The Corral
Privacy Policy
This policy explains how we collect, use and share personal information through The Corral’s app and our website, thecorral.app, and the choices you have. It doesn’t cover other companies’ apps or websites, even where we link to them.
The short version: we collect what we need to run a race app with a social side. There are no ads in the app, we don’t give ad platforms information from your account, and we don’t sell your personal information for money. When we advertise The Corral, we may measure which ads work, as your choices allow (see Measuring our ads, and Your privacy choices).
What we collect
Account. You can sign in with Apple, with Google, or with your email address and a one-time code. The Corral doesn’t use passwords. With Sign in with Apple, we receive an identifier for your Apple Account and, if you choose to share them, your name and email address (which can be a private relay address). With Sign in with Google, we receive your Google account’s ID and its verified email address and, in the app, the name on it. When you make an account in the app with Apple or Google, the name they share can become your profile name, after the same check as any name. With email sign-in, we receive the email address you use. We store these identifiers and addresses and use them to sign you in, to find your account however you sign in (signing in with an address we already know opens its account), and to write to you about your account and The Corral, such as sign-in codes, security notices (for example, when a new way to sign in starts opening your account) and important changes to our terms or this policy. You can also sign in, or make an account, on thecorral.app, for example to send and manage your cheers (see Cheering signed in); an account made there works like one made in the app. If you add the email address of an account made on our website to your account in the app, we may combine the two accounts, though we don’t combine an account for someone under 18 into an adult’s. We don’t use your email for marketing.
Your public profile. Your display name and avatar, and your handle (your username) once you confirm it, are visible to other people on The Corral (for accounts under 18, see Age range). We make a handle for every account that doesn’t have one, from your first name, last initial and random numbers, or from “runner” and random numbers for an account under 18 or one without a name we can use. Until you confirm it or choose another in the app, other people on The Corral don’t see it, and it has no page on our website. You can change your handle once every 14 days. Your location (free text you type, so share as much or as little as you like) and bio are shown as your privacy settings allow (Everyone, Mutuals or Just me). Your name (first name and last initial) and, as your settings allow, your next race, how many runners you’ve cheered and your medal case (a medal and a bib for each race you’ve logged, and a cheer medal for each race you’ve cheered at) can also appear on your page on our website (thecorral.app/@yourhandle), which anyone can open; for an account under 18, that page shows only its handle.
New to running. If you tell us when you first open the app whether you’re new to running, we keep your answer, and when you gave it, with your account to tailor the app to you. Other people on The Corral don’t see it.
Your race log. When you’re signed in, the races you log are saved to your account (the race, date, distance, finish time and whether it was a Boston qualifier) so they come back on a new device, and logging a race can post a finish card. A race you add just for yourself stays on your device. Who sees your finish cards follows your Race history setting, which starts at Everyone: anyone on The Corral, including people who don’t follow you. At Everyone, your page on our website, which anyone can open, also shows a medal for each race you’ve logged (the race, year and distance) and, if your Bibs setting is Everyone too, its bib with the date and your finish time, never your bib number.
Race reviews. When you rate a race, we store your scores, optional note, race date, optional finish time and Boston-qualifier flag. If you log a race that isn’t in our catalog, we also store the race name you type and check it against a word list before others can see it. Your scores can count toward the race’s community averages, which don’t show who rated it. Your finish, your overall rating and your note, if you wrote one, appear as a card in the feed and with the race on your profile, as your Race history setting allows. Anthropic’s Claude checks a note before it appears, so a note is posted only if you allowed safety checks (see Service providers); without them, your scores and finish time still save, and a new note isn’t posted.
Registrations and draws. When you mark a race as registered, in the lottery or on the waitlist, or say whether you got in, we store it with your account. Your draw status shows to people who follow you, as your settings allow. Being registered can show on your profile, in the feed and on the race’s page, as your settings allow; at Everyone, that includes people who don’t follow you.
Apple Health (optional). If you connect Apple Health, The Corral reads your running, walking and hiking workouts, including their routes, on your device, as far back as you allow. It uses them to find races you’ve run and fill in their dates and finish times, to show your training and recent runs, to draw a logged race’s route map and splits, and on race day to time your audio cheers. On iPhone, The Corral only reads from Apple Health. If you track a race with the Apple Watch app, the watch saves it to Apple Health as a running workout and uses its distance to play your audio cheers; the watch doesn’t send anything to us, and its finish time reaches your race log only if you save the race on your iPhone. Your workouts and routes stay on your device and aren’t uploaded to our servers, with these exceptions: the race results you confirm (the same finish time you could type in), which follow the race log rules above, and a run you share (below). We don’t use Apple Health data for advertising or marketing, and we don’t sell it.
Shared runs (optional). You can share a logged race’s Apple Health run, if it has a GPS route, on your profile from the race’s page; sharing is off by default. When you share a run, we upload its GPS route, per-mile splits, distance, finish time and the name of the app that recorded it (for example, “Apple Watch”), and show them on your profile. If you turn on automatic sharing in the app’s Privacy settings, races you import from Apple Health soon after running them are shared this way when you save them, and older runs stay private until you share them. Who can see a shared run follows your Race history setting, and it isn’t shown to people you’ve blocked. We hide a short stretch at each end of a shared route from others, but a route can still show places you go, so consider that before you share. You can unshare a run at any time, which hides it from others.
Social activity. Who you follow and who follows you, your friend code, goals you share, races you mark as registered, race-wall posts and replies, cheers (🙌) you give and receive, and reports and blocks you make. Your follower, following and cheer counts each have their own visibility setting.
Goals. The running goals you set (their titles, icons, target times, progress and completion) are stored so your profile can show them, as your Goals setting allows.
Causes & charities (optional). When you dedicate a race to a charity, we store the charity’s name (and its website, if you pick it from our suggestions), the cause you choose and, if you add them, a short note and a fundraiser link. Your profile, the race’s page and a shared space for everyone running that race for the same charity can show what you’re running for, as your Cause flair, Race pages and Upcoming races settings allow, and not to people you’ve blocked. Anthropic’s Claude checks the charity name, note and links before they’re saved, so you can add them only if you allowed safety checks (see Service providers).
