Privacy Policy

Effective date: September 28, 2026

1. Information We Collect

a. Account and Profile Information

When you create an account and set up your profile, we collect:

• Name and email address
• Password (stored only as a secure hash by our authentication provider; we never see or store your plaintext password)
• Discipline/sport, gender, bio, coach name, goals, events, and top races (all optional, entered by you)
• Location (city, state, and country), if you choose to provide it. We convert it into approximate map coordinates so you can appear on the athlete map and in distance filters.
• Profile photo, if you upload one

Your email address is never shown to other members; only Boundless administrators can see it, to support your account.

b. Location and Route Data

If you draw or upload a training route (by drawing on the map or uploading a GPX file), we store the resulting coordinates, the calculated distance, and the activity type (e.g. run or bike) you assign to it. We also store the meeting point for group workouts you create. We do not use your device's GPS and we do not track your location. Location data is only collected when you enter a place yourself: your profile location, an address search, a drawn route, or a meeting point.

c. Content You Create

Posts (including photos and links), comments, and votes in event and training group forums; group chat messages; competition discussion messages; direct messages and connection requests; workouts, routes, and RSVPs; and competitions and training groups you join.

d. Communications Between Members

Direct messages are stored on our servers so they can be delivered and displayed to the recipient. They are not end-to-end encrypted. If a message is reported (see section 1h), our moderators can see a copy of it. Please don't share anything in a direct message that you wouldn't want stored by us.

e. TrainingPeaks Integration (Optional)

If you choose to link your TrainingPeaks account, we store your TrainingPeaks athlete ID and the date you confirmed the link, and we receive training totals (such as distance, time, and number of workouts) for the competitions you take part in, to calculate leaderboard standings. Your name, or a pseudonym you choose, appears on leaderboards unless you opt out in your profile. Linking is entirely optional.

f. Push Notification Data

If you enable notifications, we store a device token issued by Apple and associate it with your account, so we can deliver notifications about messages, events, and community activity through Apple's Push Notification service. When you sign out or delete your account, the token is removed.

g. Bug Reports and Diagnostics

If you submit a bug report, we collect the description you write, a screenshot of the screen you were on (you can choose not to include it), the name of that screen, your device model, operating system version, and app version. On the website, if error monitoring is enabled, technical diagnostic data (browser, operating system, and an error trace) is sent to our error-monitoring provider when something goes wrong. The iPhone app does not include a crash-reporting or analytics service; if you choose to share analytics with app developers in your iPhone's settings, Apple may share crash reports with us. We do not use advertising or behavioral analytics tools.

h. Safety, Reports, and Blocks

To keep the community safe, text you post is automatically checked for slurs and hateful language before it is published. If you report a post, comment, message, workout, or profile, we store your report, the reason you chose, any note you add, and a copy of the reported content, and we email it to our moderation team for review. If you block another member, we store that block so their content is hidden from you and yours from them, and so you can't message each other. The member you block is not notified.

i. Security Checks

When you sign up, sign in, or reset your password, a security check from Cloudflare Turnstile runs to protect the Service from automated abuse. It may collect technical information about your browser or device to do so.

2. How We Use Your Information

We use the information we collect to:

• Operate and maintain your account and profile
• Display your profile, posts, routes, and activity to other members as intended by the Service's features (e.g., a forum post is visible to other members; a direct message is visible only to its recipient)
• Show you on the athlete map and in the athlete directory, and calculate leaderboard standings
• Connect you with coaches, training groups, events, and competitions you choose to join
• Deliver push notifications you've enabled
• Review reports, enforce our Community Guidelines, and keep the community safe
• Respond to support requests and bug reports
• Maintain the security and integrity of the Service
• Comply with legal obligations

We do not use your information for targeted advertising, and we do not sell your personal information to third parties.

3. How We Share Your Information

We share information only in the following circumstances:

• With other members, as intended by the feature you're using: your profile (without your email address), approximate location on the athlete map, posts, comments, chat messages, workouts, RSVPs, and leaderboard standings are visible to other members; direct messages are visible only to the recipient.
• With service providers who process data on our behalf, currently:
  • Supabase (database, authentication, and file storage hosting)
  • Vercel (website hosting)
  • Apple (push notification delivery, and Apple Maps for maps, address search, and route drawing in the iPhone app)
  • OpenStreetMap / Nominatim (turning the city or address you type into map coordinates, and maps on the website)
  • Cloudflare (Turnstile security checks at sign-up and sign-in)
  • Resend (emailing bug reports and content reports to our team)
  • Sentry (error monitoring for the website, when enabled)
  • Google Fonts (typefaces on the website)
  • TrainingPeaks, only if and when you choose to link your account
• Link previews. When a post or message contains a link, a preview of that page may be shown. In the iPhone app, the preview is fetched by your device, so the linked website receives a standard web request from it. On the website, previews are fetched by our servers.
• For legal reasons, if required to comply with a subpoena, court order, or other legal process, or to protect the rights, property, or safety of Boundless, our members, or the public.
• In a business transfer, if Boundless is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will notify you before your information becomes subject to a different privacy policy.

4. Data Retention

We retain your information for as long as your account is active. If you delete your account, we immediately and permanently delete your profile, posts, comments, messages, routes, RSVPs, blocks, and push notification tokens. Reports you filed are deleted too. Reports other members filed about your content may be kept, with the copy of the reported content, for moderation records. We may also retain information where required by law or necessary to resolve disputes or enforce our agreements.

5. Your Rights and Choices

• Access and correction: You can view and edit most of your profile information directly within the app at any time.
• Deletion: You can permanently delete your account and associated data at any time from Profile → Delete Account. Deletion is immediate and cannot be undone.
• Notifications: You can turn off push notifications at any time in your device's Settings app.
• Location: You are never required to provide a location. Leave your profile location blank to stay off the athlete map.
• Leaderboards: You can choose a pseudonym or opt out of leaderboards in your profile.
• Blocking: You can block or unblock other members at any time.

If you are a resident of California, the EU/EEA, UK, or another jurisdiction with data protection laws that grant additional rights (such as the right to data portability or the right to object to processing), contact us using the information below and we will honor applicable requests.

6. Security

We use industry-standard safeguards to protect your information, including encrypted connections (HTTPS/TLS) between the app and our servers, database access controls that restrict data to authorized requests only, and hashed password storage. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Children's Privacy

The Service is not directed to children under 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal information from children under that age. If we learn we have collected such information, we will delete it promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email before the changes take effect. The "Effective date" above reflects the most recent revision.