Privacy
Policy.

1. Who we are

AthRace ("AthRace", "we", "us") is a fitness platform that turns verified training into ranked competition and a living avatar that reflects how your body is doing. We are based in Dubai, United Arab Emirates, and are launching in Dubai, then the wider GCC.

AthRace is responsible for the personal information described in this policy. You can reach us at privacy@athrace.com.

2. What this policy covers

This policy applies to the athrace.com website and early-access waitlist, the AthRace mobile app, and any wearable or fitness service you choose to connect to AthRace. It does not cover third-party services you use directly, such as your wearable provider's own app, which have their own privacy policies.

3. Information we collect

Waitlist on athrace.com

When you join the early-access waitlist we collect your email address, your city, the sport you choose (if any), your language preference and the time you joined. That is all.

Your AthRace account

• Account details: name, email address, date of birth (to confirm eligibility), country and city, and login credentials.
• Profile and avatar: your display name, sport and goals, and any photo you choose to provide to generate your avatar.
• Training and race data: workouts, race entries, results, and the evidence used to verify them.
• Health readiness answers: responses to the pre-activity readiness questions shown during onboarding.
• Data from connected wearables: only the categories you authorise, described in section 4.
• Support messages: anything you send us when you contact support.

Collected automatically

Basic technical information needed to run and secure the service: device type, operating system, app version, IP address, crash logs and security logs. We do not use advertising trackers.

4. Connected wearables

You can choose to connect a wearable account, such as WHOOP, to AthRace. Connecting is optional and only happens after you sign in with that provider and expressly approve access on its authorisation screen. We only request the data categories needed for AthRace features, and you can see exactly what is requested before you approve.

AthRace is not a medical device. Readiness, recovery and avatar states are for training guidance only and are not medical advice or a diagnosis.

5. How we use information

• To run AthRace: create your account, power your living avatar, readiness and insights, and run challenges and races.
• To verify effort: check that workouts and race results are genuine and keep competition fair, including detecting cheating and fraud.
• To communicate with you: waitlist and launch updates you signed up for, account and security messages, and replies to support requests. You can unsubscribe from non-essential emails at any time.
• To keep the service safe and working: security, troubleshooting, and preventing abuse.
• To improve AthRace: using aggregated or de-identified information that cannot reasonably identify you.
• To meet legal obligations.

We process your information because it is needed to provide the service you asked for, with your consent (for example connecting a wearable or entering a public race, which you can withdraw at any time), for our legitimate interest in keeping AthRace secure and fair, or where the law requires it.

6. Leaderboards and visibility

Your profile and training data are private by default. Nothing is shown to other users unless you choose it. If you enter a ranked race or challenge, your display name (or an anonymised name if you prefer), your rank and your result for that event are shown on its leaderboard. Detailed health data such as HRV, sleep or recovery is never shown publicly. You can change visibility settings or leave a leaderboard at any time.

7. Sharing

We do not sell personal information. We share it only in these cases:

• Service providers who host and operate AthRace for us (for example cloud hosting, databases, email delivery and crash reporting), under contracts that limit their use of the data to providing those services.
• Other users, only for what you choose to make visible (section 6).
• Legal reasons, when required by law, court order or a valid request from authorities, or to protect the safety and rights of users and AthRace.
• Business transfers, if AthRace is involved in a merger or acquisition. Any successor must honour this policy, and we will tell you before your information becomes subject to a different policy.

Wearable data is never shared with third parties except service providers processing it on our behalf as described above.

8. Retention and deletion

• Waitlist: kept until AthRace launches and you create an account, or until you ask us to remove you.
• Account data: kept while your account is active.
• Raw wearable data: deleted within 30 days of disconnecting the wearable or deleting your account.
• Account deletion: you can delete your account in the app or by emailing us. We delete your personal information within 30 days, and it is cleared from backups within 90 days, unless we must keep something to meet a legal obligation.

9. Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of fitness and health data, including encryption in transit and at rest, access limited to staff who need it, and monitoring. No system is perfectly secure, but if a breach affects your information we will notify you and the relevant authorities as required by law.

10. Your rights and choices

Depending on where you live, including under the UAE Personal Data Protection Law and the Saudi Personal Data Protection Law, you can ask us to:

• access the personal information we hold about you and get a copy in a portable format;
• correct inaccurate information;
• delete your information;
• restrict or object to certain processing;
• withdraw consent at any time, for example by disconnecting a wearable or leaving a leaderboard.

Email privacy@athrace.com and we will respond within 30 days. You can also complain to your local data protection authority.

11. Children and teens

AthRace is not intended for children under 13 and we do not knowingly collect their information. Users aged 13 to 17 may only use AthRace where permitted, with verified parental or guardian consent, and with additional protections such as private-by-default profiles. If you believe a child has given us information without consent, contact us and we will delete it.

12. International transfers

Some of our service providers store or process data outside your country. When information is transferred abroad, we use providers with strong security commitments and contractual safeguards so it remains protected to the standard described in this policy.

13. Cookies and local storage

athrace.com does not use advertising or tracking cookies. It stores one small setting in your browser to remember your language choice. The AthRace app uses only the storage needed to keep you signed in and the app working.

14. Changes

We may update this policy as AthRace grows. We will post the new version here with a new effective date, and tell you in the app or by email before material changes take effect.

15. Contact

Questions, requests or concerns about privacy: