Last updated 27 October 2026
The short version
SendOff stores what you type into it: your email address, your race, and what your crew logs. There is no analytics, no advertising, no third-party trackers, no cookies, and nothing is sold to anybody.
There is one thing worth knowing before you put a race in, and it is under the repository is public.
What is collected
Your account
Your email address, and your password stored only as a salted hash. The password itself is never stored and cannot be recovered, only reset. Also your role and your plan.
If you sign in with Google
Google tells SendOff your email address and that Google has verified it, and SendOff keeps Google's identifier for your Google account, linked to your SendOff account, so that only that Google account can sign in as you. Nothing else is asked for or kept: not your contacts, your calendar or anything in your Google account. Google knows that you signed in to SendOff, under Google's own privacy policy. Signing in with Google does not create an account; you still need one first.
If you sign in with Facebook
Facebook tells SendOff your email address and an identifier Facebook makes for your account on SendOff alone, and SendOff keeps that identifier, linked to your SendOff account, so that only that Facebook account can sign in as you. SendOff asks for nothing else: not your friends, your posts, your photos or your name. Facebook knows that you signed in to SendOff, under Meta's own privacy policy. If you choose not to share your email address with SendOff, there is no way to tell which account is yours, so the sign-in is refused and nothing is kept. Signing in with Facebook does not create an account; you still need one first. To remove the link, disconnect Facebook from Account in the menu, or see deleting your data.
Your profile, if you fill one in
A display name, fueling goals, hour bands, and the notes you want a crew to have.
Your username, if you pick one
A username, like @jason, is optional and is never used to sign in. While "Let people find me by username" is on, which it is unless you turn it off, anyone signed in to SendOff can find you by it. What they see is your username and the name on your profile, never your email address, your races or your results. They can also add you to a race they run by your username. Once you are on a race, the people who run it can see your email address, as they can for everyone on it. Turn finding off and nobody can find you or add you by username; you keep the name. SendOff's admins see your username beside your account in their list of accounts, with finding on or off.
You can change your username once every 30 days. A username you give up, or one belonging to an account that is deleted, is kept back from everyone else for 30 days, so nobody can take it straight away and be mistaken for you.
Your results, if you write them down
What you add on your profile page about races you ran: an official finish time, your place, a link to the official results, a race report, what you would change next time, and where you stopped if you did not finish. Also races from before SendOff that you enter by hand: their name, date, distance, climb, discipline and place. And the races you told it are not yours, so it stops offering them. Only you can see any of it unless you make your profile public.
Your public profile, if you switch it on
It is off unless you switch it on, on your profile page, and you need a username for it: the address is sendoff.run/@ and your username. While it is on, anyone with the address can see, without signing in:
- your name and username;
- your listed public races and the races you entered by hand, with dates, distances, climb, finish times or how far you got, places and official results links;
- the totals and personal bests worked out from those races alone.
It never shows a private or unlisted race, not even in its totals, never your email address, and never the notes, issues, medications or gear written on a leg. Your race report and "what I'd change" appear only on races where you switch them on, and so do your calories, fluid and sodium, race by race. You can hide any race from it. It is kept out of search engines unless you tick "Let search engines show my profile". Switch it off and the address stops working straight away; an address with no public profile behind it says the same thing whether or not the username exists.
A race
Its name, location, start time, activity, course (segments, aid stations, and the elevation from any GPX file you upload, one for the race or, for a race of several loops, one for each loop), cutoffs, and the racers' names and bib numbers, and a racer's goal where one is set (a finish time, or in a timed race a distance or a number of laps), which the race page shows with how they are doing against it.
A race's name is checked for foul language when the race is made and when it is renamed. The check is a word list on SendOff's own server; the name is not sent anywhere else for it. A name that trips it is held for review: the race is made and works as normal, and stays off the hub, its share card and the Discord announcements until one of SendOff's admins lets the name through. While it is held, the admins see the name, the words that tripped the check and the email address of the account that made the race, and are emailed the same so that somebody looks.
What the crew logs
Arrival and departure times at each aid station (for one marked as skipped, gone by with no check-in, a time estimated from the course and a note that it was missed), calories, fluid, sodium, whether those were measured or estimated, gear taken or dropped, free text notes, and anything typed into the issues and meds fields. Those last two are worth calling out on their own: a crew uses them for how a racer is doing and what they have taken, so they can hold health information about a named person. They are stored exactly like the rest of the race, which on a public race means publicly. Also which account logged each one.
