AnyRun (the Platform) is an Australian platform for creating and running running and endurance events: registration, volunteers, payments, sponsors, and results and photos that arrive in each athlete's account. The Platform is operated by AnyRun ("we", "us"). AnyRun is a registered Australian business name, based in South Australia. Our postal address for privacy and legal correspondence is PO Box 717, Happy Valley SA 5159. This policy explains how we handle personal information: what we collect, why, how we protect it, who can see it, and what you can do about it.

We handle personal information under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For visitors from the EU or the UK we align our practices with the GDPR and UK GDPR (legal bases for each use, responses within one month) and are transparent in this policy about where data is processed.

Two parties handle your information, with different jobs. When you enter an event, the organiser decides what it collects and how that information is used: they are the data controller for their participants and volunteers. AnyRun processes that information on the organiser's behalf, and is itself the controller for running and securing the Platform (your account, your passport, the results and photo layer).

Why this matters to you: an organiser can only ever see people connected to their own events, through a registration, a volunteer shift or a club membership. That boundary is enforced by the database itself (row-level security), one layer beneath the application. Questions about a specific event's use of your details go to its organiser; questions about the Platform come to us.

Depending on how you use AnyRun, we collect:

• Account details: name and email. Your password is handled by our authentication provider and stored only as a hash; nobody at AnyRun can read it.
• Entry details: the event and distance you enter, gender and date of birth where age categories need them, bib number, your waiver acceptance, and your answers to the organiser's questions.
• Emergency contact details: emergency contact name and phone, collected so someone can be reached if something happens to you on course. This is sensitive information and gets the strongest protection we have (see "How we protect it"). We do not collect health or medical information: there is no medical-conditions field, no medications field, nothing of the kind.
• Volunteer and compliance details: shifts, roles, hours, and, where a role requires it, Working With Children check references.
• Payment records: the order, the amount and the fee. Card details are entered with and processed by the payment provider; they do not touch AnyRun servers.
• Delivery details: when you buy something an organiser posts to you, the postal address that order is going to. Ticking "save to my passport" at checkout also keeps one address on your account so you type it once; it is encrypted like your phone number and emergency contacts, and clearing the fields in your account settings removes it.
• Media: event photos uploaded by organisers and photographers, and the matches between those photos and bib numbers.
• Sponsor details: business contact details, ABN, and placement purchases, for sponsor accounts.
• Product feedback: when you send feedback from the in-product tool we record your note, the page path and viewport size it came from, and your account identity. We use it only to fix and improve the product. It is not used for marketing.

What we deliberately don't collect: no device fingerprints and no facial biometrics, and no analytics or advertising cookie exists on this site unless you accept the consent banner first (see the next section and the Cookie Policy).

Most information comes directly from you: creating an account, entering an event, signing up for a shift. Organisers may also add you to their event, for example by importing a past entrant list they hold; they are responsible for having the right to do that.

Organiser page statistics work without cookies or identifiers. To count visitors we compute a daily-salted hash on our servers with the current date baked into the hash itself. The same visitor produces a different, unlinkable value every day, so the number can't follow anyone across days. Your raw IP address and browser signature are not stored for analytics. The counter tallies visits. It does not follow people.

The same counter records which site sent you. When you arrive on an event or entry page we keep the name of the site you came from, such as “www.google.com”, so the organiser can see where their entries come from. The page you were reading on that site, the address you arrived at and anything that would join that site to you are not stored. The daily hash above stops one person being counted twice, and it is stored apart from the count, without the site name. A link an organiser tagged also carries their own campaign words, which they wrote. Arriving with no referring site is counted as its own answer, and is what a typed address or a saved link looks like.

Separately, and only with your consent, we use Google Analytics, Google Ads conversion measurement and Microsoft Clarity to understand how AnyRun itself is used and to measure our own advertising. These tools stay switched off until you accept the consent banner. What they see is page paths and device-level telemetry; your entries and your personal records stay outside them. Clarity runs on public pages only, so it is absent from your account and from an organiser console. Google and Microsoft process this telemetry partly in the United States as sub-processors. Details and the change-your-choice control live in the Cookie Policy.

With that same consent, Google Analytics uses Google signals. If you are signed in to a Google account with ads personalisation switched on, Google can join your visits to AnyRun across your devices and report to us, in aggregate, the age bands, genders and interest categories of our visitors as a group. These reports do not name you. Google withholds any figure that could point to a person. You switch it off for yourself either in your Google account's ads settings or by choosing "necessary only" on our banner. We use these reports to understand who runs with us and where to tell people about AnyRun.

