Timeathon Privacy

For the Timeathon race-timing web app (timeathon.com) and the Timeathon Garmin watch app. Last updated October 12, 2026. Timeathon is run by BobbMann Productions LLC.

Your account

When you create an account we keep your name, email address, date of birth, gender and the role you pick (host, athlete or spectator). Your password is handled by Google Firebase Authentication; Timeathon never sees it. Your date of birth is used to put you in the right age group.

Races you join

• The roster. Your name, bib number, gender, age group and date of birth are part of the race roster. The race host sees it, and so does anyone signed in who enters that race's code.
• Times and results. Your leg times, finish time and place appear in that race's live results, results pages and certificates, as with any timed race.
• Claiming your name. When you tap "This is me", your account is linked to that name in the host's athlete list, so future races by that host link to you automatically.
• Email. If you leave "Email me the watch link and my results" ticked when you sign up for a race, the race host can see your email address so they can send you the watch link and your results. Other athletes and spectators can't.

Location

During a race or a live bike ride, your phone can send its GPS position, speed and distance to the race so the host and spectators can follow you on the map and the bike leg can be measured. It sends only while you're in that race or ride and stops when you stop tracking, leave, or the race ends. Your browser asks your permission first, and you can say no.

Bluetooth devices

If you connect a heart-rate strap, bike trainer or spin bike, readings such as heart rate, cadence, power and distance are sent to the race you're in. Nothing is read until you choose a device.

What the watch app sends

Only after you pair the watch with a race using its 6-digit code, and only until you choose End tracking:

• your watch's GPS position, accuracy, heart rate and distance on the current leg, about every 3 seconds;
• each LAP press (which leg it ended, and when);
• the pairing code, so the race knows which athlete the watch belongs to.

The watch reads back your race's start time and leg times so it can show the race clock. Nothing is sent before you pair. If you choose to record the activity, it is saved on your watch and syncs to Garmin Connect under Garmin's own privacy terms.

Race photos

Race hosts can upload photos to a race album. People connected to that race (athletes, parents who linked themselves to their kids, and spectators who watched it while signed in) can open the album from the race. Anyone else needs the album's photo code. Ask the host if you'd like a photo removed.

Parents and the kids they follow

A spectator can mark which athletes in a race are their kids. We save those names with the spectator's account so the app can star them, open lap counting for them, and recognise them in later races. Other people can't see who you marked.

Children

Youth races are usually entered by the race host or a parent. Accounts for children under 13 should be created and managed by a parent or guardian, who can ask for the child's data to be removed at any time.

Where it is kept

Data is stored in Google Firebase (database, sign-in and photo storage). Watch pairing codes expire after six hours. Race data belongs to the race and is kept until the race host deletes it. The app also saves some settings on your device, such as the last race you opened.

Site analytics

We use Google Analytics to count visits and see which screens people use, so we can improve the app. It records things like pages viewed, device type and approximate region, not your name, email or race times. You can block it with your browser's privacy settings or an ad blocker.

How we protect it

• Everything travels over an encrypted (HTTPS) connection, and data is encrypted where Google stores it.
• Database rules decide who can see and change what: only a race's host can run it, people can only edit their own account, and lap counts and watch data are accepted only while a race is live.
• Google's App Check and reCAPTCHA confirm requests come from the real Timeathon app, to block bots and scripts.
• The database is backed up daily so results can be restored after a mistake.

What we don't do

Timeathon doesn't sell your data, doesn't share it with advertisers, doesn't show ads, and doesn't track you outside the races and rides you join.

Your choices: copy, delete, questions

Download your data: in the app, open your profile and tap Download my data for a copy of everything saved with your account.

Delete your account: in your profile, tap Delete my account. This removes your profile, saved races, results, athlete lists, the kids you marked and your race sign-ups. Results in races you took part in stay with that race for the other athletes and families, unless you ask the host or us to remove them.

Can't sign in, or want something removed by hand? Email support@timeathon.com from the address on your account and we'll handle it within 30 days. Parents can ask the same for a child's data at any time.