Privacy policy
Last updated: 14 October 2026
RaceDayCast helps runners plan their pace for a race based on the course and the weather. We collect as little personal data as we can. We don't sell your data and we don't show ads. We don't use analytics, tracking or advertising cookies.
Who is responsible
RaceDayCast is operated by SMSpass AS (organisation number 990 872 732), Norway, which is the data controller for the personal data described here. For any question about privacy, or to use your rights, email support@racedaycast.com or use the contact form. Postal address: SMSpass AS, Viulveien 303, 3514 Hønefoss, Norway.
What we collect and why
| Data | Why | Legal basis | How long we keep it |
|---|---|---|---|
| Account: name, email address and password (stored only as a secure hash, never in plain text), plus when the account was created, when you last logged in and when you confirmed your email address | To give you an account and let you log in | Contract (providing the service you ask for) | Until you delete your account |
| Sign in with Google (if you choose it): your Google account ID, name and email address, which Google sends us after you agree on Google’s page. We never see your Google password. | To create your account and let you log in with Google | Contract | Until you delete your account |
| Your settings: preferred race situation (alone, behind others, in a pack), whether to include shelter from buildings, units and goal time | To use your choices as defaults in your plans | Contract | Until you change them or delete your account |
| My times: race results (date, distance, time, race name) and level adjustments (date, percentage, your note) that you add | To show your level over time, your estimated race times and your training paces | Contract | Until you delete the entries or your account |
| Training (Plus): for runs and races you upload: name, date, distance, time, weather-adjusted pace and the result per kilometre. The file you upload (GPX/FIT) and your GPS track are not stored – they are read once and discarded, because a track can show where you live. | To show your weather-adjusted pace and your training log | Contract | Until you delete the run or your account |
| Planning a run: the place (from your device, if you allow it, or a point you click on the map), start time, duration, pace and an optional route | To fetch the forecast and work out what the conditions will cost. The place is sent to MET Norway (rounded to about 5 km) to get the forecast | Contract | Not stored |
| Free race: which race you unlocked with your free account, and when | To keep that race unlocked for you | Contract | Until you delete your account |
| Login attempts: email address entered, IP address, time and whether it succeeded | To protect accounts against password guessing | Legitimate interest (security) | 30 days, then deleted automatically |
| Password reset links: a scrambled copy (hash) of the link | To let you choose a new password | Contract | Valid for 60 minutes; deleted automatically after one day |
| Race requests: race name, date, city, links, your message and any GPX file you upload | To add the race you asked for | Contract | Until you delete your account, or ask us to delete them |
| Contact form: name, email address, message and IP address | To reply to you, and to stop spam (the IP address is used only to limit how many messages can be sent) | Legitimate interest (answering you, preventing abuse) | IP address removed after 30 days. Messages kept as long as needed to follow up; messages caught as spam deleted after 90 days |
Race plans are calculated when you ask for them and are not stored. You can use RaceDayCast without an account.
Cookies and local storage
- rdc_session: a strictly necessary cookie that keeps you logged in and protects forms against misuse. It is deleted when you close your browser.
- rdc-theme (stored only in your browser): remembers whether you chose the light or dark theme. It is never sent to us.
Because we only use what is strictly necessary, we don't ask for cookie consent.
Who else processes data
- Paddle (Paddle.com Market Limited) sells our paid plans as merchant of record. When you buy, Paddle collects your payment details, billing address and email under its own privacy notice. We receive only what we need to give you access and keep our accounts: a customer number, what you bought (and for which race), the amount, the dates of your trial and renewal, and the status. We never see your card details.
- Google (Google Ireland Limited), only if you choose «Continue with Google»: Google confirms who you are and sends us your name and email address, under Google’s own privacy policy. We send Google nothing about you.
- PROISP (Norway) hosts the website and the database, and sends our emails (such as password reset links). Your data is stored in the EEA.
- Map and code services. To show maps, your browser loads map tiles from OpenFreeMap and program code from unpkg. If the map service doesn't respond, tiles are loaded from OpenStreetMap instead. Like any website, these services see your IP address when your browser contacts them. We don't send them any other data about you.
- Weather and elevation data (MET Norway, NOAA, NASA POWER, USGS, IGN Spain, Kartverket, AHN, Copernicus, OpenStreetMap) are fetched by our server using only the location of the race course. No personal data is sent to them.
Your rights
You have the right to see the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive your data in a portable format. You can delete your account yourself at any time: log in, open My account → Profile and choose Delete my account. This deletes your account, settings, saved times, training log, free race, race requests (including GPX files), messages to us and login records straight away. To use any of the other rights, write to us through the contact form from the email address of your account. We will reply within 30 days.
If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet) or the data protection authority where you live.
Security
The site uses encrypted connections (https). Passwords are stored as secure hashes. Accounts are locked for a while after several wrong passwords, and access to the admin area is restricted.
Children
RaceDayCast is not intended for children under 13, and they should not create an account.
Changes
If we change how we handle personal data, we will update this page and the date at the top.