Legal

Privacy Policy

Last Updated: Sep 22, 2026

1. Who this policy is for — age requirement

Bib is not intended for anyone under 13 years of age. You must be at least 13 to create an account. We ask for your date of birth when you set up your profile and use it to check that you meet this requirement. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, contact us at privacy@racewithbib.com and we will delete it. Some regions set a higher minimum digital-consent age; where that applies, you must meet your region's age requirement.

2. Information we collect

a. Information you provide

• Account information. When you sign up with email and password, we collect your email address and a securely hashed password (handled by our authentication provider — we never store your password in readable form). If you sign up with Apple or Google, we receive basic account identifiers from those services (such as your name and email, subject to what you allow them to share).
• Public profile information. Your username, display name, optional profile photo/avatar, optional bio, and sport preferences. This is the part of your profile other members can see.
• Private personal details (required). Your full legal name, date of birth, gender, and current city and state. We ask for these once — during sign-up, or as a one-time prompt if you joined Bib before this version — and you can change them any time in Edit Profile. They are not shown on your profile and are not visible to other members, club admins, or event organizers browsing Bib. We use them to enter you in races (organizers need a legal name, age or date of birth, and gender for entry lists and age-group divisions) and to understand, in aggregate, who takes part in events on Bib. Your date of birth is also how we check the minimum-age requirement in Section 1. Access is restricted at the database level so that only you can read your own details through the app.
• Content you create. Club message-board posts, replies, likes, clubs you create or join (including a club's name, description, and city/state), and event registrations.
• Communications. If you contact us for support, we keep the messages and contact details you provide.

b. Information from services you connect

You can optionally connect third-party accounts. When you do, we import only what's needed to power Bib's features:

• Race organizers and timing partners — RunSignup, Race Roster, ChronoTrack, and other event partners (registration and race-result import): If you register for an event through Bib or connect an account with one of our partners, we may receive and store registration information (such as your name, email address, event, division, bib number, wave assignment, and registration status) along with official race results (including finish time, split times, placement, and other event statistics). We use this information to display your registrations, race history, results, personal records, badges, rankings, and other Bib features. When matching organizer-hosted timing imports, matching may be performed using the email address you used to register and other identifiers supplied by the timing provider to improve accuracy.
• Apple / Google Sign-In: the identifiers described above.

You control these connections and can disconnect them at any time (see Section 6).

c. Location information

• Live location sharing (opt-in). Bib has a race-day "live map." This is off by default and controlled by you, per race. If you turn it on, your device shares its precise GPS location so others can follow you on the map. By default only your accepted friends can see you; if you additionally choose "visible to all spectators," anyone watching that race — including people without a Bib account — can see your live position. Because a race can last from minutes to many hours and you won't keep the app open the whole time, when sharing is on your location continues to update in the background — including when the app is closed or your phone is locked — until you turn it off or the race ends, at which point sharing stops automatically. While sharing is active your phone shows a status indicator (iOS) or an ongoing notification (Android). Your live location is stored only transiently, is subject to a short freshness window, and turning sharing off removes your shared position.
• Map search. When you use "near me" / radius search or geocode an address (for example, when creating an event), your device location or the address you enter is used to find nearby events and is sent to our maps provider to look up coordinates.

We only collect precise location when you enable a feature that needs it; you can revoke location permission at any time in your device settings.

d. Contacts (optional)

If you choose to find friends from your phone contacts, we access your contacts to help you find or invite people. We don't use your contacts for advertising and don't sell them.

e. Information collected automatically

• Device and usage data. We use PostHog (product analytics) and Sentry (crash and error reporting) to understand how the app is used and to diagnose problems. This can include device type, operating system, app version, screens viewed, in-app actions, IP address, and crash diagnostics.
• Push notification tokens. If you enable notifications, we store a push token for your device so we can deliver alerts (see Section 4).

We do not currently process payments or collect payment-card information. Paid events are a future feature; if we add them, payment details will be handled by a third-party payment processor and this policy will be updated.