Official results come from timing. Chip timing is the sole source of truth for results. Published results show a finisher's name, time and place: the same information every printed results board shows.

Photos find you by your bib number. Bib matching reads the printed number on your race bib (optical character recognition) and cross-checks it against chip times, with a human reviewing uncertain matches. Reading a printed number is not biometric processing; what it identifies is the bib you are wearing.

Face matching is switched off across the entire platform, by design. We do not build a facial-recognition index of participants or bystanders.

Write to takedown@anyrun.net. Tell us which event, and point at the photo if you can. You do not need an account and you do not need to have been in the race. Anyone who appears in a photo can ask, and so can a parent or guardian on a child’s behalf.

What happens then:

1. We confirm we have it, straight away. The reply is automatic, so it does not wait for anyone to be at a desk.
2. Within two business days the photo comes out of public view. It leaves the public gallery and any match to a participant is removed. We do that before we decide anything.
3. Within ten business days we tell you the outcome and the reason for it. If the photo stays down, it stays down.

If you have an account and the photo is matched to you, you do not need any of this. Mark it “not mine” in your account and the match goes on the spot, with no form and no waiting.

If you are unhappy with what we decide, the complaints route below is open to you, and it ends at the Office of the Australian Information Commissioner.

We use personal information to:

• run your event experience: registration, payment, your entry, results and photos (performance of a contract);
• keep you safe on course: emergency contact details, used only if they're needed (consent, and protecting vital interests);
• process payments and prevent fraud (contract and legitimate interests);
• send service messages about your entry or shift, and marketing only if you opted in (consent for marketing, contract for service messages);
• meet legal obligations such as tax and record-keeping (legal obligation);
• secure and improve the Platform (legitimate interests, balanced against your rights).

Where a use rests on consent you can withdraw it at any time, and where it rests on legitimate interests you can object, both from your account settings or by contacting us.

What arrives, and where. Service messages about your own entries and shifts reach you by email and in your account. If you hold a role in an organisation, the Platform also writes notices into that organisation's console: one running daily summary per event of the entries that came in (updated in place as the day goes on, so a single entry does not raise its own message) and separate immediate notices for the things a summary would bury, which are a refund, a payment dispute and published results. Those notices go to the people holding owner or admin roles, in their capacity as the organisation's staff, and they carry only the counts and the event, without an entrant's contact details.

Three things are decided by a rule or a model, and a person can change all three.

• Matching a photo to you. A vision model reads the bib numbers printed in a race photo. When it reads a number clearly and that number belongs to exactly one live entry, the photo attaches to that entry on its own. A read the model is unsure of, a bib two entries share, or a photo taken far outside your chip time goes to the organiser's review queue, where a person decides. You can remove any photo from your account at any time, and you can write to us if one you cannot see is attached to you.
• Your start wave. When an organiser fills the waves for a distance, every entry without a wave is placed by the finish time you estimated at entry, fastest first, then by the order the entries arrived, and each wave's capacity is honoured. Nothing about your age is used. You can pick a different wave, or clear the pick, from your race page while your entry is live and the wave has room.
• Ranking bids for a sponsor placement. When an auction closes the bids rank by amount, and the earlier bid takes a tie. Nothing about the bidder goes into the ranking. The organiser sets the placement and its starting price and approves the creative before anything runs.

If one of these decisions affects you and you want a person to look at it, write to support@anyrun.net.

The most sensitive fields are encrypted before they reach the database. Your phone number, date of birth, emergency contacts and Working With Children references are encrypted with AES-256-GCM inside the application itself. The key is kept apart from the database and from the code, so someone who obtained the database alone would hold unreadable ciphertext for those fields.

Around that core: TLS on every connection, encryption at rest, row-level security enforced inside the database, an append-only audit log of sensitive actions, HttpOnly session cookies, and optional two-factor authentication. The full engineering picture is on the Security & data protection page.

The assessment behind this policy is available on request. Our privacy impact assessment sets out every field we hold and whether it is encrypted, where each one goes, and how the thirteen Australian Privacy Principles are met. Write to support@anyrun.net for a copy; the controls it rests on are summarised at /trust.

A password cannot be guessed at indefinitely. Failed sign-ins are counted against the account, and after repeated failures the sign-in stops accepting attempts for a while; continued guessing extends the lock. What we store to do it is one row per failed attempt holding the account and the time. The password that was tried stays out of that row, and so does your IP address. A successful sign-in deletes them. When a lock engages we tell the account holder, with a notice in the account and an email to the address you verified, one per lock, because someone working through your password is something you should hear about from us straight away. A second, longer ceiling sits above the first. The two-factor code check has both ceilings and its own separate count, applied wherever our sign-in screen accepts a code. A code presented straight to our identity provider's own interface falls under that provider's own limits.