Photographs the crew add, with the leg they were taken on, any caption and runner tag, and which account added each. The photographs are shown to whoever can see the race; which account added one is kept on SendOff's server and is not shown to anyone viewing the race.
Reactions on race photos
If you react to a photo on a race (a heart, fire and so on), the reaction is kept with your account's email address so that it is yours to take back. Anyone who can see the race sees how many of each reaction a photo has, and you see which are yours; nobody is shown who reacted. Reacting needs an account. A reaction is deleted when you take it back, or with the photo, the race or your account.
Access
Which email addresses may see or edit each race, which account each racer is linked to, and which crew members are assigned to which racers on a race with several. Assignments are kept with the access list, never in the race's public file, and are shown only to the people who work the race.
Feedback you send
What you wrote, and, gathered automatically so a report is useful: the page you were on, the race, the version of the app, whether the device was offline, how many unsent writes were waiting, and your browser's user agent. Your email address if you were signed in, or one you typed if you were not.
If you ask for an invite or a password reset
Your name, your email address, and anything you wrote in the request. An account invite holds your email address and, when whoever sent it added one, your name, so the email can greet you and they can see who it was for. It is deleted when you accept it or when it expires. If it had a name, that name stays with your account as a label only SendOff's admins see, so the list of accounts says who you are. It is not your profile, which only you can change, and it is deleted with your account.
Technical
Your IP address is used to rate limit feedback and invite requests. It is held as a counter against your address for one hour and then it is gone. SendOff keeps no other logs of its own. Cloudflare and GitHub keep theirs.
Where it is stored
| Cloudflare Workers KV | accounts, profiles, usernames, public profile settings, results you enter, access lists, invite and reset tokens, share links, feedback |
| Cloudflare D1 | races and logged splits |
| GitHub | races and logged splits, as files in a repository |
| Your own browser | your session, a copy of the races you have opened so they still work with no signal, and any feedback waiting to send |
Private races, and a public repository
A private race is kept off the hub and out of search engines, and only the people you put on it can open it. That is enforced when the page asks for the race, not by the address being hard to guess: SendOff checks who you are on every read, and answers somebody who is not on the race exactly as it answers a race that does not exist.
Its data is not published anywhere. The race, the splits, the course files and the photographs are kept in Cloudflare's database and storage, the roster of who is on it is kept separately again, and none of it is written to a public host. A private race is never listed on the hub, never given a share page or a preview card, never announced anywhere, and its address carries a random suffix so it cannot be guessed either.
A public race can be unlisted, but it cannot be made private. While a race is public its hub entry, its share page, its preview card and its course files are committed to a public GitHub repository. Those carry the race's name, its location, its date, its distance and the names of its racers, and a course file is the route itself. Taking the race off the hub deletes them from the current files and starts checking who is asking, which is worth doing. What it cannot do is remove them from that repository's history, where they stay. Splits, notes, photographs and the roster of addresses were never in there and are not affected. If a race needs to be private, make it private when you create it.
So SendOff calls that race unlisted rather than private, on its hub card and wherever else it describes it, and keeps calling it that for as long as it exists. The two words mean different things here and the app does not blur them: private is a race that was never on the hub, unlisted is one that was.
Five things that are true anyway, and are worth saying plainly:
- Cloudflare holds it. Nothing here is end-to-end encrypted. Cloudflare stores the data and can read it, and so can anybody who gets into SendOff's account there.
- A view link is a key. Any link you create from Manage access lets whoever holds it watch that race without an account, for as long as it lasts. Revoke it there.
- SendOff's own admin page can list the races any one account is on, by name, username and address, private ones included, so that accounts can be supported and races that were set up and then abandoned can be taken off the hub.
- A site admin can open and change any race, including a private one. This is the plainest thing on this page and it is worth reading twice. It is not a role you grant and it is not one you can take away: somebody running SendOff can read your splits, your roster, your photographs and your course, and can edit them, and you are not told when they do. It exists because the alternative was worse in practice, which is that nobody could be helped with a race they could not reach, including their own. Today that is one person. If you would not hand a race to a stranger who runs a website, do not put it here.
- Public races are public, deliberately. A public race's files are served from a public GitHub repository, which is also what serves the pages people watch. Every change to one is a public commit.
