Privacy Policy

Last Updated: August 17, 2026

This Privacy Policy describes how Race Dashboard ("we", "our", or "us") collects, uses, and protects your personal information when you use our mobile application (the "App").

1. Information We Collect or Process

Some information described below is processed only on your device. It is not sent to the Race Dashboard broker unless this policy says otherwise or you choose to share it.

1.1 Authentication Data

When you sign in to the App, we collect authentication information through Microsoft Azure AD B2C, including:

• OAuth access and refresh tokens
• User ID and email address
• Profile information (name, display name)

1.2 User Profile Information

To provide race management services, we collect:

• British Cycling (BC) membership number
• User display name and profile information

1.3 Event Data

As part of race management functionality, the App processes event-related data including:

• Rider information (names, bib numbers, categories, license numbers)
• Incident reports and notes
• Race results and protests
• Event assignments and schedules
• Documentation (technical guides, risk assessments, levies)

1.4 Expense Claim Data

If you use the expense claim features, the App processes information needed to prepare and manage your claims, including:

• Claimant name, home address, and home postcode
• Account name, account number, sort code, and bank name
• Event, organiser, journey, mileage, and route-calculation details
• Expense categories, descriptions, amounts, claim statuses, and status dates
• Receipt photographs and generated expense workbooks
• The date on which you accepted the Google route-calculation disclosure

Expense profiles, claim records, receipts, and generated workbooks are stored locally and are scoped to your signed-in account. Race Dashboard does not automatically upload this expense data to the Race Dashboard broker or Azure Blob Storage. Data is sent off the device only when you request a Google route calculation or choose to send or share a claim, as described below.

1.5 Device Information

We collect device information to ensure app functionality and security:

• Device ID and platform information
• Device model and operating system version

1.6 Location Data

The App may access location identifiers (What3Words addresses) for event locations, which are stored locally on your device.

1.7 Crash Reports and Analytics

To improve app stability and performance, we collect:

• Crash reports and error logs via Firebase Crashlytics
• Usage analytics and telemetry data

2. How We Use Your Information

We use the collected information for the following purposes:

• Authentication: To verify your identity and provide secure access to the App
• App Functionality: To enable race management features, including rider lookup, incident logging, and document access
• Expense Claims: To calculate mileage, prepare expense workbooks, retain claim history, and let you send claims and receipts to the event organiser
• Offline Operation: To store event data locally so the App works without internet connectivity
• Crash Reporting: To identify and fix bugs and improve app stability
• Analytics: To understand app usage patterns and improve user experience

3. Data Storage and Security

3.1 Encryption

We implement strong security measures to protect your data:

• All event data containing personally identifiable information (PII) is encrypted using AES-256-GCM encryption
• Authentication tokens are stored in secure platform storage (iOS Keychain / Android Keystore)
• Local databases use SQLCipher encryption with keys stored in secure storage
• Expense profiles and claim records are stored using secure platform storage and are separated by account
• Expense receipts and generated workbooks are stored in the App's private application-support directory; additional file protection and backup exclusion are applied on iOS where supported
• All data transmission is encrypted using HTTPS/TLS

3.2 Data Retention

Cached event data is automatically deleted from your device 14 days after the event end date. Authentication tokens are retained until you sign out or they expire.

Expense data is not part of the 14-day event-data purge. Your expense profile and claim history remain available for the same signed-in account after sign-out and do not currently have a fixed automatic deletion period. You can delete an individual claim and its associated receipts and generated files from the expense screens. You can delete your complete expense profile, bank details, claims, receipts, and workbooks by selecting Delete all expense data in Settings. Account deletion also requests removal of this local expense data.

Because secure platform storage may behave differently between operating systems, uninstalling the App should not be relied on as the only way to erase expense data. Use the in-App deletion controls before uninstalling if you want to ensure that this data is removed.

3.3 Offline Storage

The App stores event and expense information locally so that relevant features work without an internet connection. Event caches and expense records follow the separate retention rules above. The App applies the platform storage and file protections described in section 3.1; it does not claim that every locally stored expense file is independently encrypted on every platform.

4. Third-Party Services

We use the following third-party services that may collect or process your information:

4.1 Microsoft Azure AD B2C

We use Microsoft Azure AD B2C for user authentication. When you sign in, your authentication is handled by Microsoft according to their privacy policy. We receive only the information necessary to identify and authenticate you.

4.2 Firebase Crashlytics

We use Google Firebase Crashlytics to collect crash reports and error logs. This helps us identify and fix issues. Crash reports may include device information and error details.

4.3 Azure Blob Storage

Event data and documents are stored in Microsoft Azure Blob Storage. All PII data is encrypted before transmission and storage.

4.4 Google Maps Platform Routes API

If you select Calculate with Google Maps and accept the in-App disclosure, your home postcode and event destination are sent directly from your device to the Google Maps Platform Routes API to calculate road distance. These route inputs are not sent to the Race Dashboard broker. Google may also receive service-request information such as your IP address, application identifier, and routing coordinates generated from the submitted locations. Google handles this information under its own privacy terms.

Race Dashboard does not send your bank details, receipt photographs, expense descriptions, or claim amounts to Google for route calculation. You can enter mileage manually instead of using Google Routes.

Use of Google Maps features is subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy.

4.5 Email and Sharing Services

The App does not send expense claims automatically. When you choose to send a claim, the App hands the generated workbook and any receipt attachments to your selected email application. If no email application is available, the App offers a separate, confirmed hand-off to the device share sheet. The intended event organiser, your chosen email or sharing provider, and any service used to deliver the message will process the information according to their own terms and privacy policies.

5. Data Sharing

We do not sell your personal information. We only share data as necessary to provide the App's functionality:

• With Microsoft Azure AD B2C for authentication
• With Azure Blob Storage for event data storage
• With Firebase Crashlytics for crash reporting
• With Google Maps Platform when you request route calculation after accepting the disclosure
• With your selected email or sharing service and the intended event organiser when you choose to send an expense claim, workbook, or receipts
• As required by law or to protect our rights

6. Your Rights

You have the following rights regarding your personal information:

• Access: You can request access to the personal information we hold about you
• Deletion: You can delete individual expense claims, use Delete all expense data in Settings, request account deletion, or contact us directly. Signing out clears authentication and event caches but does not delete your account-scoped expense profile or claim history
• Correction: You can update your profile information within the App
• Data Portability: You can export your event data through the App's functionality

To exercise these rights, please contact us using the information provided in the "Contact Us" section below.

7. Children's Privacy

The App is intended for use by race officials and commissaires. We do not knowingly collect personal information from children under the age of 13. If you believe we have collected information from a child under 13, please contact us immediately.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

9. Contact Us

This privacy policy is effective as of the date listed above and applies to all users of the Race Dashboard mobile application.