3. How we use your information

We use the information above to:

• Create and manage your account and profile;
• Provide core features — event discovery and registration, results, personal records and badges, the home feed, clubs and message boards, and the race-day map;
• Process event registrations, communicate registration updates, synchronize official race results, and provide race-related features;
• Enter you in races using your private personal details — organizers require a legal name, date of birth or age, and gender to place you in the correct division or age group;
• Confirm you meet the minimum age in Section 1;
• Understand who takes part in events in aggregate — for example how many participants fall into an age band, a gender, or a region. This is reported to us in summary form and is not used to build advertising profiles;
• Import and display your activity and race results from services you connect;
• Show your live location to your chosen audience — your friends, or all race spectators if you opt in — while you have sharing on during a race, including in the background so spectators can follow you throughout the event;
• Send push notifications you've enabled (for example: a friend registers for your race, an event you're in is updated, a waitlist spot opens, a personal record or badge, or a new club post) — you can control these by category in Settings;
• Keep the Service secure, prevent abuse, and debug problems (via crash/error reporting);
• Understand and improve the Service (via analytics);
• Communicate with you about the Service and respond to support requests;
• Comply with legal obligations.

4. How your information is shared

Bib is a social app, so some information is shared with other users according to your privacy settings:

• Public vs. private profile. Your profile is public by default. Anyone can see your profile and activity (results, personal records, race history, feed activity). If you switch your profile to private, that activity is hidden from people who aren't your friends — non-friends then see only your name, avatar, username, and sport preferences. This is enforced at the database level, not just in the app.
• Your private personal details are never part of either view. Your legal name, date of birth, gender, and city and state are not shown to other members whether your profile is public or private, and they are not included in club rosters, entry lists shown inside Bib, or the race-day map. They leave Bib only when you register for an event, as described below.
• Records visibility. You can separately hide your personal records and badges from others while keeping the rest of your profile visible.
• Friends. Friendships are mutual (both people accept). Friends can see your activity as described above, and your activity may appear in your friends' home feed (for example, registering for an event, hitting a PR, earning a badge, joining a club, or completing a race).
• Event registrations. If you register for an event through Bib, we share the information necessary to complete your registration with the applicable race organizer, registration provider, timing company, payment processor (if applicable), and other service providers involved in operating the event. This may include your legal name, date of birth, gender, city and state, contact information, emergency contact information (if provided), event selections, waiver acknowledgments, and other registration details required to administer the event. Once an organizer receives your registration, their privacy policy governs what they do with it.
• Events Bib lists but does not host ("official events"). Bib staff may list well-known races that are not run through Bib so you can find them and mark that you're taking part. Marking that you're taking part is visible to other members the same way any registration is, but because Bib is not the organizer we do not send your registration or personal details to anyone for these events — if you want to enter, you sign up on the race's own site under their privacy policy. Live race tracking and organizer announcements are switched off for these events.
• Clubs. Content you post to a club message board is visible to that club's members (and, for public clubs, may be visible more broadly per the club's visibility). Club admins and owners can moderate and delete posts and replies, and can remove members from the club. Removing you from a club ends your access to it; it does not delete your registrations, results, or personal records.
• Live location. While you turn on live-location sharing for a race, your position is shared with your accepted friends, and — only if you choose "visible to all spectators" — with anyone watching that race, including account-less viewers. This is enforced at the database level. Sharing runs only while you have it on (which continues in the background) and stops automatically when the race ends.

We also share information with the service providers below who process it on our behalf, and we may share information if required by law, to enforce our terms, to protect the rights, safety, and security of Bib and its users, or in connection with a merger, acquisition, or sale of assets (in which case we'll notify you of any change in how your information is handled).

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

5. Service providers and third parties

We rely on the following providers ("sub-processors") to run Bib. Each receives only the information needed to perform its function:

| Provider | Purpose | Data involved | |---|---|---| | Supabase | Backend, database, authentication, hosting | Account, profile, and all app content | | Vercel | Web app hosting | Web usage / delivery | | Mapbox | Maps, geocoding, static map images | Addresses and coordinates you search or set | | Expo push service (via Apple APNs / Google FCM) | Delivering push notifications | Push token + notification content | | PostHog | Product analytics | Device and usage data | | Sentry | Crash and error reporting | Device and crash diagnostics | | Apple / Google | Sign-in (if you choose it) | Account identifiers |

Services you choose to connect — RunSignup, Race Roster, and ChronoTrack — are controlled by those companies and governed by their own privacy policies. We recommend reviewing them. You can disconnect these at any time.