Changing the address on your account takes two confirmations. We email the address you have now and the address you are moving to, and the account moves only once you have opened both links. Somebody who reaches your signed-in browser has to open a link we send to the address you already have before the account can move.

Every consent you give or withdraw on AnyRun is stored as its own append-only record with a timestamp and source, so both you and we can prove what was agreed and when. The three purposes we track:

• Bib photo matching: on by default under standard entry terms (it's how your own photos reach your own account), and revocable at any time from your settings. Revoking stops future matching immediately.
• Face-based matching: off by default, and the feature itself is switched off platform-wide. The consent slot exists only so that the off-state is enforceable in code.
• Marketing: strictly opt-in, with nothing pre-ticked, unsubscribe any time. Service messages about your entries and shifts are separate and arrive regardless, because you need them.

We share personal information only where the service needs it:

• The organiser of an event you joined: your entry details, for their event, under the boundary described in "Who is responsible" above.
• Our sub-processors: the companies the Platform runs on: database hosting (Sydney, Australia), our application edge and media storage, payment processing when enabled (Stripe, PayPal), AI vision for bib-number recognition on event photos, and email delivery. The current list of them, by name and by country, is published at sub-processors. Each handles data under contract terms that require them to protect it.
• Authorities: only where the law requires it, or to protect safety.

Photographs and logos on a public event page are served by us. When an organiser gives us the web address of a sponsor logo, we fetch the picture once, keep our own copy and serve that copy. Your browser doesn’t contact the organiser’s host, so that host doesn’t learn your IP address or which race you were looking at.

We do not sell personal information, and no advertiser can target you on the Platform. Your details do not go to data brokers, and sponsors do not receive your data. With your consent we use Google tools to measure and advertise AnyRun itself. Those tools do not let anyone else reach you here.

A wallet pass goes to Google, and only when you tap "Add to Google Wallet". Your race pass and your volunteer crew pass can be saved to Google Wallet. When you tap that control, and at no other time, we hand Google a signed pass for it to display. Nothing is created in the background, and nothing is sent at all for a person who doesn’t tap it.

A pass you saved is kept true afterwards, and that means later messages to Google. If your bib number changes we send Google the corrected pass. If your entry stops being valid (you cancel it, it is refunded, or you transfer it to another runner) we send Google an update that marks the saved pass expired and adds one line saying so, and if the entry is reinstated we send an update that makes it valid again. Those updates carry the fields already listed above and nothing new about you, they happen only for a pass you chose to save, and there are none at all for one you did not. We do it because the alternative is leaving a valid-looking ticket on your phone for an entry that no longer exists.

Exactly what the pass carries. A race pass: your name, your distance and bib number, the event's name, start time and venue, a link to your race page, the invoice number of the order that paid for your entry when it has one, and up to two race-day notes the organiser publishes, such as bag drop and parking. A crew pass: your name, your role, your shift date and window, where to report, the event's name and venue, the coordinator's published contact, a link to your shift page, and up to two briefing notes. On both, the QR code holds a single internal reference number and nothing else: no name, no email. Nothing else travels at all: your email address, your phone number, your date of birth and your emergency contacts stay on AnyRun. Google receives the pass overseas, which is covered in "Where your data lives" below.

Some things are public by design, with your controls. Published results show name, time and place. A start list shows your name only if you opt in (off by default, first name and initial only). Photo galleries show what the organiser features, and you can remove your own matched photos at any time.

The primary database runs in Sydney, Australia (region ap-southeast-2). Event media sits somewhere else. Your race photographs, and the files organisers upload, are held in a separate object store from that database, in our edge provider's Oceania region. A region here is the preference we set when the store is created, and our provider may still place an object elsewhere in the Asia-Pacific region. So please treat a photograph you appear in as personal information that can be stored outside Australia and served worldwide from our edge network. What we do about that: media is reachable only through our own access-checked proxy routes, with no public storage address serving it; the bib-number model that reads those photos runs inside our infrastructure provider's own network; no face recognition is run on them; and we take reasonable steps to hold our infrastructure providers to protections comparable to the APPs. Other sub-processors may likewise process limited information outside Australia in the course of providing their service; those recipients are in the United States and other regions on our providers' global networks, and the payment and email providers when enabled.

