Draft. This text is not final yet: it is still being reviewed, and some details may be missing.

Privacy policy

Last updated: 28 October 2026

This policy explains which personal data MyHalfs processes, why we do so, how long we keep it and what your rights are. We collect no more than we need, use no tracking cookies and never sell your data.

Who is responsible

The controller for myhalfs.com and myhalfs.nl is:

Name: [HANDELSNAAM] ([RECHTSVORM])
Address: [ADRES]
Chamber of Commerce (KvK): [KVK-NUMMER]
Email: [CONTACT-EMAIL]
Phone: [TELEFOONNUMMER]

You can reach us at that email address with any privacy question.

In short

Your profile is private by default. You decide what becomes public.
Proof for a stamp is only visible to you and to the MyHalfs moderators and administrators.
We measure visits without cookies and without storing your IP address.
We do not store heart rate or other health data.
You can download your data and delete your account yourself. Only what we must keep for our accounts is kept (without a link to your account).

Waitlist

Purpose: Keeping you informed about MyHalfs, such as the launch and new races, and contacting you if you told us you would like to become a partner.
Data: Your email address, the language of the website, the page where you signed up, the time you signed up and a secret code for the unsubscribe link. Your email address and language are also stored as a contact in the waitlist at our email service (Resend). For every sign-up our team can receive a notification with your email address and language, in a MyHalfs team mailbox (see 'Who we share data with').
Legal basis: Your consent. You can withdraw it at any time using the unsubscribe link in every email.
Retention: Until you unsubscribe. We then delete your sign-up from our database. At our email service (Resend) your address remains marked as ‘unsubscribed’, so that you no longer receive emails from the list. To verify (V6): also delete the contact at Resend?

Account and profile

Purpose: Letting you sign in and giving you an account and profile.
Data: Your email address, an account ID, when you created your account and last signed in, your role (for example moderator or administrator, if we give you one), and what you fill in on your profile: your username (by default a random name, such as runner-a1b2c3d4), your display name if you set one, what you write about yourself, your country, your profile photo and whether your profile is public.
Legal basis: Performance of the contract: you use your account.
Retention: As long as your account exists. If you delete your account, we delete your profile and your profile photo.

Signing in works with a link we send to your email address (magic link). You have no password. Our sign-in service (Supabase) records technical data such as your IP address to prevent abuse. When you request a sign-in link, you also pass a short security check by Cloudflare (see ‘Security, abuse and logs’).

Profile photos are converted on our server into a new file, without the hidden metadata from your camera or phone (such as the location where the photo was taken). Your profile photo has a fixed link: anyone who has that link can see the photo, even if your profile is private.

Private unless you choose otherwise. By default your profile is only visible to you. If you make your profile public, anyone can see your display name, country and bio. Your username and profile photo are also shown next to posts you write in the forum. A public profile also makes your passport public: anyone can then view the half marathons that a moderator approved (city and year), the totals and your completed challenges, and your finish times only if you turn that on as well. Passport numbers are not secret, so your passport can also be found without a link. We ask search engines not to index it. You can turn this off again at any time. Your email address, orders, bib numbers and proof are never public.

Passport, stamps and proof

Purpose: Recording the half marathons you have run as stamps in your passport, calculating your progress on challenges, and checking that a stamp is correct.
Data: Per stamp: the race and edition, your finish time, your bib number, the proof you upload, the review status, and once reviewed: who reviewed it, when, and any explanation. In addition, your passport number and your completed challenges.
Legal basis: Performance of the contract: you use the passport.
Retention: Stamps as long as your account exists, or until you delete a stamp yourself. We only keep proof as long as needed for the review: To verify (V6): period; proposal: 30 days after the review, after which only the outcome remains.

Who sees your proof? Proof is kept in restricted storage. Only you and the MyHalfs moderators and administrators can view it. It is never public, not even if your passport is public. Moderators review it themselves; there is no automated decision.

Only upload what is needed: for example a screenshot of your result or your finisher certificate. If it shows other people or health data (such as your heart rate), make that unrecognisable first. A photo can also contain hidden data, such as the place where it was taken. We convert photos into a new file without that data; a PDF is stored unchanged.

