Privacy Policy

1. Information We Collect

Account information. When you register, we collect your email address and any profile information you provide, including your name, username, sport, country, and bio. The minimum age to create an account is 13 (16 in the European Economic Area). Gender and date of birth are optional. You can add a date of birth later for age-group stats, or leave it blank. Your date of birth and email address are not included in your public profile.

Third-party sign-in. If you choose to sign in with Google or Apple, we receive your name, email address, and (for Google) profile photo from that provider in order to create and authenticate your account. We do not receive your password or any other information from these providers.

Athletic data. We collect the race results, personal bests, upcoming races, and achievement details you enter into the Service, including any splits, schedules, or role information (such as pacing duty) associated with a result.

User-generated content. We collect photos, certificates, optional finish-line voice notes, and other files you upload to the Service. On the mobile app, we request access to your camera, photo library, and microphone so you can take or choose photos and record a short voice note about a race. We only access these when you actively choose to add one, and never in the background. Voice notes are private to you by default. Achievement photos are processed on your device (for example, to suggest a crop or a share-card layout). This on-device processing never leaves your device or reaches our servers.

AI reading of certificates and tickets. If you choose to scan a finisher certificate or race ticket to fill in a race's details, we send that one image to Google Gemini, an AI service provided by Google, which reads the text on it (for example the event name, date, distance, and time) and returns it to us. We ask for your permission in the app before the first scan, and you can always type the details in instead. We do not send any other data to Gemini.

Instagram photo import. If you choose to paste a link to your own Instagram post to add its photo to a race result, we retrieve that single photo through Instagram's own sanctioned oEmbed API and store a copy of it. We do not access your Instagram account, and we never import photos without you providing the specific post link yourself.

Content reports. If you report a profile for objectionable content, we collect the reason you select, any details you provide, and your email address if you choose to leave one so we can follow up.

Usage data. We automatically collect information about how you interact with the Service, including pages visited, features used, device type, operating system, IP address, and crash reports.

Payment information. If you purchase a Lifetime Pro membership or make an optional tip on the web, payment is processed by Stripe. If you make the same purchase in our iOS or Android app, payment is processed by the Apple App Store or Google Play (via RevenueCat, our subscription-management provider) instead. In either case, we do not store your credit card number. We receive confirmation of the transaction, your membership tier, and, for app-store purchases, an anonymous purchaser identifier used to keep your membership in sync across devices.

2. How We Use Your Information

We use the information we collect to:

• Create and maintain your account and public profile
• Provide, operate, and improve the Service
• Send you transactional emails (account confirmation, password reset, purchase receipts, and notices about changes to our Terms or Privacy Policy)
• Send optional product emails you choose to receive: race tips and reminders, and (only if you opt in) product updates and announcements. You can change or turn these off at any time via the unsubscribe link in those emails
• Respond to your inquiries and support requests, including content reports
• Detect, prevent, and address fraud, abuse, or security incidents
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your data to serve you third-party advertisements.

3. Public Profile

Your Podium profile is public by default and accessible at podium.bio/[username]. This includes your name, username, bio, sport, country, race results, PBs, upcoming races, and any photos or certificates you choose to display. Do not post information on your profile that you do not wish to be publicly visible.

You can delete your account and all associated data at any time from the Settings screen.

Any visitor can report a public profile for objectionable content directly from that profile's page. Reports are reviewed by our team and are never shown publicly.

4. Athlete Results From Public Sources

Podium's mission is to give every athlete a permanent home for their race history, including results from before they ever joined Podium. To make this possible, we source publicly available race results (such as name, finish time, age category, and country) from race organizers' and timing providers' own public results pages, and use them to create "unclaimed" profiles that a real person can later find and claim as their own.

This means we may hold and publish limited race-result information about people who are not yet, and may never become, Podium users, and who have not directly given us this information. We only source results that were already published publicly by the event or its timing provider, and we take reasonable steps to exclude results from events or categories aimed at children.

If you find an unclaimed profile that belongs to you, you can claim it by creating a Podium account. If you would like an unclaimed profile removed instead (whether or not it belongs to you) you can request its takedown at any time, without needing an account, from that profile's page or by contacting [email protected]. We aim to review and action takedown requests promptly.

5. Data Sharing

We share your information only in the following circumstances:

• Service providers. We use Supabase for database hosting and authentication, Vercel for web hosting (fronted by Cloudflare, which caches public pages to keep the Service fast and does not itself store your personal information), Google Gemini to read the text on certificates and tickets you choose to scan, PostHog for first-party product analytics, Google Analytics on the website only, Resend for transactional and optional product email, Stripe for web payment processing, and RevenueCat together with the Apple App Store and Google Play for in-app purchase processing on mobile. These providers process data on our behalf under appropriate data processing agreements.
• Legal requirements. We may disclose your information if required to do so by law or in response to valid requests from public authorities.
• Business transfers. If Podium is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

7. Security

We implement industry-standard technical and organizational measures to protect your information, including encrypted connections (TLS), secure authentication, and row-level security on our database. No method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

8. Children's Privacy

The minimum age to use the Service is 13 (16 in the European Economic Area). The Service is not directed to children under that age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.

9. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Request deletion of your personal information
• Object to or restrict our processing of your information
• Data portability (receive a copy of your data in a structured format)

These rights also apply if you are not a Podium user but appear in an unclaimed profile sourced from public race results, see "Athlete Results From Public Sources" above for how to request removal.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection authority.

10. Cookies and Tracking

We use session cookies and local storage to keep you signed in and store your preferences (such as dark/light mode). We use PostHog to measure product events such as signup, onboarding completion, race creation, and profile sharing, including in the iOS and Android apps. Automatic click capture is disabled. On the website only, we record session replays of profile pages (with every text field masked) and anonymous click heatmaps to improve the design, and we also use Google Analytics; the mobile apps never record sessions or heatmaps and do not load Google Analytics. We do not use advertising cookies, we do not use the device advertising identifier, and we do not sell analytics data.

11. International Transfers

Your information may be processed and stored in countries outside your country of residence, including the United States. We rely on standard contractual clauses and other appropriate safeguards for international data transfers where required.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and, where required, by email. The "effective date" at the top of this page indicates when the policy was last updated. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, contact us at: [email protected]