Device identifier. A random identifier the app makes for your device (not a hardware or advertising identifier). We use it to tell your device’s requests and reviews apart, for example to avoid duplicate reviews and to link your reviews to your account when you sign in. It changes when a different account signs in on the device and when you delete your account.
Corral Club subscription (optional). Apple handles payment, so we never see your card or other payment details. To show Corral Club’s prices and know whether a membership is active, the app talks to our subscription manager, RevenueCat, whether or not you’re a member. RevenueCat receives your App Store purchase receipts, a random ID (your account ID once you sign in), the identifier Apple gives our apps on your device, your device model, iOS and app versions, language and App Store country, and your network address, but not your name or email. For adults on the US App Store, it also receives Apple’s ad attribution code (see Apple Ads).
Push notifications (optional). If you turn on notifications, we store a push token for your device so Apple’s notification service can deliver alerts, such as new followers, cheers, group activity and race-wall activity. You can choose which ones you get in the app, or turn them off in your device’s settings. We delete the token when you delete your account, and generally when you sign out.
Crash and performance reports. If the app crashes or freezes, iOS prepares a diagnostic report on your device (Apple’s MetricKit), and the app sends it to us, along with a daily summary of performance measurements. These reports contain technical information, such as the app and iOS versions, the device model and region setting, call stacks, and performance measurements (including how long the app ran and used location). They don’t include your name, account, email, device identifier or anything you typed. We use them to find and fix problems, not to identify or track you, and we keep them for a limited time.
Cheer links (optional). If you make a cheer link for a race, anyone who has it can open its web page without an account. The page shows your first name and last initial, the race and its course map and, if you add them, your wave, start time and times projected from your goal pace. We don’t show your location on the page; if you turn on Share my mile, your cheer squad also sees your latest mile (see Live progress), and a tracking link from your race’s own app, if you add one, goes to them too (see Your tracking link). The page uses the colors you picked in the app, which can show that you’re a Corral Club member. Visitors can send you cheers: a short message with a name they type and, if they like, the moment of the race it’s for, or a pin on the course map (see Pins and voices on a cheer link). The page shows how many cheers there are, not other visitors’ names or words. You see the names and words in the app, including in notifications, and our team can see them to run the service and keep it safe. Names and typed words are checked for safety before a cheer is accepted (see Service providers). We count how often your link’s page is opened, and from which country (see Usage counts). You can make more than one link for a race, close or replace a link, turn cheers off for a race, and choose whether your friends (people you follow who follow you back) can cheer from the app. A link stops working shortly after race day (generally at the end of the day after race day, on the race’s local clock), or when you turn it off or replace it; after that, it takes no more cheers and no longer shows your race or its cheers. You can see the cheers you received in the app. We delete the link and what’s on it about 30 days after race day, or when you delete your account, and keep a record of its cheers with your account (see Cheers you’ve received). If your account is under 18, you can make one too, where the law requires once a parent or guardian approves it through Apple (see Parental consent). It starts with new visitors’ pins waiting for your approval, which you can turn off, as anyone can, and it doesn’t show your handle.
Pins and voices on a cheer link. On a cheer page’s course map, a visitor can pin a spot with a name they type, which side of the road they’ll be on and a short note, and can record a short voice message for it. Everyone with the link can see where the pins are; who left them, their notes and their voices are for the runner, and for our team to run the service and keep it safe. Names and notes are screened before they appear, and each recording is turned into text by a service provider and screened the same way (see Service providers); we don’t store the text. A recording that doesn’t pass is held: the runner can see why, listen to it and decide whether it plays. We keep recordings in private storage and share them through links that expire. To prevent abuse, each pin also keeps a one-way code made from the visitor’s network address (not the address itself), which helps us limit bursts and lets the runner block or report that visitor; a visitor reported by several runners can be blocked from every cheer link. Where the cheer page says so before a visitor sends a recording, the runner can download it and keep it, even after our copies and the link are deleted. On race day, the runner can hear short announcer lines about each cheer, such as who it’s from and where they’ll stand, in an announcer voice the runner picks. Where the cheer page says so before a visitor sends their pin, ElevenLabs reads the visitor’s name, side, place and note aloud to make those lines (see Service providers); otherwise the runner’s phone reads them. We keep those lines in the same private storage as the recordings and send them to the runner’s phone. The runner can choose to approve new visitors before their pins show, and can take any pin off; a visitor can take their own pin off from the same browser or, signed in, from any device. If you left a cheer or pin on someone’s cheer link and want it removed, write to support@thecorral.app with the link and the name you used, and we’ll delete what we find. We generally delete our copies of recordings and announcer lines about 7 days after race day (for a Corral Club member’s link, with the link itself), and pins, with the rest of the link, about 30 days after race day, sooner if the link is turned off, or when the runner deletes their account. The runner keeps a record of the cheers they received, and the cheer page lets a visitor choose whether that record keeps their name and words (see Cheers you’ve received).
Cheers you’ve received. As the cheers on your cheer links are deleted (above), we keep a record of them with your account, so you can look back at them in the app by year and race: each cheer’s race and race day, its kind (a voice note, a spot to cheer in person, or a quick cheer) and when it was sent. Where the cheer page gave a visitor a switch to let you keep their name and words and they left it on, the record also keeps the name the cheer was sent under, its note or words, its place on the course or the moment it was for, and how long its recording was; otherwise it keeps none of those. The record doesn’t keep recordings, which are deleted on the schedule above unless you saved them, or the code made from a visitor’s network address. It doesn’t keep the name or words of a visitor signed in to an account under 18, and it leaves out cheers that were taken off, held after screening or still waiting for your OK, and cheers on a test run. The names and words in your record are shown only to you, in the app, and our team can see them to run the service and keep it safe. Others can see how many cheers you’ve received and how many of each kind, not who sent them or for which race: on your profile in the app if your Cheers setting lets them, and on your page on our website if it’s set to Everyone. They can’t for an account under 18 or one that approves its followers. You can delete a cheer from your record, and the record is deleted with your account. A visitor who sent a cheer signed in and deletes it from their own record deletes it from yours too, and if they delete their account, their name and words leave your record while the cheer still counts.
