Privacy

RunFolio is run by one person, not a company. It has no advertising, no analytics, no tracking pixels and no third-party scripts. Nothing here is sold, shared for marketing, or handed to anyone who is not needed to run the service.

This page describes what the software actually does. Where it says a thing is impossible, that is a property of the database rather than a promise about intentions, and it says so.

What is stored

Your account. An email address and a password, both held by Supabase Auth. The password is hashed there and is never visible to the application. If you sign in with a magic link instead, there is no password at all.

Your profile. Whatever you fill in: display name, username, location, a short biography, a favourite quote, links to Instagram and a website, an avatar and a banner.

Your date of birth, if you give one. It is optional, and it is never shown publicly — see below.

Your races. Event name, location, date, distance, finish time, bib number, a link to a timing certificate, and whatever you write in the notes.

Your photographs. Compressed in your own browser before they are uploaded, then stored as Cloudflare R2 objects. A small blurred thumbnail of each is kept in the database so the page has something to show while the real image loads.

What is public, and what is not

A RunFolio profile is a public web page. That is the product: the whole point is a link you can give to someone. Your name, username, location, biography, links, races, times and photographs are all visible to anyone with the address, and to search engines.

Two things are not:

• Your email address. It never leaves the authentication system.
• Your date of birth. Anonymous visitors read profiles through a database view that does not include the column at all. It is not hidden by a rule that could be misconfigured; it is absent from the only path a visitor can take.

Photographs are served from a public bucket. They are not listed anywhere except on your profile, but the URL of an individual image is not a secret — anyone who has it can open it, whether or not they came through RunFolio. Do not upload a photograph you would mind a stranger seeing.

Strava

Connecting Strava is optional, and RunFolio works fully without it.

If you connect it, RunFolio reads your activity list — each activity’s name, date, distance and time — so you can pick which ones to turn into races. It does not read your followers, your private notes, your heart rate, or anything else, and it never writes anything back to Strava.

The access and refresh tokens are stored in a table with row-level security enabled and no policies at all, and with permissions revoked from both browser-facing database keys. A signed-in runner cannot read their own Strava token through the browser; only server code can touch it. That is deliberate — the browser key is public by nature, so any table it can read is effectively public, and a token behind an ordinary “only the owner” rule would be one scripting bug away from being taken.

Disconnecting Strava from your settings deletes the tokens.

Cookies

Two, and neither is for tracking:

• A session cookie from Supabase Auth, which is what keeps you signed in.
• A theme preference, stored in your own browser so the page does not flash the wrong colours before it loads. It never reaches the server.

Who else processes your data

Three services, each because the application cannot run without it:

Service	What it holds
Supabase	Authentication and the Postgres database
Cloudflare	Serves the site, and stores the photographs
Strava	Only if you connect it, and only what is above

Cloudflare necessarily sees the requests it serves, in the way any host does.

How long it is kept

For as long as your account exists.

A daily job deletes photographs in storage that no longer belong to any race — the leftover of a delete that half-finished. It waits a grace period first, and it refuses to run at all if it looks like the database query failed, because “no races exist” and “the query broke” are indistinguishable from where it stands and one of them would delete everything.

Deleting your account

Settings → Delete account, behind a typed confirmation. It removes the account, the profile, every race, every photograph and any Strava tokens. Deletion cascades in the database rather than running as a cleanup script that can be interrupted halfway.

It cannot be undone, and there is no backup to restore you from.

Changes

If this page changes in a way that matters, the revision date at the top changes with it. There is no mailing list to notify you, because there is no mailing list.

Getting in touch

Questions about this page, or a request about your own data, go to sanket.tambare01@gmail.com.RunFolio is run by one person, so give it a few days.