Privacy Policy

My Virtual Race ("MVR", "we", "us") is operated by MyVirtualRace Ltd, a company based in the United Kingdom. We are the data controller for the personal data described in this policy. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For any privacy question or request, email hello@myvirtualrace.com.

• Account details – name, email address, password (stored only in encrypted, hashed form), profile photo and preferred units.
• Activity data – the activities you log or sync, such as activity type, distance, duration, date, reps and personal bests.
• Connected services – if you connect a fitness service (for example Fitbit), the activity data you choose to sync from it.
• Race & social data – races and teams you create or join, leaderboard positions, trophies, friends, invites, chat and direct messages.
• Corporate data – if your employer runs a corporate race, your name, email and team as provided by them or by you.
• Payment data – plan, billing status and transaction records. Card details are handled directly by our payment provider; we never see or store your full card number.
• Support messages – anything you send us through the contact form or by email.
• Device & usage data – IP address, browser or device type, app version, pages viewed and features used, and push notification tokens if you allow notifications.

We do not collect precise GPS location, and we do not sell your personal data.

• To create and run your account, races, teams, leaderboards and trophies.
• To calculate progress, streaks, personal bests and share cards.
• To send account emails (verification, password reset, receipts) and race updates or notifications you have opted into.
• To process payments and manage subscriptions or corporate packages.
• To keep the service secure, prevent fraud and cheating, and enforce our Terms.
• To understand how the service is used so we can fix problems and improve it.
• To answer your support requests.

• Contract – to provide the service you signed up for.
• Legitimate interests – security, fraud prevention, product analytics and improving MVR.
• Consent – connecting third-party fitness services, push notifications and optional marketing. You can withdraw consent at any time.
• Legal obligation – keeping financial records and responding to lawful requests.

Activity data such as exercise can, in some cases, reveal information about your health. We only use it to run your races and show your progress, and only with your consent when you log or sync it.

We share personal data only with service providers who help us run MVR, under contracts that protect your data:

• Stripe – payment processing.
• Resend – sending transactional emails.
• PostHog – product analytics.
• Cloud hosting, database and file storage providers – hosting the service and your uploaded images.
• Fitbit / Google – only if you choose to connect your account.
• Apple and Google – delivering the mobile apps and push notifications.

If you take part in a corporate race, the organising company can see your name, team and race progress. We may also disclose data if required by law, or as part of a sale or reorganisation of our business.

Members of a race can see your name, profile photo, team and activity totals in that race. If your profile is discoverable, other users can find you to send friend requests; you can turn this off in Settings → Privacy. Share cards and public race or trophy links you create can be viewed by anyone you share them with.

Some of our providers store or process data outside the UK, including in the United States. Where this happens we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to protect your data.

We keep your data for as long as your account is active. If you ask us to delete your account, we delete or anonymise your personal data within 30 days, except where we must keep certain records (for example payment records for up to 6 years for tax purposes). Race results may remain in anonymised form.

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your data and account deleted;
• restrict or object to how we use your data;
• receive your data in a portable format;
• withdraw consent at any time.

To use any of these rights, including deleting your account, email hello@myvirtualrace.com from the address on your account. We will respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

We use essential cookies to keep you signed in and secure. We also use analytics (PostHog) to understand how MVR is used. You can block or delete cookies in your browser settings, but parts of the service may stop working.

MVR is not intended for children under 13 and we do not knowingly collect their data. Users aged 13 to 17 should have permission from a parent or guardian. If you believe a child under 13 has given us data, contact us and we will delete it.

We use encryption in transit (HTTPS), hashed passwords and restricted access controls to protect your data. No system is completely secure, so please use a strong, unique password.

We may update this policy from time to time. We will change the "last updated" date above and, for significant changes, let you know by email or in the app.

MyVirtualRace Ltd, United Kingdom – hello@myvirtualrace.com