Race suggestions

Purpose: Reviewing a race you suggest and, if approved, adding it to the race calendar. Contacting you if we have a question about your suggestion.
Data: The race details you enter (such as name, place, date and website), your account ID and the time of your suggestion.
Legal basis: Performance of the contract: you use a feature of your account.
Retention: The race details themselves are not personal data and remain in the race calendar. We keep the link to your account until your suggestion has been handled. To verify (V6): period; proposal: delete when handled, at the latest after 3 months If you delete your account, we delete your suggestions that have not (yet) been accepted. For accepted suggestions, we remove the link to your account and your notes.

Orders and payment

Purpose: Carrying out your order: making and delivering your poster, emailing you about your order, asking for your finish time after the race, refunds and handling complaints. In addition, our accounts.
Data: Your email address, the name on the poster, your finish time (or that you did not start or did not finish), the race, the design and colour, the order number, the amount and VAT, the status of your payment, the time you consented to immediate delivery, and if you are signed in: the link to your account.
Legal basis: Performance of the contract with you. For our accounts: our statutory retention obligation.
Retention: Data that belongs in our accounts (such as order number, date, amount, VAT and payment) is kept for 7 years, because of the Dutch tax retention obligation (article 52 of the General Tax Act). The details on the poster (name and finish time) and the poster files are kept as long as you can request new download links: To verify (V6): period; proposal: 12 months after delivery. If you delete your account, your paid orders are kept for our accounts, but without a link to your account: we replace your email address on them with an anonymous code. Unpaid or cancelled orders, and designs that are not part of a paid order, are deleted with your account. If you have an order we still need to deliver, or a payment that is still open, you can delete your account once it has been delivered, or 24 hours after an unfinished payment.

Ordering without an account. If you order as a guest and later sign in with the same email address, we link your earlier orders and designs to your account, so you can see them there. We only do this once your email address has been confirmed through a sign-in link. Legal basis: performance of the contract.

Payment. You pay via Stripe. Stripe processes your payment details (such as your name, email address, card or bank details and country) to carry out the payment. We receive the status of your payment from Stripe, but not your full card or bank details. Stripe is itself responsible for fraud prevention and its legal obligations; Stripe’s privacy policy applies to that. To verify (V8): role of Stripe (processor or independent controller) and the Stripe entity

Checking your finish time. To verify (V13): do we do this? If so: we look up your finish time in the race’s public results, only for you and only with the name you give us, and we do not store data of other runners

Delivery and downloads

Purpose: Delivering your poster as a file and letting you request new download links.
Data: The poster files (PDF and PNG), the temporary download links and a personal code with which you submit your finish time or request new links.
Legal basis: Performance of the contract.
Retention: Download links work for 7 days. We keep the poster files and the personal code as long as you can request new download links (see above, To verify (V6)).

Designs and sharing

Purpose: Keeping your design (the poster with your details) for the preview, the order and the delivery, and sharing it if you want to.
Data: The race, the template and the colour, the name on the poster and your finish time, and a link to your account or, if you order as a guest, a secret code.
Legal basis: Performance of the contract.
Retention: As long as the poster files are kept (see Orders and payment, To verify (V6)).

Sharing. Your design isn’t public unless you choose ‘Create a shareable link’ after your order. It then gets its own page (myhalfs.com/designs/…) with your poster and share images showing your name and finish time. Anyone with the link can see that page, and the image appears when you share the link on social media. Search engines don’t include the page. You can remove the link at any time (with your order, or through the link in the email with your poster); the page and the images then disappear. If your order is refunded, we remove the link ourselves. Images that have already been shared or downloaded can’t be taken back. To verify (V17): is a design public by default? Built as proposed: only after an explicit choice to share

Emails we send

Purpose: Emails that belong to your account or order: your sign-in link, your order confirmation, your poster, the request for your finish time and a reminder, and messages about your stamps and challenges. We only send newsletters to the waitlist, with your consent.
Data: Your email address, your name if you provided it, the content of the email and whether it was delivered.
Legal basis: Performance of the contract. For the waitlist: your consent.
Retention: Our email service (Resend) keeps sent emails and their delivery status for a limited time. To verify (V7): retention of email logs at Resend