Race-day voices. On race day, the app can play each voice as you reach its spot. It works out where you are on the course from your phone’s location while the race is on, on your phone, and doesn’t send your location to us. If you turn on Share my mile, the app sends how far along the course you are and when, not where (see Live progress). After the race, the app tells us whether each voice played (which shows you reached its spot) or why it didn’t, but not when or where you were, so we can check that voices work. A visitor whose voice played can see that on the cheer page, from the browser they left it in. Voices saved on your phone stay there for a limited time after race day (longer for Corral Club members), or until you remove them or delete the app.
Live progress (optional, off by default). If you turn on Share my mile for a race, then on race day your phone sends us how far along the course you are and when, from shortly before your start until you finish or race day ends. It doesn’t send your GPS location or route, and we keep your latest points rather than a history. Your latest mile and time are shown to your cheer squad: people signed in to The Corral who have a cheer on your race that’s still up, except anyone either of you has blocked. The app may also show them an estimated position on the course map, worked out from your latest mile and pace. It’s an estimate, not your GPS location or route, and it may not match where you are. Unless you turn on approving new cheers, anyone who signs in and cheers joins your squad, including someone who found your link where you posted it; with it on, people join when you approve them. The app shows you who’s in your squad. People who only have your link and haven’t cheered don’t see your progress, or that it’s on. We delete it when you turn it off or turn your race’s cheers off, generally within a few hours after you finish, and no later than about 12 hours after race day. Accounts under 18 can turn it on too; like everyone’s, it starts off.
Your tracking link (optional). If you add a tracking link from your race’s own app (one that shows where you are on the race’s live tracker), we show it to the people who’d see your live progress (above), whether or not Share my mile is on. Others who open your cheer page, or have you on their list or in a group, get the race’s own tracking page instead, where the race has one. We delete it with your cheer link, or when you remove it.
Runners you cheer for. In the app you can keep a list of the runners you cheer for: people on The Corral, and people who aren’t, by the name, race, bib number, goal and start time you type. We keep the list with your account so it’s on every device you sign in on. Your list is private: we don’t show it or send it to the runner, and adding someone doesn’t tell them. For a runner on The Corral, you don’t see their race, wave, start or goal unless you could open their cheer page anyway, or their live progress and own tracking link unless you’re in their cheer squad. On race day the app may estimate where a runner is on the course map from what you can see of them: their start time and goal (or the race’s start and a typical pace), what people in a group you share with them report seeing, and their latest mile if they share it with you. These are estimates, worked out in the app, and may not match where the runner is. We keep the cheer links you added people with, to know what you may see, and don’t show them back. A runner stays on your list until you remove them or delete your account, and someone who deletes their account is removed from others’ lists.
Cheering in a group. You can make or join a group for one race if you’re 18 or over. A group’s owner can invite people with its link, the link’s code, or an invite in the app to people who follow them or who’ve been in a group with them, and an invite in the app has to be accepted before anyone joins. If you send a group’s link or code from the app, you send it yourself, through Messages or another app you choose, and we don’t receive who you send it to. Members see each other’s names, the spots, statuses and sightings members choose to share, the meet-up point and the group’s message board (below). When you mark that you saw a runner, we record which runner, where on the course and when, with your name, and the group sees it. A runner on The Corral whom a group cheers can see that group’s members, their spots and statuses, their sightings of that runner and the meet-up point, until about 3 days after race day. A runner’s wave, start, goal, live progress and tracking link don’t show in a group to members who couldn’t already see them (see Cheer links, Live progress and Your tracking link). Anyone with a group’s link or code can see whose group it is and for which race. We don’t verify who members are: the owner decides whom to invite, and can turn the link off, replace it or remove members, who then can’t rejoin. Blocking works in groups too, and a runner can block a member from their race. What you type that others will see, such as a group’s name, your outfit or the meet-up point, is screened for safety (see Service providers). If you leave a group, your spot, status and sightings go with you, and your messages stay until you or the owner delete them. A group and everything in it, including its board and photos, is generally deleted about 3 days after race day, or sooner if its owner ends it or its last member leaves. If someone in the group is a Corral Club member, we may keep the group and its board while they’re a member and for up to 30 days after, and other members may be able to tell that someone in the group has Corral Club; its spots, statuses, sightings and meet-up point are still deleted about 3 days after race day. When a group’s sightings are deleted, if you sent cheers signed in for that race, we keep where on the course you saw your runners, without when or which runner, with your record of those cheers, so your cheer medal can show them. It stays until you delete that race’s cheers from your record or your account. Accounts under 18 can’t make, join or be invited to a group.
A group’s message board. Members of a group can post messages, links and photos to its board. The board is for the group’s members; our team may see it when we need to, for example to review a report. Before a message or photo is shown, it’s screened for safety (see Service providers), so you can post only if you’ve allowed safety checks. Screening is automated and can make mistakes in either direction, and we don’t review every message. A message that doesn’t pass isn’t posted. We remove location and camera details from photos when they’re uploaded, keep photos in private storage, and show them to members through links that expire. Members can delete their own messages, and a group’s owner can delete any message. We notify members about new messages unless they’ve muted the group or turned off group notifications in the app, and we keep when you last opened each board, to show what’s new. Messages and photos are deleted with their group or with your account, except as described under Moderation and Retention & deletion. Anyone who can see a message or photo can copy or save it, and deleting it from The Corral doesn’t remove copies others made.
