Privacy Policy

Effective October 12, 2026. This policy describes the Run to Obtain service at runtoobtain.com. For privacy questions, access, correction, or deletion requests, use our contact form.

Who this service is for

Accounts are for ages 13 and older. We ask for an age band, not a full birth date. We do not offer under-13 or parent-managed accounts. If you believe someone under 13 has created an account, a parent or guardian should contact us so we can investigate and remove the account and associated personal information.

Information we collect

Account records include a login username, actual name, age band, password hash, recovery email once verified, verification tokens, and login sessions. Runner profiles include a chosen nickname, its moderation status and approved nickname, optional huddle nickname, school name and city/state, selected sports, and saved goal settings. We store event membership and manually entered or screenshot-assisted activity dates, distances, activity type, and duration. We do not record GPS routes or connect to running apps.

Organizers provide event descriptions, school details, dates, goals, and optional devotional content and author names. Representative applications include a public name, ministry, region, story, official staff-page link, legal donation recipient, and review records. Stripe collects payment, identity, and banking details directly; we store connected-account identifiers, donation amounts, payment status, and transaction references, not card or bank-account numbers.

Support requests contain your reply email, topic, message, and submission date. Please do not send passwords, payment details, or unnecessary information about children. The hosting service may process technical connection and security logs. We use a hashed network identifier to limit abusive requests.

How information is used and shared

We use information to provide accounts, recover access, organize events, calculate standings, publish organizer content, process optional donations, handle support, and protect the service. Actual names are self-reported and are not independently verified. Within a joined event, all members and the organizer can see runner nicknames (or an assigned runner label if removed), huddle nicknames, and mileage totals. Closed events keep a snapshot of final standings. An invitation code controls joining; anyone given that code may join while the event accepts participants.

Actual name, login username, email, age band, school fields, and sports are not included in runner lists or public student profiles. School event listings intentionally marked public show event descriptions, dates, school, and sport, but not participant lists or invitation codes. Approved representative profiles are public. Administrators can review runner nicknames and associated actual names, representative applications, and support requests. Runner nicknames appear on event leaderboards and any support page the runner chooses to share. Actual names remain available to the account holder and administrators. Public event listings do not include student rosters. There are no student-to-student messaging features.

Service providers process information needed to operate the service: Sites/Cloudflare for hosting and storage, Resend for account email, and Stripe for payments and onboarding. Administrator authentication uses the hosting provider’s sign-in. We do not sell student information or use the app to serve targeted advertisements. Information may also be disclosed when legally required or needed to investigate abuse.

Optional runner support pages and pledges

Runners may explicitly enable a shareable support page. Anyone with that link can see the runner’s nickname, event name and dates, total event mileage, and receiving FCA representative. Actual names, school profile fields, individual activity records, and supporter identities are not published on that page. The runner can stop sharing; existing supporters retain access to their own pledge and final event mileage.

Adult supporters use an account to store a fixed-gift or per-mile pledge, rate, maximum amount, cancellation state, payment references, and payment status. Runners see aggregate pledge counts and donation totals, not supporter contact information. Pledge records are retained with event and payment records. Per-mile pledges are paid through Stripe after the organizer closes the event; no automatic card charge or payment reminder email is sent. Return to My pledges to review and pay.

Game teams and Match Challenge payments

Event-specific team choices and frozen scores are stored with event records. Public game pages show team names, membership counts, and aggregate mileage or round scores, not student rosters or donor identities. Only the organizer sees the private invitation code through that page. Student-created Faceoffs are not listed publicly in school searches.

Adult team pledges store the selected team, rate, cap, conditions, consent text and timestamp, recipient, payment status, and Stripe customer, setup-session, payment-method, and transaction identifiers. We do not store card numbers. For Match Challenges only, an adult can authorize a one-time automatic charge after closure. Other pledges are manually paid. Organizers see aggregate giving totals; supporters see their own agreements and payments in My pledges.

Optional run screenshots

You may upload or paste a screenshot to fill in activity details. Your browser resizes it and removes image metadata. The image is sent to OpenAI to read the activity date, distance, unit, type, and duration. Crop out names, maps, and other private information first. Images are not saved by Run to Obtain or shown to other runners. OpenAI may process and retain API inputs according to its service and abuse-monitoring policies; disabling response storage is not a guarantee of zero provider retention. Review and confirm every field before saving; image reading does not verify authenticity.

We store a per-runner image fingerprint to help detect duplicate uploads and a temporary reading draft. Unsaved drafts expire after 24 hours and are cleaned up on that runner’s next upload. Extracted draft details are cleared on saving; the fingerprint remains until the associated activity is deleted.

Retention and your choices

Account, activity, event, and final-standing records remain stored while the account and events are maintained; there is no automatic event-record expiry. Login sessions expire after 30 days and verification/reset links after 30 minutes. Expired authentication records are cleaned up during account activity. Support requests remain available for follow-up until an administrator removes them. Payment and review records may need to be retained for transaction, dispute, or legal obligations.

You can update school, sports, and huddle details in your profile, update your recovery email, or delete an activity. Deleting an activity does not rewrite a closed event’s final standings. Request access, correction, or deletion—including removal from final standings—through the contact form. We may ask you to verify account ownership or parental authority before acting. Parents and guardians may contact us about their child’s information. Requests requiring retention of certain payment or legal records will be explained when handled.

Security and updates

Passwords are hashed, sessions use protected cookies, and private workspace data requires authentication. No system can guarantee complete security. This policy may be updated as the service changes; the effective date above identifies the current version.