Privacy policy

Last updated: October 28, 2026

GPXTiming times rides from GPS data, so we take care with it. This page explains what we collect, why, who sees it, how long we keep it, and how to ask us to delete it.

Who is responsible

GPXTiming is run by Spincast Outdoors, LLC, 935 Planters Wharf Rd., Lusby, MD 20657, USA. Each event is run by its own event organizer (a "director"), who decides who may enter and uses GPXTiming to check rides and publish results. GPXTiming handles riders' information on the organizer's behalf, and is responsible for keeping it safe and for deleting it on the schedule below.

What we collect

• When you register for an event: your name, email address, gender, year of birth, city, state and country, whether you ride geared or single-speed, and the club or team you enter. An organizer may also give you a bib number.
• If you are under 18: your parent's or guardian's name, email address and phone number, and their consent. We only accept riders aged 13 or older, and an organizer may set a higher minimum.
• Your ride: the GPS file you upload. A track is a list of places and times, so it can show where you started and where you rode. We keep only the track points, not the device or account details in the file, and we record the network address the upload came from.
• If you connect RideWithGPS (optional): a sign-in token for your RideWithGPS account (never your password), your RideWithGPS user number, and a note of which of your rides we looked at and what we did with each. We download only rides that match your event, and a downloaded ride has every point of the track, including any place you hid with a RideWithGPS privacy zone.
• If you sign in to the rider dashboard (optional): your email address, and the time and internet address of each sign-in request. The dashboard shows only what we already hold about your own registrations, results and rides, gathered by that email address (for a child, the parent or guardian’s address).
• Teams: the team name and who is on it, if you create or join a team.
• Organizers and administrators: your name, email address, the name and address of your organization, and a record of what you do in the director area (for example approving a ride).
• Technical data: the usual records a server keeps, such as network address and browser type, used to run and protect the service.

Cookies

We use only the cookies the service needs to work: one that keeps an organizer signed in, and one that protects forms from forgery. They are not used for advertising or tracking, and we do not run analytics or advertising scripts, so there is no cookie banner to accept. Riders do not need an account and are not signed in. The sign-up form uses Cloudflare Turnstile to tell people from robots, which Cloudflare provides under its own privacy terms.

Why we use it

To work out your time and check your ride, run the event's results, email you your private upload link and event messages, let the organizer review and correct results, and keep the service secure. We do not sell your information, use it for advertising, or use it to train artificial-intelligence systems.

Who can see it

• The public sees an event's results: your name, category, place, state and country, and your time. The organizer chooses how the names of riders under 18 appear (full name, first name and last initial, team or school only, or not at all), and public results never show a rider's track, route or map, or the clock times they started and finished.
• The event organizer sees your registration details and your ride (the track, on a map) so they can review and correct your result. Only people signed in to the organizer's account can see the course or any rider's track.
• GPXTiming administrators can see what the organizer sees, to run and support the service.
• Our service providers host the service and send its email, under their own privacy terms: server hosting, Cloudflare (network protection and file storage), Amazon Web Services (email), and Mapbox (the maps organizers use, which receive the map areas an organizer views).
• RideWithGPS, if you connect your account there, tells us about your rides under its own privacy terms. We never change anything in your RideWithGPS account.

How long we keep it

• Your GPS file is kept until the organizer finalizes the event, when it is deleted. It is never kept longer than 90 days after the event's upload period ends.
• Your RideWithGPS sign-in, if you connected one, is deleted when you disconnect, when the organizer finalizes the event, or when uploads for the event close, whichever comes first, and we then ask RideWithGPS to cancel it. The note of which rides we looked at is deleted with it.
• Rider dashboard sign-in links work once and expire after 15 minutes, and a spent or expired link is deleted within a day. The dashboard keeps nothing of its own: what it shows ends when the underlying registration, result or ride is deleted, as described above.
• Your personal details (email address, guardian details, year of birth, network address and similar) are deleted when the organizer finalizes the event. If the event is part of a running series, a few details needed to join your results across the series are kept until the series ends, and then deleted.
• Your result (your name as shown publicly, category, place, club or team, and time) is kept for 5 years after the event is finalized and then deleted. The published results page and downloads stay available for that time.
• Sign-up requests and sign-in links for organizers are kept while they are needed to run the service. A record of actions in the director area is kept for the life of the account.
• Email addresses that bounce or complain are kept only as a one-way fingerprint, so we stop sending to them; the address itself is not kept.

Your choices and rights

You can ask us to show you the information we hold about you, correct it, delete it, or stop using it. A parent or guardian can ask for a rider under 18. If you are in the UK or the European Economic Area you can also complain to your data protection authority.

To make a request about a ride or registration, open the privacy page of the event you rode in and use "Make a request", or email us. You can also write to [email protected], naming the event. We will carry out your request, and confirm in writing, within 30 days.

When your data is deleted, your registration, your ride and your personal details are removed. If the event is already final, your name and result are removed from the published results page and the text and CSV downloads (the PDF is withdrawn, because a PDF cannot be edited).

Age

GPXTiming is for riders aged 13 and over. Riders under 18 need a parent or guardian to consent when they register. We do not knowingly collect information from anyone under 13; if you think a child under 13 has registered, tell us and we will delete the registration.

Security

Connections are encrypted, uploaded files are stored privately and can only be opened through the organizer's signed-in account, rider upload links are long secrets stored only as fingerprints, and organizers sign in with single-use emailed links rather than passwords. No system is perfectly secure; if there is a breach that affects you we will tell you and the organizer as the law requires.

Changes to this policy

If we change what we collect or how we use it, we will update this page and its date and, where the law requires, tell you and ask for your consent again.

Contact

Spincast Outdoors, LLC, 935 Planters Wharf Rd., Lusby, MD 20657, USA. [email protected].