Privacy Policy

Glass Slipper Run is a personal training companion app for the Disney Princess Half Marathon weekend. It is operated by CD Web, contactable at [email protected].

This app is for users aged 18 and over. By creating an account you confirm you are at least 18 years old. We do not knowingly collect data from anyone under 18.

Account information — your username, email address, an optional display name, and a hashed (bcrypt) password. We never store your password in plain text.

Training data — your training plan, scheduled sessions, and run logs. Run log fields include: distance, duration, pace, how you felt, effort score (1–10), run/walk ratio, route description (free text you type — not GPS), shoes worn, and weather notes.

Health-related data — whether you reported pain during a run, the location of any pain, and severity. You choose what to enter; these fields are optional. This data is used only to display your own history back to you.

Photos — an optional profile photo and optional run photos you choose to upload. See Image storage below.

Social interactions — follows, run reactions, comments, and run invites you send or receive.

Photos you upload are stored on Cloudflare R2, a third-party cloud storage service. Images are served from a public URL, which means anyone who has the direct link to an image can view it without being logged in to the app. Image URLs are randomly generated and are not listed or searchable within the app.

If you delete your account, your images are removed from our database records. Please contact us at [email protected] if you would also like the underlying files removed from storage.

We use your data solely to provide the training tracking service — showing your plan, logging runs, computing stats, and enabling social features like following training partners.

We do not sell your data, use it for advertising, or share it with third parties beyond the service providers listed below.

Google Analytics 4 — used to understand how the app is used (page visits, feature usage). Only loaded with your consent. Google may process your IP address and device information to provide this service. Governed by Google's Privacy Policy. You can opt out at any time via our Cookie Policy.

Cloudflare R2 — stores uploaded photos. Governed by Cloudflare's privacy policy.

Cloudflare Turnstile — a CAPTCHA-like bot detection widget shown on the login screen. It processes your IP address and browser signals to verify you are human. Governed by Cloudflare's privacy policy.

Essential cookies — a session cookie (next-auth.session-token) is set when you sign in. It is required for the app to function and contains only a session identifier. A CSRF security token is also set. These do not require consent.

Analytics cookies — Google Analytics 4 sets cookies (_ga, _ga_G-DNQH02ZYQL) to count visits and measure usage. These are only set after you explicitly accept analytics cookies via the consent banner. You can withdraw consent at any time on our Cookie Policy page.

Browser localStorage — we store small preference flags locally on your device (for example, whether you have completed the in-app tour, and your cookie consent choice). These contain no personal data and are never sent to our servers.

We do not use advertising or targeting cookies. Full details of all cookies are listed in our Cookie Policy.

Your data is retained for as long as your account exists. When you delete your account, all of your data — training plan, run logs, achievements, and social connections — is permanently and immediately deleted. This cannot be undone.

If you ran with another user and they retain their own run log, the reference to your account in their log is anonymised (set to null) rather than deleted.

You can access, update, or delete your data at any time:

• Edit your profile in Settings
• Export your data as JSON in Settings → Data & Backup
• Delete your account in Settings → Danger zone
• Withdraw cookie consent at any time via the Cookie Policy

For any other requests — including data subject access requests, portability requests, or complaints — email [email protected]. We will respond within 30 days.

Depending on the US state you live in, you may have rights under applicable privacy laws including the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Texas Data Privacy and Security Act (TDPSA), and similar laws in other states. These rights may include:

• Right to know — what personal information we collect about you and how it is used
• Right to access — a copy of the personal information we hold about you (use Settings → Data & Backup)
• Right to delete — request deletion of your personal information (use Settings → Danger zone, or email us)
• Right to correct — request correction of inaccurate data (use Settings, or email us)
• Right to opt out of sale or sharing — we do not sell personal information. We share limited data with Google Analytics only with your consent; you can withdraw consent at any time on our Cookie Policy page.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, email [email protected]. We will respond within 45 days as required under US state privacy laws. We may need to verify your identity before processing a request.

Do Not Sell or Share My Personal Information — Glass Slipper Run does not sell personal information. Analytics data is only shared with Google if you consent. To opt out of this sharing, visit our Cookie Policy and select "Reset my preference", or decline cookies when the consent banner appears.

Passwords are hashed using bcrypt (12 rounds) and are never stored in plain text. Login attempts are rate-limited and protected by Cloudflare Turnstile. Email verification is required before an account can be used.

If we make material changes to this policy, we will update the date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

Questions or concerns? Email us at [email protected].