Google, when you save a wallet pass. Saving a race pass or a crew pass sends it to Google in the United States and across Google's global network. That is a cross-border disclosure under Australian Privacy Principle 8. Three things shape it. It starts when you tap the control, and nothing crosses a border unless you decide it should; the later corrections and the expiry update described above travel for a pass you already chose to save. The pass carries the fields listed in "Who can see it" above, which is the least that will display one at all, and an update carries no more than the first send did. It is signed, so it cannot be altered between us and Google.

Two notes on this one. Google is not a supplier we can bind to our own contract terms: we issue passes under Google's terms for pass issuers, so the steps genuinely available to us are the three above: your tap, the smallest pass that will display, and a signature. Once the pass is in your Google Wallet it sits in your own account there, held under your agreement with Google. If you would rather nothing went overseas, don't save the pass: the same pass is already in your account here, on your race page and your shift page, and nothing about your entry or your shift depends on keeping a copy on your phone.

You must be at least 16 to hold a AnyRun account. Entries for participants under 18 are made or approved by a parent or guardian. Where an event involves minors (school events especially), we and the organiser collect only what is necessary, handle it with extra care, and apply Working With Children requirements to volunteers in roles that involve minors. If you believe we hold a child's information without proper consent, contact us and we will address it.

A right you can't exercise is a sentence in a policy. These are built into your account:

• Access and portability: a one-click data export in your account settings downloads everything we hold about you as structured data (APP 12; GDPR access and portability).
• Your payment history, without asking for it: every order you have paid, part-refunded or had refunded is listed in your account settings: what it was for, the entry price, the platform fee, any discount, the total, how it was paid, when, and the tax invoice number where the order has one. It is the money record we hold about you, and your account shows it to you directly.
• Correction: edit your details in your account at any time (APP 13).
• Photo removal: removing a matched photo from your account is instant and self-service, with no request queue.
• Consent withdrawal: every consent above is revocable from your settings, effective immediately.
• Where you're signed in: your account settings list every browser and app currently signed in to your account: the browser and system each one reports, when it was last used, and the network address it came from, shortened to the block it sits in. The full address doesn’t reach the card. One control signs them all out.
• Account erasure: lodge a deletion request from your settings. A human operator confirms it before anything is erased, deliberately, because erasure is irreversible and we will not let a hijacked session destroy your race history. Erasure is typically completed within about 7 days.

Your date of birth stops being editable once a waiver is accepted. Your date of birth locks once you accept a waiver, or once a guardian accepts one for you. The waiver records the date as it stood when it was signed, so changing it afterwards would change a signed record. Everything else on your profile stays yours to edit. If the date is wrong, write to support@anyrun.net and we will correct it and log the correction.

For EU/UK visitors, the GDPR rights of erasure, restriction, objection and portability apply, and we respond within one month. Some records survive erasure because the law requires it (financial and tax records, for example), and those are anonymised where we can't delete them, so the transaction survives but you don't stay attached to it.

We keep personal information only while it serves the purposes above or the law requires it. Your account and race history stay while your account is active (that continuity is the product) and go when you ask us to erase them, subject to the lawful-retention exceptions described above.

The horizons below are enforced by a scheduled job. An automated retention sweep runs hourly and deletes what has passed its horizon. This is the actual table it works from:

Three notes on this table. Audit records, event photographs and an address you chose to save have no automatic deletion date. Financial records are kept past seven years, for the reason in that row: the horizon is a floor, and a dispute record is kept beside the payment it argues about. And anything that falls outside this table is deleted or irreversibly anonymised once it is no longer needed for the purposes above.

If a data breach occurs that is likely to cause serious harm, we will notify the affected people and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme, and the relevant EU or UK authority where GDPR applies. Our layered security exists so that no single failure exposes readable personal data. The details are on the security page.

Privacy question or concern? Contact us first at support@anyrun.net and we will work to resolve it. If you're not satisfied with our response, you can complain to the OAIC at oaic.gov.au. We acknowledge privacy complaints within 5 business days and aim to resolve them within 30 days. People in the EU or UK may also complain to their local data-protection authority.

When we make a material change we bump this document's version (shown at the top of this page, currently 2026-11), update its effective date, and, where the change affects how your information is used, tell you before it takes effect. Every document in the pack carries its own version and date, so you can see which one moved and when.

What your acceptance record says. When you accept, we record the version of this document current at that moment: the text you were shown. If this page later shows a newer version than the one on your record, this policy has been revised since you accepted it, and we ask you to accept it again before you carry on.