at rest by our providers, and sign-in is handled by Clerk. Spectator and invite links work like passwords, so share them only with people you want to have them.
Where your data is
Handoff is run from the United States. If you use it from elsewhere, your information is transferred to, stored in and processed in the United States.
Children
Handoff isn't for children under 13, and we don't knowingly collect their data. Runners aged 13 to 17 need a parent or guardian's permission (see our Terms of Use). If you think we hold data about a child under 13, email privacy@handoff.run and we'll delete it.
Changes and questions
We may update this policy to reflect new features or new rules. When we do, we'll change the date at the top of this page. For significant changes, we'll also tell account holders by email or in the app.
Questions about this policy, your data or your rights? Email privacy@handoff.run. For anything else, use our contact form.
Adapted from the Basecamp open-source policies / CC BY 4.0.