People you’ve cheered with. When you and another account are in a group at the same time, we keep a record that you cheered together and the last race you shared, so either of you can invite the other to a later group without a link. Other people don’t see it, and the two of you see it when inviting. We delete it about 18 months after the last group you shared, or sooner if one of you removes the other from a group or deletes their account.
Race-day notifications for cheering. For the runners on your list or in your groups, on race day we may notify you when a runner starts, when they’re getting close to your spot, and when someone in your group sees them. You can turn these off in the app’s notification settings. We keep a record of which ones we sent, so you don’t get one twice, for about a week after race day. Invites to a group and messages on its board have their own notification setting, and you can mute one group’s messages in the group.
Sharing a cheer publicly. A runner can make a video in the app, such as their race reel, and post it anywhere. Where the cheer page says so before a visitor sends a spot to cheer in person or a quick cheer, that video can show the name the visitor typed and their words or what they’ll wear, at their pin or at the moment of the race their cheer is for. A visitor who leaves a voice note can choose: sharing starts on, and they can turn it off before they send it; if they leave it on, a video can show the name they typed at their pin. Where the cheer page asks before a visitor sends a voice note, they can also choose whether the runner can play their voice in a video: that box starts ticked, and if they leave it ticked, a few seconds of their recording can play in the video, at its place in the race. A visitor can turn sharing, or their voice in videos, off from the same browser while the cheer page is up (after that, by writing to support@thecorral.app), and the runner’s later videos leave their name, what they’ll wear, their words and their voice out; a video the runner has already shared can’t be taken back. The page doesn’t ask visitors signed in to an account under 18. Otherwise a cheer shows in a video as a mark, without the visitor’s name or words, and its recording doesn’t play.
Cheering signed in (optional). On a cheer page you can sign in, or make an account, the ways described under Account, after Cloudflare’s bot check (see Our website). Signed in, the pins and quick cheers you send are your account’s: they go out under your profile name, shown the way cheer pages show runners’ names (first name and last initial), or under the name you type if your profile has none, and cheers you sent from the same browser before you signed in may become your account’s too. You can see your cheers on thecorral.app from any device, change one until the race starts, and take it off, stop sharing it or keep your voice out of videos while it exists. Each change is checked again like a new cheer (see Service providers), and where the runner approves new cheers, a changed one waits for them again. We keep a record of each cheer you send signed in (such as the race, the runner’s name, what you sent, whether it played and where you saw them), so you can look back at it after the runner’s link is deleted. The record stays until you delete it or your account, and taking a cheer off deletes its record too. Deleting a cheer from your record also deletes it from the runner’s record of the cheers they received (see Cheers you’ve received). When a runner deletes their account, their name leaves your record. Recordings aren’t part of the record and are deleted on the schedule above; until then, you can download your own. We may notify you about your cheers, for example when a voice note of yours plays, as your notification settings allow. The runner sees your profile photo and name with the cheers you send signed in, and can open your profile, unless the app wouldn’t show them your profile anyway (for example, one of you blocked the other, or your account approves its followers or is under 18 and they aren’t a follower you approved). A runner who blocks your account stops your cheers on their links, and reports from several runners can stop them on every link, as for anyone. If your account is under 18, your cheers aren’t shared publicly. Others can see how many runners you’ve cheered and how many of each kind, never who: on your profile in the app if your Cheers setting lets them, and on your page on our website (thecorral.app/@yourhandle) if it’s set to Everyone. Your profile in the app, and your page on our website when Cheers is set to Everyone, also show them a cheer medal for each race you cheered at, with the race and its year, once its race day is over. They can’t see either for an account under 18 or one that approves its followers.
Cheer pages in the app. In the app, someone else’s cheer link can open the cheer page inside the app. If you’re signed in to the app, the page is too, through a short-lived, single-use code. The page keeps its sign-in and what it remembers (see Our website) in the app’s own web storage on your device, and signing out of the app clears them. Recording a voice note there uses your microphone while you record, once you’ve allowed the app to use it. Your profile in the app shows you your own records of the cheers you’ve sent and received.
Profile photo (optional). If you add a profile photo, we remove its location and camera details, store a smaller copy in private storage, and show it next to your name in the app to people who can see your profile, but not to people you’ve blocked or who’ve blocked you, and for an account under 18, not to anyone but approved followers. You can add one only if you allowed safety checks: before it’s saved, Anthropic’s Claude checks it (see Service providers), and a photo that fails isn’t kept. Removing it, or deleting your account, deletes it from our servers (see Retention & deletion).
Age range. We ask for your age range when you make an account, or later if we don’t have it: from Apple, where its Declared Age Range is available and you or a parent choose to share it (we learn only the range, not a birthday), or by asking you. We may ask for your birth month and year, in the app or on our website; we use them to work out your age range, and we don’t keep the month or the year. If you’re under 13, we don’t keep an account for you: we delete one you already have, with what’s in it, and our website doesn’t make one and deletes the email address you gave for a code. If you’re under 18, your account is private: everyone who follows you needs your approval, including people who followed you before; people you haven’t approved don’t see your profile details, races, posts or photo; you don’t appear in search by name, on race rosters, on charity lists or in suggestions; your cheers and replies don’t notify people you haven’t approved; groups aren’t available; and a cheer link you make starts with new visitors’ pins waiting for your approval (see Cheer links). People you follow, or ask to follow, see your name, and someone who types your exact handle sees the handle, not your name or photo, and can ask to follow you. If you gave us your birth month and year, these limits end when you turn 18 by that count, and your settings stay as they are until you change them; otherwise they last until you turn 18 and contact us, and we may ask you to confirm your age. A later answer of your own doesn’t end them sooner. We store your age range, where it came from and, for an account under 18 that gave us a birth month and year, the day it turns 18.
Parental consent (Texas and similar laws). Where a law asks a parent or guardian to approve a teen’s apps, as Texas does, the app sends us Apple’s identifier for your account’s App Store download of The Corral (its app transaction ID, which isn’t a device or advertising identifier); where the app can’t tell whether such a law applies, it may send it for every account that isn’t 18 or older. If a parent or guardian withdraws consent, Apple tells us, and we pause the accounts used with that download until consent is given again: a paused account is signed out, gets no notifications, is hidden from others and can’t be used, though it can still download its data or be deleted. We delete its push tokens and keep the rest of its data. If you’re a parent or guardian who signed in to your own account on your child’s device, contact us and we’ll lift the pause for your account. Where these laws require it, a teen may be asked to get a parent’s or guardian’s approval, through Apple, for significant changes to the app. We keep with your account a record of which of those changes have been approved, or didn’t need approval, and of any request still waiting for an answer, so signing out or reinstalling the app doesn’t lose it; it’s deleted with your account.
Usage counts. So we know whether The Corral is working for people, our server notes the day your account last used the app (just the date, not what you did), and we keep daily totals of how often certain things happen in the app and on cheer pages, such as a race saved, a card shared, a cheer link made or a cheer sent. These totals aren’t tied to your account or device: the app and cheer pages send them without either, and we keep each day’s totals, not the individual events. A cheer link also keeps its own daily count of how often its page was opened and its button to get the app tapped, and from which country: Cloudflare, which sits in front of our server, tells us the country, and we don’t keep the address or anything else about who opened it. Those counts belong to the link: our team can see them, the runner’s data download includes them, and they’re deleted with the link. This is our own counting, not an analytics service, and we don’t use it for advertising or share it with others.
Network address. Like any internet service, our hosts receive your device’s network (IP) address with each request: Cloudflare, which runs our website and sits in front of our server; Amazon Web Services (AWS), which runs our server and our file storage, and receives the address when your device sends or fetches files such as voices and photos directly; and Ably, which delivers live updates, when the app connects. Cloudflare keeps it in its logs for a short time, our storage’s access logs keep it for up to about 90 days, and our rate limiter keeps it for a few days to stop abuse. Our other records don’t store it (for sign-in codes and cheer pins, we keep a one-way code made from it instead), and we don’t use it to identify you. We use the country it comes from to count a cheer page’s opens by country (see Usage counts) and to start your choices on our website the way your region’s law expects (see Your privacy choices), and we don’t keep that country otherwise.
Race news. We curate occasional racing headlines, such as race-weekend spotlights, that appear as cards in your feed. Opening one takes you to that race’s page in the app or, for outside stories, to the organizer’s or publisher’s website in your browser, under that site’s own policies; we don’t track what you read.
Our website. thecorral.app doesn’t use analytics tools. Apart from any cookies our host, Cloudflare, sets to protect the site from bots and attacks, and those the sign-in tools below use on their own domains, it uses a sign-in cookie and, on our marketing pages and as you allow, the ad tools’ cookies (see Measuring our ads on our website). If you sign in on thecorral.app, our server (api.thecorral.app) keeps you signed in with that cookie, which holds only your sign-in, can’t be read by the page’s own code, and lasts up to 30 days or until you sign out. The website’s own counting is limited to what a cheer page adds (see Usage counts). Our pages load their fonts and map code from our own domain, so opening a page doesn’t contact a font or script service. Apart from ad measurement on our marketing pages, the outside services a page may contact are our own server and file storage (both at AWS), OpenFreeMap for the map tiles on cheer pages and, while a form to make an account or sign in is open, Cloudflare’s bot check (Turnstile), which looks at your browser and its connection to tell a person from a bot, and Apple’s and Google’s sign-in buttons (signing in happens in their own windows, and Google’s button can show the Google account your browser is signed in to). Cloudflare, which hosts the site, receives your IP address to deliver each page. A cheer page keeps a few things in your browser so it works the way you’d expect, such as the name you typed, the cheers you’ve sent and which pins are yours, and your privacy choices are kept there too; you can clear them with your browser’s site data.
Measuring our ads on our website. When we advertise The Corral, our marketing pages (the home page, and pages we make for an ad) may load Google Tag Manager, Google Ads, the Meta Pixel and the TikTok Pixel, so we can see which ads bring people to The Corral. These tools can set cookies and tell Google, Meta and TikTok about your visit to that page, such as the page, the ad you came from and whether you went on to the App Store, with your IP address and browser details. Those companies can connect this to an account you have with them and use it under their own privacy policies, including to show you ads. They load as your privacy choices allow (see Your privacy choices): outside the United States, only after you agree in our banner; in the United States, unless your browser sends Global Privacy Control or you turn them off. They don’t load on cheer pages, group pages, sign-in pages, your cheers page, runners’ and race pages, the course form or our policies, and they don’t receive your email or information from the app.
Measuring our ads in the app. To count which of our ads lead to installs, the app may include a mobile measurement partner’s SDK (see Service providers). We’d use it to measure The Corral’s own ads (installs, opens and, if we choose, signing up or starting Corral Club), not to show you ads, sell data or build profiles for others. The app asks your permission before tracking, as Apple requires: with your permission, the partner may use your device’s advertising identifier; without it, the partner relies on Apple’s privacy-preserving ad attribution (AdAttributionKit and SKAdNetwork), which doesn’t identify you. We don’t use fingerprinting (identifying a device from its traits). It doesn’t run for accounts under 18, and outside the United States it runs only after you agree in the app. It receives the app’s device identifier (for us), the advertising identifier only with your permission, your IP address, your device model, iOS and app version, and those events, but not your health or workout data, races, location, cheers, contacts or messages. Once the app has a partner, you can turn it off in the app’s Privacy settings (Ad measurement).
Apple Ads. When we advertise The Corral in the App Store’s search results (Apple Ads), we may measure which of those ads lead to downloads and Corral Club memberships. For an account that’s 18 or over, on the US App Store, the app turns on Apple’s ad attribution (AdServices) in our subscription manager, RevenueCat: the app gets a code from Apple, and RevenueCat uses it to learn from Apple which of our Apple Ads campaigns and search keywords, if any, led to the download, and keeps that with your subscription record. It doesn’t use your device’s advertising identifier, and the app doesn’t ask to track you for it. Once it’s on, it generally stays on until the app is closed, so an account that signs in on the same device before then may be matched to that download too.