6. Your choices and controls

• Profile privacy: switch between public and private in Settings or Edit Profile.
• Records visibility: hide your PRs and badges from others in Settings.
• Location sharing: turn live location on/off per race (and choose friends-only vs. all spectators) in Settings (Privacy) or from the race-day map. It's off by default, continues in the background only while on, and stops automatically when the race ends. You can also revoke location permission at any time in your device settings.
• Notifications: enable/disable push overall and by category (Friends, Events, Clubs, Results) in Settings; you can also manage OS-level notification and location permissions in your device settings.
• Connected accounts: connect or disconnect timing partners at any time in Settings → Integrations.
• Profile edits: update your username, display name, bio, and sport preferences in Edit Profile.
• Private personal details: review or correct your legal name, date of birth, gender, and city and state at any time in Edit Profile, under "Private info." They are required to use Bib's race features, so they can be corrected but not left blank; deleting your account removes them.
• Delete your account: You can permanently delete your Bib account at any time from Settings → Danger Zone → Delete Account. We will begin deleting or anonymizing your personal information as described in Section 8 (Data Retention).

7. Your privacy rights

Depending on where you live, you may have rights to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your account and personal information;
• Export / port a copy of your information;
• Object to or restrict certain processing;
• Withdraw consent for optional processing (like location sharing) at any time.

Many of these actions can be completed directly within the Bib app, including editing your profile, adjusting privacy and sharing settings, disconnecting integrations, exporting your data (where available), and deleting your account. To permanently delete your account, go to Settings → Danger Zone → Delete Account and follow the prompts. If you need assistance or wish to exercise any other privacy rights, contact us at privacy@racewithbib.com. Deleting your account removes your profile and associated content (such as registrations, posts, results, and personal records) along with the private personal details described in Section 2(a), although we may retain certain information where required by law or for legitimate business purposes, as described in Section 8.

If you are in the EEA, UK, or Switzerland (GDPR): our legal bases for processing are your consent (for optional features like location sharing and analytics where required), performance of a contract (to provide the Service), our legitimate interests (to secure and improve the Service), and legal obligations. You may lodge a complaint with your local data protection authority.

If you are a California resident (CCPA/CPRA): you have the rights to know, delete, correct, and opt out of "sale"/"sharing" of personal information. As noted above, we do not sell or share your personal information for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.

We will not charge you to exercise these rights and will respond within the timeframes required by applicable law. We may need to verify your identity before acting on a request.

8. Data retention

We keep your personal information for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or anonymize your personal information within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, prevent abuse, or enforce our agreements. Aggregated or de-identified data that can no longer be linked to you may be retained. Backups are purged on a rolling schedule.

9. Security

We protect your information with industry-standard measures, including encryption in transit, database-level access controls (row-level security) that enforce your privacy settings, storing your private personal details in a separate owner-only record that no other member's session can read, and storing sensitive credentials (such as third-party access tokens) on the server side only, never in the app. No method of transmission or storage is 100% secure, so we can't guarantee absolute security, but we work to protect your information and to promptly address issues.

10. International data transfers

Bib is operated using infrastructure that may be located in the United States and other countries. If you access Bib from outside those regions, your information may be transferred to, stored in, and processed in a country with different data-protection laws than yours. Where required, we use appropriate safeguards (such as standard contractual clauses) for these transfers.

11. Children's privacy

As stated in Section 1, Bib is not for children under 13, and we do not knowingly collect their information. If we learn we have collected personal information from a child under 13, we will delete it.

12. Analytics and crash reporting

We use PostHog and Sentry to understand usage and fix bugs, as described in Section 2(e). This helps us improve reliability and features. Where required by law, we obtain consent for analytics, and you can limit tracking through your device's privacy controls (for example, iOS "Allow Apps to Request to Track" and limiting ad identifiers).

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we'll update the "Last updated" date and, where appropriate, notify you in the app or by email. Your continued use of Bib after an update means you accept the revised policy.

14. Contact us

Questions, requests, or concerns about your privacy? Contact us at:

privacy@racewithbib.com

Bib Innovations LLC, 8 The Green, Suite B, Dover, Delaware 19901

This policy is governed by the laws of Delaware, without regard to conflict-of-laws principles.