Privacy
Borderless Runner is a small prototype run by two students. We collect as little as we can. This page says exactly what we store and how to have it removed.
Last updated 6 October 2026.
The short version
- No ads, no tracking cookies, no session recording and no third-party analytics.
- To plan a trip you need an account: we store your email, a securely hashed password and your plans.
- You can delete your account and all your plans yourself, any time, from your account page.
- We don't sell or share your data.
- Fonts and all other files are served from our own site, so loading a page doesn't send your details to Google or anyone else.
What we store, and why
| What | Why | How long |
|---|---|---|
| Your account: email address, a hashed password, a hashed recovery code, your plan choice (Free or Premium trial) and when you signed up | So you can sign in and keep your plans | Until you delete your account |
| Your plans: race, dates, home city, arrival time, goal time and the first name you enter (optional) | To show your plans on any device and let you share them by link | Until you delete the plan or your account |
| A sign-in cookie (see below) | To keep you signed in | 30 days, or until you sign out |
| Anonymous plan counts: the race, your home time zone, the time difference, days before the race, and when | To see whether the planner is useful | Up to 24 months |
| Feedback you send: rating, most useful part, comment, race | To improve the plans | Up to 24 months |
| Waitlist: your email address and the date you joined | From before accounts: to send one email when Premium launched | Until that email is sent or you leave |
| Races you add: the details you type in | To give the race its own link so you can plan and share it | While the prototype runs |
| Contact messages, and a reply email if you give one | To answer you | Up to 24 months |
Accounts and passwords
We never store your password. We store a one-way hash of it (PBKDF2 with a random salt), which can check a password but can't be turned back into one. Your recovery code, for resetting a forgotten password, is stored the same way, so we can't see it either. After several wrong passwords or codes an account is locked for a short time to stop guessing.
Anyone you give a plan's share link to can see that plan, including the first name on it if you added one. Deleting the plan stops the link working.
Cookies
We use one cookie, br_session, only to keep you signed in. It's strictly necessary, so we don't ask for consent. It holds a random code (we store only a scrambled copy), can't be read by page scripts, is only sent over HTTPS, and lasts 30 days or until you sign out. We don't use any other cookies.
Stored only in your browser
Checklist ticks, the races you added and the weight you enter in a Premium food plan are kept in your browser's local storage so you can come back to them. They are never sent to us. Clearing your browser data removes them.
Services we use
When you use “Fill in the rest for me” on Add a race, our server looks up the city on OpenStreetMap (Nominatim) and typical weather from NASA POWER. Only the city, country and race month are sent, never your email or name.
Hosting
The site runs on Cloudflare. Like any web host, Cloudflare processes your IP address to deliver pages and protect the site from abuse, and keeps short-lived technical logs. We don't use these to identify anyone.
Links to other sites
Plans link to official race and government websites. Those sites have their own privacy policies; we don't control them.
Children
Borderless Runner isn't meant for children under 13, and they shouldn't send us anything. In the EU, people under 16 need a parent or guardian's agreement to create an account. If we learn we've received information from a child under 13, we'll delete it.
Your choices
You can delete your plans, or your whole account, from your account page. You can also ask us what we hold about you, or ask us to correct or delete it, using the contact form.
Leave the waitlist
Changes
If we change what we collect, we'll update this page and the date at the top.