Invite links. When you tap Get The Corral on a runner’s page (thecorral.app/@name), the page copies its own link to your clipboard, so the app can open that runner’s page once it’s installed. The link is public and names only that runner. On its first screen, the app can check whether your clipboard holds a web link without reading it, and if it does, it shows a Paste button. The app reads what’s on your clipboard only when you tap Paste, uses it to open that page, and doesn’t keep it. You can type the runner’s @name instead.
Race organizers who send a course. If you organize a race and send us its course at thecorral.app/submit-course, we keep what you enter: your name, your role at the race, your email address, the race’s website and any note; the course file or map you attach; and the license you agreed to, with when you agreed. To protect the form from abuse, we also keep a one-way code made from your network address (it can’t be turned back into the address) and your browser’s name. We keep it in private storage, and we don’t publish the file itself. A person on our team reviews each submission, and may write to you, or to the race’s published contact, to confirm it’s really from the race. We keep the license record for as long as we use the course, and the rest until you ask us to delete it: write to support@thecorral.app. We don’t sell it or share it beyond our service providers: Cloudflare (the form’s page, and the network in front of our server), Amazon Web Services (our server, its private storage and, through Amazon SES, the email that tells our team a course came in, without the file) and Resend (a backup for that email).
What stays on your devices
Some things stay on your devices: the date of birth and gender you enter to work out Boston-qualifying standards (we save only whether a race met one), races you add just for yourself, private notes on your races, photos you add to a race, your splits plan and pace band (a cheer link shares its goal time, wave and start time, not the plan; see Cheer links), and races you save without marking them. Some of your plans are also kept in your own iCloud, so your other devices have them (below). Workouts read from Apple Health stay on your device unless you share a run; a race you log from Health saves its date and finish time to your race log like any other race.
Your plans, in your iCloud. When you’re signed in to The Corral and to iCloud, the app keeps your plans the same on your iPhone, iPad and Mac through Apple’s iCloud: the races you’ve saved, with the notes you keep on them and whether you’re in a lottery, on a waitlist or registered; the race day you confirmed; your start time and wave; your pace-band goal times; and the races you’re planning splits for. They’re kept in your own iCloud account, under Apple’s privacy policy, and we can’t see that copy; what you share with us another way, such as a registration, a draw or a cheer link, follows the rules above. Your bib number and corral, private races, race photos, private notes on races you’ve run and Apple Health data aren’t synced. If you delete your account in the app on a device signed in to iCloud, your plans are deleted from your iCloud too.
Widgets on your Home Screen and Lock Screen (race countdowns, bibs, pace bands) read this data on your device, and a pace-band wallpaper you save goes to your Photos library; none of it is uploaded to us. If you use The Corral as a guest, without an account, your races, goals and bookmarks stay on your device until you sign in, and come along when you do (unless a different account was last signed in on the device: then they’re set aside with that account’s data). Even as a guest, the app asks our server for the race catalog, news, race pages and community ratings (including those of races you’ve saved or logged), sends the crash and performance reports and usage totals described above, asks the App Store and our subscription manager (RevenueCat) about Corral Club, and uses Apple’s maps.
Photos you add to a race stay on your device too. A photo overlay uses the photo you choose from your library, or take with the camera, to make the picture on your device: it isn’t uploaded, and a photo you take there isn’t saved to your library. The app asks for the camera the first time you take a photo, and the finished picture leaves your device only if you share it.
Sharing to other apps. When you share something from The Corral to another app, such as Messages, Instagram or TikTok, what you share goes to that app under its own terms and privacy policy. For TikTok, the app saves the picture or video to your Photos library (asking first) and opens TikTok with it through TikTok’s Share Kit. Only that picture or video goes to TikTok. The Corral doesn’t sign in to TikTok, read your TikTok account or post for you: you edit, caption and post it in TikTok, or cancel. When you come back, TikTok tells the app only whether you shared it, and we don’t keep that.
Your cheer squad stays on your device too. When you add people to a race’s cheer squad, the app keeps their names, the phone numbers you pick or type and the spots you give them in a file on that device: it isn’t synced to your other devices, it’s left out of iCloud and computer backups, and it isn’t sent to us. Choosing from Contacts shows the app only the people you pick, never your whole contact list. A text to someone on your squad is sent by you, through Messages or the app you choose. People who pin a spot or leave an audio cheer on your cheer link show up in your squad from the link (see Pins and voices on a cheer link), and the app doesn’t save one in the squad’s file until you give them a phone number or a spot. Removing someone from your squad also takes their pins and voices off your cheer page. The app deletes a squad about 30 days after its race, and when you sign out and clear the device, delete your account, or another account signs in on it.
How we use information
We use the information described above to provide The Corral and its features; to keep The Corral and the people on it safe, including screening content, preventing fraud and abuse and enforcing our terms; to write to you about your account and the service; to understand and improve how The Corral works, for example from crash reports and usage totals; to measure our ads, as your choices allow; and to comply with the law. We may also use information that’s aggregated or de-identified so that it can’t reasonably identify you, for any lawful purpose; we keep it in that form and don’t try to re-identify it.
What we don't do
No ads in the app, no third-party analytics, no selling your personal information for money, and no advertising profiles about you. We don’t give ad platforms your email or information from your account or the app, and ad tools don’t load beyond our marketing pages. We don’t use fingerprinting. Apart from measuring our ads as described above, which follows your choices, we don’t track you across other companies’ apps and websites. We honor Global Privacy Control as an opt-out. We don’t respond to Do Not Track, which has no agreed meaning, but Your privacy choices does the same thing.
Your privacy choices
Our website’s pages have a Your privacy choices link at the bottom. It opens your choices for that browser: Necessary, which is always on (keeping you signed in, the bot check on sign-in forms, and the cheers you send), and Advertising (the ad measurement on our marketing pages). We keep your choice in your browser, and may ask again if what the choices cover changes. A browser that sends Global Privacy Control has Advertising off, whatever else it says. In the app, Apple’s tracking permission (in your device’s Privacy & Security settings) applies, and once the app has a measurement partner, so does Ad measurement in the app’s Privacy settings.
