Privacy Policy

Last updated August 31, 2026

Race Hawks (“Race Hawks,” “we,” “us,” or “our”) operates racehawks.com (the “Service”). We are committed to protecting your privacy through a defense-in-depth security program, privacy-by-design and data-minimization principles, and processing aligned with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA (“CCPA”). This Privacy Policy explains what we collect, how we use it, and who we share it with. By using the Service you agree to this policy. If you do not agree, please stop using the Service.

1. Information we collect

1.1 Account information. When you create an account we collect your name, email address, and a password (stored only as a secure hash). If you sign in with Google, we receive your name, email, and profile image from Google instead of a password.

1.2 Your strategy settings. Goal times and pacing choices you set in the strategy builder are saved in your browser (localStorage) on your own device. They are not sent to or stored on our servers.

1.3 Technical and usage data. Like most sites, our hosting and analytics automatically receive standard technical data such as your IP address, browser and device type, pages viewed, and referring URLs.

1.4 Content you post. If you post comments or tips on a course, like a post, or set a public username and profile picture, we store that content and associate it with your account. Comments, tips, usernames, and profile pictures are public. To keep the community safe, this content may be reviewed by automated tools (including AI-based content moderation) and by us, and content that breaks our Terms may be flagged, hidden, or removed and may lead to account action.

2. How we use your information

We use your information to: create and secure your account; provide the flyovers and the strategy builder; send transactional email such as verification and password-reset messages; send you product emails such as new features, new courses, and race-prep tips (you can unsubscribe from these at any time via the link in the email or by contacting us, and it does not close your account); understand and improve the Service; and comply with legal obligations. When you create an account or sign in, you agree to be added to our email list for the messages described above. We do not sell your personal information.

3. How we share information (service providers)

We share data only with the providers we use to run the Service, and only as needed:

Vercel — hosts the app and provides privacy-friendly, cookie-less page analytics; receives standard request data (IP, headers).
Railway (PostgreSQL) — hosts the database that stores your account data.
Google — used when you choose “Continue with Google”; returns your name, email, and profile image.
Resend — delivers transactional email (verification, password reset); receives your email address and message content.
Cloudflare — serves the flyover videos and images from its global CDN; your browser’s IP is visible to it when streaming.

We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a merger or acquisition (with notice).

4. Cookies

We use a small number of strictly necessary cookies for signing in and keeping you logged in (your Better Auth session cookie). We do not use advertising cookies, tracking pixels, or cross-site trackers. Our page analytics (Vercel) do not use cookies.

5. Data retention

We keep your account information for as long as your account is active. When you delete your account, we delete your account data, except limited records we must keep for legal or security reasons. Comments and tips you posted are kept but anonymized: your name and profile picture are removed and your likes are cleared, so shared course knowledge stays available to the community without being tied to you. Strategy settings saved in your browser stay on your device until you clear them.

6. Security

We operate a defense-in-depth security program layering encryption in transit (TLS 1.2+) and at rest (AES-256), salted and hashed passwords, least-privilege role-based access controls, network isolation, continuous logging and anomaly monitoring, secure software-development-lifecycle practices, and reputable, audited infrastructure providers. Access to production data is restricted on a need-to-know basis and reviewed periodically. While no method of electronic storage or transmission is 100% secure, we work to protect your information and to triage and remediate any incident promptly.

6a. Legal bases & international transfers

Where the GDPR or UK GDPR applies, we process personal data on the legal bases of performance of a contract, our legitimate interests in operating and improving the Service, your consent (where required), and compliance with legal obligations. When personal data is transferred outside your region, we rely on an appropriate safeguard such as the European Commission’s standard contractual clauses (SCCs), the UK International Data Transfer Addendum, or an equivalent lawful mechanism. Our sub-processors are engaged under written data-processing agreements that impose confidentiality, security, and onward-transfer obligations consistent with this policy.

7. Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, contact us and we will delete it.

8. Your rights and choices

Depending on where you live (including under GDPR and California’s CCPA), you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You can update or delete your account from your settings at any time. To make a request, email us at the address below; we will verify your identity and respond within the time the law requires. We will not discriminate against you for exercising these rights.

9. International users

Race Hawks is operated from the United States, and our providers may process and store data in the U.S. and other countries. If you use the Service from outside the U.S., you consent to that transfer as described here.

10. Do Not Track

Some browsers send a “Do Not Track” signal. There is no common industry standard for how to respond to it, so the Service does not currently change its behavior when it receives one. As noted above, we already don’t use advertising cookies or cross-site trackers.

11. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the rights described in Section 8 above, plus the right to know the categories of personal information we’ve collected about you and the right to non-discrimination for exercising your rights. We do not sell or share your personal information for cross-context behavioral advertising, and have not done so in the past 12 months, so there is no “Do Not Sell” opt-out to provide. To exercise any California privacy right, email us at the address in Section 13; we may need to verify your identity before fulfilling the request.

12. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and for material changes we will provide reasonable notice. Continued use after changes take effect means you accept the updated policy.

13. Contact

Questions or privacy requests? Email info@racehawks.com.