This changed on 23 September 2026, and it is not retroactive. Until 11 September 2026 every race's files were written to that public repository whatever its setting, so a race created before then has its old files in the repository's history, where deleting them does not remove them. Commit messages made before 9 September 2026 carry the email address of whoever made the change, and those are in the history too. Removing both means rewriting that history, which has not been done yet. If you set up a race before September 2026 and its contents matter, treat them as public and make a new race.
SendOff called this setting unlisted from 9 September 2026 until 23 September 2026, because during that time off-the-list was all it really was. It is called private again because the app now keeps that promise for any race you make.
Who else sees something
- Cloudflare
- Hosts the service, stores the data, and routes the email. They can see everything SendOff holds.
- GitHub
- Hosts the repository and serves the public pages.
- Google Fonts
- Serves the typefaces. Loading any SendOff page sends your IP address and browser details to Google.
- Google and Facebook sign-in
- Only when you open the sign-in box, and only for the ones switched on, their sign-in scripts load from Google and from Facebook, which sends them your IP address and browser details. No other page loads them.
- Esri
- Serves the map tiles behind a course map. Opening a race page that draws a map sends your IP address and the map coordinates to Esri, which reveals roughly where the race is.
- Your browser's speech-to-text
- Only if you tap the microphone in the racer screen's write-in box. Your browser turns what you say into words, and it may send the recording to whoever makes it to do that: Google for Chrome, Apple for Safari. SendOff never receives the recording, only the words you then log, the same as if you had typed them.
- Your browser's push service
- Only if you turn on the send-off reminder on the racer screen. Your browser gives SendOff an address at its maker's push service (Google for Chrome, Apple for Safari, Mozilla for Firefox), and SendOff knocks on it when a reminder is due. The knock carries nothing: no name, no race, no words. Your phone then asks SendOff what to say. The push service learns only that your device was sent something, and when.
- An AI you connect as crew
- Only if somebody who runs the race connects one, and only that race and that racer. See an AI as crew.
That is the whole list. No analytics, no advertising networks, no social pixels, no session recording.
An AI as crew
Whoever can hand out access to a race can connect an AI assistant to it, such as Claude, as crew for one racer. It is made from Manage access on the race's settings page, and that is where this is said first.
What it is sent. Every time the assistant asks, it is given that race's name, location, course, aid station names and notes, start and cutoffs, and that one racer's name, bib, splits, food, drink, one-tap items, notes and goals. Nothing about anybody else on the race, and no email address. It is asked to look at the racer's new notes each time the racer talks to it, but SendOff never sends it anything on its own: it only gets what it asks for.
Who gets it. Whoever runs the assistant: Anthropic for Claude, OpenAI for ChatGPT, and so on. What they keep, for how long, and whether they use it to train their models is set by their terms and your settings with them, not by SendOff. The conversation with the assistant is theirs, not SendOff's, and SendOff never sees it.
What it can change. Food, drink, one-tap items and notes on that racer's legs. Each line it writes says it came from the AI, and its numbers are kept as estimates and shown with a ~ until a person types the real one. It cannot check anybody in or out, or change the course, the roster or who can see the race.
The link. Connecting one makes a link that works for that race and racer only. SendOff keeps it, with who made it, when, and when it expires, until it is removed or expires: a week after the race's cutoff or a month after it was made, whichever is later. Removing it from Manage access stops it at once. Whoever has the link can do what the assistant can, so keep it to yourself.
The send-off reminder
Off unless the racer turns it on, on the racer screen, on their own phone. It asks the phone's permission to show notifications. While it is on, SendOff keeps, in Cloudflare KV, the push address the browser gave it, the race and racer it is for, the address of the account that turned it on, the aid station names, and which stations it has already reminded about. Every five minutes the worker looks at that racer's check-ins in the race data it already holds; if they checked in at a station and have not been sent off well past their usual stop, it sends one reminder for that station. It works from the check-in times alone. It never asks for or uses the phone's location. Turning it off deletes the record at once; otherwise it is deleted four days after it was last renewed, and straight away if the push service says the address is gone.
What is not done
No cookies are set. Your sign-in session lives in your browser's local storage rather than a cookie, which is why there is no cookie banner: there is nothing to consent to. Nothing is sold, rented, or shared for advertising. There is no profiling and no automated decision-making.
Sensitive information
No location is ever taken from your device. SendOff never asks your browser for your position and never reads it. Nothing in the app calls the browser's location interface at all.
The only coordinates in SendOff are in the course files that whoever set the race up chose to upload, and a course file describes a route rather than a person. It is worth understanding what that still implies: a course, a start time and a logged arrival together say roughly where a named racer was, and on a public race that is readable by anybody.