Measurement without cookies

Purpose: Understanding how the website is used, for example how many visitors a race page or poster page gets, how many of them start and complete an order, and through which channel (such as a shared link) people arrive.
Data: Per view of a public page (the home page, the race calendar, a race page, a poster page, a public design or a public passport; for the last two only the kind of page, not which design or passport): the day (no time), the page (without the rest of the link), the language, the domain of the referring website (for example instagram.com, not the full link), campaign codes in the link (utm_source, utm_medium, utm_campaign) and whether you came through a shared link (ref, and src: the kind of card). When an order is started or paid: the edition and the same channel, without language or kind of card, and for a only the week (not the day). We use no cookies or other storage on your device and do not store an IP address, device ID, browser data or account ID. We keep the channel of an order only until the payment has arrived (at most 3 days, after which a daily task deletes it). After that the data is pseudonymous: it is not directly linked to your order. To keep out abuse and bots, we count how often a measurement comes from the same IP address (hashed, see Security, abuse and logs) and refuse measurements from browsers that identify as a bot or crawler; we only read your browser’s user agent for this and do not store it. To verify (V7): for an edition with very few orders, tracing back to a single order remains possible in theory
Legal basis: Our legitimate interest in improving the website and what we offer. The data is pseudonymous and not directly linked to you or your order.
Retention: To verify (V6): period; proposal: 25 months, then totals only

Security, abuse and logs

Purpose: Keeping the website secure and available, limiting abuse (such as too many sign-in attempts or sign-ups) and fixing faults.
Data: When you sign in, sign up or order, and for the measurement without cookies, we count how often a request comes from the same IP address or email address. We do not store those addresses in readable form for this, but as a hashed code (HMAC) with a secret key; without that key the code cannot be traced back to the address. In addition, our hosting provider (Cloudflare) and our database and sign-in service (Supabase) process technical data such as your IP address, browser and the page you request. Our own technical logs mask email addresses (for example j***@gmail.com).
Legal basis: Our legitimate interest in a secure and working website.
Retention: A counter applies to a short time window (at most 15 minutes) and is cleaned up on a later request after that window has passed. Logs at Cloudflare and Supabase are deleted automatically after a limited time. To verify (V7): retention of the logs at Cloudflare and Supabase

Security check (Cloudflare Turnstile). When you request a sign-in link or join the waitlist, Cloudflare Turnstile checks that a human is using the form, usually without you having to do anything. For this, your browser loads a script and a frame from Cloudflare (challenges.cloudflare.com), only on the sign-in page and once you use the waitlist form. Cloudflare processes technical data about your browser and connection, such as your IP address and your browser. Your email address is not sent to Cloudflare. Cloudflare returns a one-time code, which we (for the waitlist) or our sign-in service Supabase (for signing in) check with Cloudflare; we do not send your IP address along. Legal basis: our legitimate interest in preventing abuse of the forms, such as spam and flooding someone’s inbox with sign-in links. Cloudflare also uses this data to improve its own bot detection; Cloudflare is itself responsible for that. To verify (V7): role of Cloudflare (processor, and an independent controller for improving Turnstile), DPA, safeguard and retention at Cloudflare

We further protect your data with appropriate measures: the website only works over an encrypted connection (HTTPS), the database only gives each user access to their own data, proof and poster files are kept in restricted storage, and only those who need it for their work can access the data.

Contact and reports

Purpose: Answering your question, complaint or request, and handling reports of inappropriate or illegal content.
Data: Your email address, your name if you mention it, the content of your message and what we did with it.
Legal basis: Our legitimate interest in being able to answer questions, or performance of your order if your question is about it. For reports of illegal content: our legal obligation (Digital Services Act).
Retention: As long as needed to handle your question or report, or as long as it belongs to an order in our accounts. To verify (V6): period; proposal: 2 years after handling

Who we share data with

We do not sell your data. We do use a few service providers that process data on our behalf (processors). We have agreements with them on security and confidentiality in a data processing agreement. To verify (V7): data processing agreement accepted for each service