California and other US states. We don’t sell your personal information for money. But when an ad platform’s tool on our marketing pages, or a measurement partner in the app, collects information it can also use for its own advertising, California law calls that “sharing” for cross-context behavioral advertising and may count it as a “sale”; other states call it targeted advertising. That information is identifiers (such as cookie IDs, advertising identifiers and IP address) and internet activity (such as the page you visited and the ad you came from), and it goes to the companies named in Measuring our ads. You can opt out of all of it: turn off Advertising in Your privacy choices, send Global Privacy Control from your browser, or turn off Ad measurement in the app. We don’t knowingly sell or share the information of anyone under 16. We don’t use or disclose sensitive personal information (such as your sign-in details, a shared run’s route or messages on a group’s board) for purposes that would give you the right to limit it under California law. For your other rights, see Your rights.
Service providers
Besides sharing with other people on The Corral as you choose and as your settings allow (described above), we share personal information with service providers that run parts of The Corral for us, with ad partners as your choices allow, and for the legal reasons and business transfers described below. Our service providers process personal information to provide their services to us, under terms that limit how they may use it and require them to protect it, at a level at least equal to the protection this policy describes.
Your data is processed by the infrastructure we run on: Amazon Web Services (AWS: our server, database, backups and rate limiter; the private storage for profile photos, photos on groups’ boards, cheer-link voices, their race-day announcer lines, and the course files race organizers send us; and Amazon SES, which sends our server’s emails, such as sign-in codes), Cloudflare (our website, the network in front of our server, and the bot check on our website’s forms to make an account or sign in), Ably (delivering realtime updates), Resend (a backup for our server’s emails) and RevenueCat (Corral Club subscription status; see above). Cheer pages also load their map tiles from OpenFreeMap, a free map service, which receives your IP address under its own terms. Before October 26, 2026, our server ran on Vercel, our database on Railway, and safety checks went to Anthropic’s own API; we deleted what Vercel and Railway held on October 27, 2026 (see Retention & deletion).
To measure our ads, as your choices allow: Google (Tag Manager and Google Ads), Meta (the Meta Pixel) and TikTok (the TikTok Pixel), which receive what their tools collect on our marketing pages and use it under their own privacy policies, and the app’s mobile measurement partner (none yet).
The Race Finder matches races on your phone; your quiz answers never leave it.
If you allow safety checks (in the app, by tapping a button that starts with “Allow and”, such as “Allow and post”, or by turning on Safety checks by Anthropic in the app’s Privacy settings), Claude, Anthropic’s AI model, checks what you post before others see it: posts, replies, review notes, charity flair, the words of a goal you share, your profile name, location and bio when you change them, your profile photo, what you type that others will see in a group (such as its name, your outfit or the meet-up point), and the messages and photos you post to a group’s board. We use Claude through Amazon Bedrock, inside AWS, so what’s checked goes to AWS and not to Anthropic. We don’t send anything of yours for a check before you allow it, and turning it off stops new checks. Until you allow them, you can’t post or add anything that needs a check, such as replies, messages on a group’s board, a review note, charity flair, a bio, a location or a profile photo, and we don’t send anything for a check; the rest of the app works as usual. Your display name and handle are also checked against a word list on our own server. Your answer, and when you gave it, are stored with your account and included in your data download. Screening is automated and can make mistakes in either direction.
On cheer pages, Claude checks the names visitors type and the notes and words they send the same way, and OpenAI’s transcription API turns each voice recording into text for that check; the page says so before a visitor sends anything, and sending is their agreement. OpenAI processes recordings under its API terms, which may let it keep them for a limited time, and we don’t keep the text. When a cheer page says so before a visitor sends their pin, ElevenLabs’s text-to-speech API reads their name, side of the road, place and note aloud to make the short lines the runner hears on race day, once for each announcer voice the runner picks; ElevenLabs processes them under its API terms, and once the audio is made, we ask ElevenLabs to delete the request from our account’s history.
Retention & deletion
How long we keep information depends on what it is and why we have it. We keep your account information while your account is active, and what you post until you or we delete it. Information tied to a race day, such as cheer links and their cheers, pins and voices, live progress, groups and race-day notification records, is deleted on the schedules described above, generally within hours to about a month after the race, apart from a runner’s record of the cheers they received, which stays with their account (see Cheers you’ve received). Logs, security records and backups are kept for limited periods, such as those described in this policy. When we no longer need information, we delete it or de-identify it.
You can delete your account in the app (Settings → Account → Delete account). This permanently deletes your account and what’s tied to it from our servers, including your profile and photo, race log, reviews, registrations and draws, follows, posts, replies and feed activity, cheers, goals, cause flair, shared runs, the reports you sent about a race’s details, your cheer links with their cheers, pins, voices and counts, the cheers you sent signed in and your record of them, your record of the cheers you received (your name also leaves others’ records of the cheers they sent you, and your name and words leave runners’ records of the cheers you sent them), the runners you cheer for (and you leave others’ lists and groups), your groups (one you own passes to the member who joined first), your sightings and the mile you shared, your messages and photos on groups’ boards, the invites you sent and got, the record of people you’ve cheered with, your notifications and push tokens, and the links between your account and App Store download identifiers. It also asks RevenueCat to erase your subscriber record, revokes our connection to your Apple Account, deletes your plans from your iCloud if the device is signed in to it, and clears The Corral’s data on the device. Copies in our backups are deleted as the backups expire. Our database is backed up daily, and backups, including a locked copy in a separate AWS account for disaster recovery that can’t be deleted early, are kept for up to about 4 months. A deleted or replaced file, such as a voice or a photo, can stay recoverable for about a week before our storage removes it for good. If we restore a backup, we delete again the accounts deleted since it was made, using a record of deleted accounts’ IDs that we keep for about 4 months. On October 27, 2026, we deleted what our previous hosts held when we moved to AWS: Railway’s database and the few files left at Vercel. Railway’s own backups of it, and our own encrypted copies from before the move, expire within about 3 months of the move. Community averages may continue to reflect previously aggregated, non-identifiable statistics. We may keep some information after you delete it or your account, or longer than described here, when we need it to comply with the law, resolve disputes, enforce our terms, prevent abuse (for example, records of bans and reports) or establish or defend legal claims.
