Privacy Policy

Account data. When you sign up with email we store your email address and a hashed password (handled by Better Auth). When you sign in with Google we receive the profile data Google shares: name, email, and avatar image. Other providers such as Strava may be offered in the future under the same model.

Profile data. Your claimed username, display name, optional bio, and avatar.

Race data. Race titles, distances, finish times, dates, timing links, and proof images you upload. Proof images are stored in Convex file storage.

Cookies and local storage. We set session cookies to keep you signed in. During the claim flow we stash your staged handle and PR in your browser's local storage (fmr:pending-claim) so it survives the sign-in redirect; it expires after 30 minutes and never leaves your device until you finish claiming.

Trophy rooms are public by design. Your claimed username, display name, bio, avatar, race cards, total miles, and prestige tier are visible to anyone at flexmy.run/[username], and can appear in the share card images generated at /[username]/story.png. Do not post anything you do not want public.

We run no analytics, no advertising, no third-party trackers, and we do not sell your personal data. There is nothing to opt out of because nothing is collected beyond what the service needs to run.

We rely on a small set of processors to run the service:

• Convex: database, server functions, and file storage
• Better Auth: authentication and session management
• Netlify: hosting and content delivery
• Google: optional sign-in provider

Timing links and proof URLs you attach point to third-party sites (Athlinks, Sportstats, RunSignup, and similar) that have their own privacy practices.

We keep your data while your account is active. Email imtiaz@raqib.tech to request an export or deletion of your account and race data. Deleting your account releases your handle and removes your public profile.

Under Canadian privacy law you can request access to the personal information we hold about you, ask us to correct it, and withdraw consent to further collection (which may require deleting your account). Contact us at imtiaz@raqib.tech.

FlexMy.Run is not directed at children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, contact us and we will remove it.

If this policy changes we will update the date above. Material changes will be called out on this page.