Политика за приватност

Last updated: 12 October 2026 · This text is in English; the English version applies.

In short

• We store only what is needed to time races and show results.
• Results pages are public – that is the point of them. Race directors decide what goes on them.
• No ads, no tracking, no selling of data. Ever.
• You can ask us at any time what we store about you, and have it corrected or deleted.

1. Who is responsible

Backyard Timing is run by Dejan Krle, Vangel Dinu str. 6B, 1000 Skopje, North Macedonia.
Email: morigatto@gmail.com

For the accounts of race directors we are the "controller" (we decide why and how the data is used). For the runner data a race director enters (names, bib numbers, lap times…) the race director is the controller and we process that data on their behalf, only to provide the service. Runners with questions about their data in a race should contact the race organiser first; we will help.

2. What we store

Race director accounts: name, email address, password (only as a one-way scrambled "hash" – nobody can read it), chosen language, date of sign-up and last login.

Races: race name, date, place settings, logos you upload, and the timer PIN.

Runners (entered or uploaded by the race director): first and last name, bib number, and – only if the director provides them – sex, country, predicted number of laps, date of birth and email address. During the race: lap times, check-in and DNF ("did not finish") status.

Online registration (only if a race director switches it on): runners who sign up with the form enter their own name, email address and – if the director asks for them – category, country, date of birth, lap goal and answers to up to two questions of the director. They are added to that race's runner list for the race director, together with the time of sign-up and whether the entry fee was marked paid. We send the runner the confirmation and any emails the director triggers (waitlist, payment reminder). Entry fees are paid directly to the race director – we never receive or see them. To block automated spam, the internet address of each sign-up is kept for at most 24 hours.

Payments: paid plans are sold by our reseller Lemon Squeezy (see section 5). We receive the order details (name, email, product, date, amount, country) but never your card or bank details.

Security data: the internet (IP) address of failed login and PIN attempts, kept for at most 24 hours to block password guessing. The web server also keeps short technical logs (IP address, page, time) for security and error fixing.

3. What is public

Each race has a public results page showing the runners who checked in: name, bib number, country flag, laps, lap times, distance, predicted laps and status. Race directors can switch a results page to hidden in the race settings. Account data and the runners' date of birth and email address are never public – only the race director sees them.

Race directors are responsible for informing their runners that results are published online, and for having a legal basis to share runner data with us (for example their race entry terms).

4. Why we use the data (legal bases)

• To provide the service you signed up for – accounts, timing, results (contract, GDPR art. 6(1)(b)).
• To keep the service safe – blocking password guessing, fixing errors (legitimate interest, art. 6(1)(f)).
• To keep accounting records of payments as the law requires (legal obligation, art. 6(1)(c)).
• Runner data: on behalf of the race director, who relies on their own legal basis (usually the race entry).

5. Who else handles data

• Hosting: the platform runs on Milan, Europe.
• Lemon Squeezy (Lemon Squeezy LLC, USA) sells the paid plans as "merchant of record": they take the payment, handle VAT and send receipts, under their own privacy policy. Data sent to the USA is protected by the safeguards Lemon Squeezy provides for such transfers.
• Email: when we send emails (e.g. to confirm your email address or reset a password), an email delivery service sends them for us.
• Maps: the course map in TV mode loads map pictures from OpenStreetMap, OpenTopoMap or the Humanitarian OSM team, depending on the background chosen. Like any website, their servers see the viewer's internet address. No map is loaded when the map is not opened.
• Password check: when you choose a password, we check whether it appeared in a known data leak using the "Pwned Passwords" service by Have I Been Pwned. Only the first 5 characters of a one-way code (hash) of the password are sent – never the password itself, and nothing that identifies you.

We do not use advertising, social media trackers or analytics services, and we never sell or rent data.

6. Cookies and storage on your device

We use one cookie, only when you log in: it keeps you logged in and protects forms. It is necessary for the service, so no cookie banner is needed. The timer app stores the race PIN, the runners list and the laps you tap on the phone itself, so it works without signal. You can delete this with your browser settings or "Sign out" in the app.

7. How long we keep data

• Accounts: until you delete your account (or ask us to). Accounts whose email was never confirmed: 7 days.
• Races, runners and laps: until the race director deletes the race. Results of past editions stay online on purpose, as an archive, until deleted.
• Failed login attempts and sign-up attempts: 24 hours. Server logs: a few weeks.
• Payment records: as long as accounting law requires.

8. Your rights

You can ask us to show you the data we have about you, correct it, delete it, limit its use, object to its use, or give it to you in a portable file. Write to morigatto@gmail.com – we answer within one month.

You can also complain to a data protection authority: in North Macedonia the Agency for Personal Data Protection (Агенција за заштита на личните податоци), or the authority in your own country.

9. Children

Race director accounts are for adults (18+). If a race director enters data of runners under 18, the race director is responsible for having the permission of their parents or guardians.

10. Changes

If we change this policy, we update the date at the top. Important changes are announced to race directors by email or on their dashboard.