The other sensitive thing SendOff can hold is health information, and only because a crew typed it. The notes, issues and meds fields are free text, and crews use them for how a racer is doing and what they have taken. SendOff does not require any of it, does not ask for it, and cannot tell whether a note is about a shoe or a stomach. It is stored like the rest of the race and it is readable by everyone the race is readable by.
None of it is sold, shared for advertising, or used to build a profile of anybody. If you would rather it were not in a public file, keep it out of the fields, or make the race private, whose data is never written to a public file.
On your device
Signing in stores a session that lasts seven days. Opening a race stores a copy of it so the page still works when the signal goes, which for a crew at an aid station is the point. Feedback written with no signal is held until it can be sent. Signing out deletes all of it, and so does clearing your browser's data for the site. The crew page also remembers which leg you last picked for each racer, so a reload comes back to it; that is only a leg number, it is never sent anywhere, and it goes when you close the tab.
The demo race. The race at sendoff.run/try lives only in your browser's local storage. Nothing you press or type in it is sent to SendOff or anybody else, it needs no account, and it does not touch a sign-in or a race you already have on this device. Reset deletes it, and it starts over by itself after six hours untouched. The course map loads its tiles from Esri, and the page its fonts from Google Fonts, as on any race.
How long things are kept
| Sign-in sessions | 7 days |
| Password reset links | 2 days |
| Account invites | 14 days |
| Share links | 30 days by default |
| Invite and access requests | 90 days |
| Feedback | 180 days |
| Rate limit counters | 1 hour, or a day for adding people by username |
| A username given up | kept back from others for 30 days |
| Reactions on race photos | until taken back, or the photo, race or account is deleted |
| A race name held for review | until it is let through, or the race is renamed or deleted; a name let through is remembered until the race is deleted |
| A send-off reminder | until turned off, or 4 days after the racer screen last renewed it |
| Races and logged data | until deleted |
Your rights: getting a copy, a correction, or a deletion
Write to info@sendoff.run. Your account, your profile, your results, a Google or Facebook sign-in link and your races can be deleted on request. Results you entered can also be cleared or deleted yourself, from your profile page, and a Google or Facebook link disconnected yourself, from Account in the menu. Deleting your data sets out what goes with an account and how to ask.
You can ask to see what is held about you, to get a copy of it in a portable form, to have it corrected, or to have it deleted. Ask at info@sendoff.run from the address on the account, or say which account you mean. Every request is answered within 45 days. If it needs longer you will be told why inside those 45 days, and the extension will not be more than a further 45.
If a request is refused you will be told why, and you can appeal by replying to that answer. An appeal is decided within 60 days. If the appeal is refused as well, you will be told how to complain to the Texas Attorney General.
Anything already published to the public repository is harder, and it is worth being straight about that. Removing it from the current files is done within 30 days of the request. Removing it from the repository's history means rewriting that history, which cannot be done for one person on demand because it rewrites the whole repository. Within the same 45 days you will be told which of the two your request needs and, where it needs the second, the date it is expected by. It will not be left at "eventually".
Children
SendOff is not aimed at children and accounts are not knowingly given to anybody under 13. No age is asked for at sign up, because sign up is invite only and every invite is sent by hand.
A racer in a race can be a child, because a child can run a race and a crew logs for them. What is held then is a name, a bib number and the splits, entered by an adult on the crew rather than by the child, and there is no account for that child.
If you believe a child under 13 has an account, or that something about a child is in a race and should not be, write to info@sendoff.run and it will be removed. A parent or guardian can ask for that without having the account.
Where it is processed, and by whom
SendOff itself is run from the United States, in Texas. Two companies process data on its behalf, and no others:
| Cloudflare, Inc. (US) | runs the worker that answers requests, and holds accounts, profiles, usernames, results you enter, access lists, tokens, share links, AI crew links and feedback. Also serves traffic from whichever of its locations is nearest the person asking, worldwide. |
| GitHub, Inc. (US, a Microsoft company) | holds races and logged splits as files in a public repository, and serves the pages people watch. |
Both are United States companies operating globally, so your data is stored in the United States and may pass through or be cached in other countries as it is served. Nobody else is given it, except an AI that somebody running a race connects as crew, which is their choice and goes to whoever runs that AI: see an AI as crew. There is no advertising network, no analytics provider and no data broker in this list because there are none.
Changes
This will change as SendOff does. The date at the top says when it last did.