Supabase: Database, sign-in and file storage (profile photos, proof, poster files). The data is stored in a data centre in the EU. Supabase and some of its sub-processors are established outside the European Economic Area (EEA), including in the United States. To verify (V7): confirm the project region (EU, e.g. Frankfurt) and the Supabase entity
Resend: Sending email (sign-in links, order emails, the waitlist). Resend (Plus Five Five, Inc.), United States. To verify (V7): in which region Resend processes and stores our email
Cloudflare: Website hosting (Cloudflare Workers, with storage for the page cache) and the security check (Turnstile) when signing in and joining the waitlist. Cloudflare, Inc., United States. Cloudflare processes requests on servers worldwide, including outside the EEA. To verify (V7)
Stripe: Payments. Stripe Payments Europe, Limited, Ireland. Stripe may also process data at Stripe, Inc. in the United States. To verify (V8)
Email for contact: Our mailbox for questions, reports and the team notifications for new waitlist sign-ups. To verify (V7): which mailbox(es) receive notifications, with which provider, where, and any transfer
Accounting: To verify (V7): do we use accounting software or an accountant? If so, list it here

Data outside the EEA

If data goes to a country outside the EEA, this only happens with a legal safeguard: an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for companies that participate in it) or the European Commission’s standard contractual clauses. You can ask us for a copy of the safeguard. To verify (V7): which safeguard applies per service (Data Privacy Framework or standard contractual clauses)

Beyond that, we only disclose data if the law requires us to, for example to the Dutch Tax Administration.

Cookies

We do not use cookies for statistics, advertising or tracking, and there are no third-party tracking scripts on the website. We only use functional cookies that are needed for the website to work. They do not require consent, which is why you do not see a cookie banner. On the sign-in page and with the waitlist form we do load Cloudflare’s security check (Turnstile, see ‘Security, abuse and logs’); it is there to prevent abuse, not for tracking. To verify (V7): does Turnstile set cookies or store anything in the browser? If so, list it here

sb-…-auth-token: Keeps you signed in. Only when you sign in. May be split across several cookies (with .0, .1 after the name). Retention: until you sign out, at most 400 days.
sb-…-code-verifier: Part of the sign-in technology of our sign-in service (Supabase). Set when you request a sign-in link and only contains a random code; there may be several. Your sign-in link also works without this cookie, in any browser. Retention: until you sign out, at most 400 days.
NEXT_LOCALE: Remembers the language in which you view the website, only if it differs from your browser’s language. Retention: until you close your browser.
mh_thanks: Set when you check out, so that only you (in this browser) can create a shareable link to your poster on the thank-you page. Contains a code that belongs to your order, no personal data. Retention: 24 hours.

When you check out, you go to Stripe’s payment page (checkout.stripe.com). Stripe sets its own cookies there, among other things to prevent fraud; Stripe’s cookie policy applies to those.

If we ever start using other cookies, we will update this policy first.

No health data

We do not ask for heart rate or other health data and do not store it. We do not import files from sports watches or apps. We do not regard your finish time as health data. If your proof does contain health information, such as your heart rate, make it unreadable before you upload it.

Your rights

You have the right to:

access your data and receive it in a common format. With an account, you download it yourself in your account settings;
have incorrect data corrected. You edit your profile and stamps yourself;
have your data deleted. You delete your account yourself in your account settings: your profile, passport, stamps and proof are then removed. Orders are kept for our accounts, without a link to your account and without your email address;
have the processing restricted;
object to processing based on our legitimate interest;
withdraw your consent, without affecting what we did before you withdrew it.

If you cannot do something yourself, or you do not have an account, email us at [CONTACT-EMAIL]. We respond within one month. Sometimes we first ask you to confirm that the request really comes from you. Data we are required by law to keep, such as our accounts, is only deleted after the retention period has ended.

We do not make decisions about you based solely on automated processing.

Filing a complaint

If you are not happy with how we handle your data, please let us know first. You also always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or with the data protection authority in the EU country where you live.

Changes

If we start using data in a new way or engage a new service provider, we update this policy first and publish the new version on this page, with the date at the top. For important changes we let you know by email if you have an account.