You can download a copy of your data at any time in the app (Settings → Account → Download my data), which gives you a JSON file of the information your account holds, such as your profile, settings and photo, races and reviews, goals, posts and replies, shared runs, cheer links with their cheers and pins, the cheers you’ve sent and received, the runners you cheer for, your groups, sightings and messages, follows, reports you sent about races, and notifications. You can also ask for a copy by writing to support@thecorral.app (see Your rights).
Your rights
This policy describes the kinds of personal information we collect, and have collected over the past 12 months, where it comes from (you, your devices, other people on The Corral, and services you connect, such as Apple, Google and Apple Health), why we use it, and who receives it.
Depending on where you live, you may have the right to know what personal information we have about you and get a copy of it in a portable format, to correct it, to delete it, to opt out of its sale or sharing and of targeted advertising, and to withdraw consent you’ve given. You can do most of this yourself: edit your profile and settings in the app, download your data or delete your account (see Retention & deletion), and use Your privacy choices and your app and device settings to opt out or withdraw consent, for example by turning off safety checks, Apple Health access, notifications or ad measurement. Withdrawing consent doesn’t affect what we did before, and some features may stop working. For anything else, write to support@thecorral.app.
We respond to requests as the law where you live requires. We may need to verify that a request is yours before we act on it, for example by asking you to write from the email address on your account or to confirm it in the app. Someone you authorize can make a request for you where the law allows it; we may ask for proof of their authority and ask you to confirm your identity with us. We may decline or limit a request where the law allows, for example when we can’t verify it, when we need to keep information for the reasons in When we may share or keep information for legal reasons, or when it would reveal someone else’s information. We won’t discriminate against you for exercising your privacy rights. Where the law gives you the right to appeal our decision on your request, you can appeal by replying to our answer or by writing to support@thecorral.app with “Appeal” in the subject; we’ll respond within the time the law requires and, if we deny your appeal, tell you how to contact your state’s attorney general.
If you’re in the European Economic Area, the UK or Switzerland. Sand Collective LLC is the controller of your personal data. We process it to provide The Corral under our Terms of Use; for our legitimate interests in running, securing and improving The Corral, keeping it safe (including screening content and preventing abuse), enforcing our terms and establishing or defending legal claims, where your interests don’t override them; with your consent, where we ask for it (for example, for Apple Health access, notifications and ad measurement); and to meet our legal obligations. Besides the rights above, you can object to processing based on our legitimate interests, ask us to restrict processing, and complain to your local data protection authority.
Where we process information. We’re based in the United States, and we and our service providers process and store information in the United States and other countries, whose laws may not protect personal information the way the laws where you live do. Where the law requires a safeguard for information transferred from the EEA, the UK or Switzerland, we rely on one the law recognizes, such as the European Commission’s standard contractual clauses.
Moderation
You can report posts, replies, shared runs, goals, charity flair, messages on a group’s board and runners, and block other users, in the app. New reports alert our moderation team, and we review reports within 24 hours and remove content or accounts that violate our Terms of Use. Our checks and reviews can make mistakes, and we may also remove content or restrict accounts on our own, as our Terms of Use describe.
Reported and removed content. When something is reported, or we remove it, we may keep it, with related information such as who posted it and when, for as long as we need it to review the report, enforce our terms, prevent abuse, comply with the law, or establish or defend legal claims, even after it’s deleted from the app, its group ends or its sender’s account is deleted. When the law requires it, we report apparent child sexual exploitation to the National Center for Missing & Exploited Children and preserve related content as the law requires.
Copyright notices. If you send a copyright notice or counter-notice, we keep it and our emails about it for at least three years. As the law requires, we send a copy of a counter-notice, including its sender’s name, address and phone number, to the person who sent the original notice. We may also share a notice, including the claimant’s name and the work, with the person whose material it names. When we remove something for a copyright notice, we keep a copy of it with the notice’s record, so a counter-notice can put it back; it’s deleted with the poster’s account.
When we may share or keep information for legal reasons
We may access, keep and share information about you, including your content, when we believe in good faith that it’s needed to comply with the law, a legal process or a government request; to enforce our Terms of Use or investigate possible violations; to detect, prevent or address fraud, abuse, security or technical problems; or to protect the rights, property or safety of Sand Collective LLC, our users or others. If Sand Collective LLC is part of a merger, acquisition, financing, reorganization or sale of assets, your information may be transferred as part of that transaction, and this policy will keep applying to it unless you’re told otherwise.
Security
We use reasonable safeguards to protect your information, such as encryption and access controls, but no service is completely secure, and we can’t guarantee the security of the information you share with us. If a security breach affects your personal information, we’ll notify you as the law requires.
Children
The Corral isn’t directed to children under 13, and you must be at least 13 to make an account, in the app or on our website. We ask your age as described under Age range above. If someone tells our website they’re under 13, that browser remembers it and won’t make an account. If we learn that we’ve collected personal information from a child under 13, we delete it; if you believe a child under 13 has given us personal information, write to support@thecorral.app. If you’re a teen’s parent or guardian and you withdraw consent for The Corral through Apple, we pause the account as described under Parental consent above.
Changes
We may update this policy. If we make material changes, we’ll post them here with a new effective date and, where the law requires, tell you in another way or ask for your consent.
Questions or requests? Write to support@thecorral.app, or to Sand Collective LLC, 16192 Coastal Highway, Lewes, DE 19958, United States.