Privacy policy

In short: we use your data only to make the app work (recording your runs, your statistics and results, your medals, your training and your communities). We do not sell your data, we do not show ads, we do not use third-party tracking or analytics tools and we do not build advertising profiles. Your location is only used while you record a run or check in to a training session. You can delete your account and your data at any time from the app.

This is a translation of the Spanish version. If the two versions differ, the Spanish version prevails.

1. Who is responsible for your data

The Carreras Panamá app is developed and operated by Xtrategy Consultants Int, Corp, owner of Carreras Panamá, based in Panama City, Republic of Panama. For any question about your personal data, write to us at administracion@carreraspanama.com, call us at +507 6127-0624 or use the contact form. We process your data in accordance with Law 81 of 2019 on Personal Data Protection of the Republic of Panama and its regulations.

This policy covers the app and its server. Race registrations, payments, official results and race photos are managed on the carreraspanama.com website and are governed by its privacy policy.

2. Legal basis for using your data

We use your data with your consent, which you give when you create your account and accept this policy, and which you give separately each time you turn on something optional (location, camera, Apple Health or Health Connect, Face ID or fingerprint, live sharing, reminders, registration details, the AI coach). We also use it because it is necessary to provide the service you asked for when using the app. You can withdraw your consent at any time by turning off the permission on your phone or in the app, or by deleting your account. Withdrawing it does not affect what was done before.

3. What data we collect

• Account: name, email address and password (stored encrypted; we never see it), the language you chose for the app and your date of birth, which we ask for when you create the account only to check the minimum age (section 12).
• If you sign in with Google or Apple: we receive your name, your email (with Apple it may be a private address that Apple forwards to yours) and an identifier for that account so we recognize you next time. We never receive your Google or Apple password. We still ask for your date of birth.
• Profile (optional): city, bio, profile photo, height and weight.
• Activities and location: when you record a run we use your phone's GPS to record the route, altitude, distance and time. Location is used only while you are recording, also with the screen off (that is why Android shows the "Recording your run" notification and the iPhone shows the blue indicator). We never track your location outside a recording. We also store the title, description and cover photo you add to each activity.
• Guided routes (optional): if you run the official route of an event, we store with your activity which route you ran and what percentage you completed. Voice directions are generated by your phone; no audio is sent anywhere.
• Live tracking (optional): if you turn on "Share live" while running, we send your position to the server every few seconds, together with your direction, distance, time, pace and whether you are paused, only for the duration of that run. It is deleted the day after it ends.
• Training attendance: when you tap "I'm here" we read your location once to confirm you are at the training location, and we store the date, time, that location, whether it was verified by GPS and the distance to the meeting point. When you tap "I'll be there" we store only your confirmation.
• Health and fitness data (only if you connect your watch): if you authorize Apple Health (iPhone) or Health Connect (Android), we read your running workouts from the last 30 days: distance, duration, route, altitude, the source app or watch and your heart rate during the workout (of which we only store the average). We only read; we never write or modify your health data. See section 5.
• AI Training: your goal (distance or weekly target), your experience, when you last ran, the level we calculate from that, your training days, the race you are training for (if you choose one), your session plan, which sessions you completed and the distance and pace you ran in each. The time of your reminders is stored only on your phone.
• AI coach (optional): the answers you give when you finish each training block (how it felt, what you want for the next one, your days) and, if you report pain, the body area and your answers (how much and how it hurts, since when, whether there is swelling, etc.), plus the coach's feedback, assessment and recommendations. This is information about your health: see section 5.
• Camera and photos: the camera is used to scan the QR code of medals (the one on your time certificate or the race's) and to take your profile photo or an activity cover if you choose to; the photo library, to choose those photos and to save the images you create in "Create image". We only upload the photos you choose as profile or cover; "Create image" images are put together on your phone.
• Medals: when you scan the QR code of your time certificate from carreraspanama.com we store the data it contains (event, bib number, first name, last name, distance and official time) to show it on your medal; with the QR code of a medal without data, we use your account name. We record each scan (date, account, medal, bib and result) for Carreras Panamá's statistics.
• Race coupons: the coupons a race's sponsors give out are unlocked in two ways. With the "Desbloquear cupones de carrera" button in your registration email, which only carries the event number and your registration number (signed; nothing about your ID or your details). Or, if your app email is verified and there are coupons for an event you don't have yet, the app asks carreraspanama.com whether that email has a confirmed registration for that event; the website only replies with those numbers and the event name. We store which registration unlocked the coupons on your account (each registration, on a single account). Sponsors only see how many people unlocked and redeemed them, never who.
• Registration details (optional): if you fill in "My race registration details", we store your ID document number, first and last names, sex, country, date of birth and phone number. The ID number and date of birth are stored encrypted. They are only handed to carreraspanama.com when you register for an event from the app and confirm it is you (Face ID, fingerprint or your phone's passcode): the app passes the form a single-use permission that expires after 2 minutes. Nobody can obtain them with just your email. In the app you can see each time they were shared and you can delete them whenever you want.
• Participation in the app: unlocked medals, achievements, Prestige points and rank, organizations you belong to (with their history of requests and invitations and whether you share your email with them), groups and training sessions you attend, promotions you redeem, the routes you recommend, the routes you run with "Try this route" (and how much of each one you covered), the reactions ("shotings") and reports you give, which News posts you viewed, opened or shared (and whether you tapped their button), and the notices we send you inside the app.
• Technical data: the open session on each phone and technical server logs (such as the IP address and time of each request) needed for security and to fix errors. We do not use advertising identifiers.

4. What we use it for

• Showing you your activities, statistics, elevation, kilometers in the app, medals and Prestige rank.
• Guiding you by voice on official routes and, if you turn it on, letting people with your code follow you live.
• Creating and adjusting your AI Training plan, reminding you of your workouts and, if you ask for it, giving you the AI coach's feedback on your training or your pain.
• Showing you communities and training sessions (including your groups' private ones) and confirming your attendance.
• Letting you redeem promotions from partner brands.
• Filling in the carreraspanama.com registration form for you when you ask for it.
• Sending you in-app notices and emails about your account (such as the code to verify your email when you sign up or to change your password), your organizations, your groups and your training sessions, and an email receipt when a brand validates a promotion you redeemed.
• Protecting the app and its users (for example, detecting fake activities that add points improperly).

We do not use your data for advertising, we do not sell it, we do not share it with third parties for commercial purposes and we do not make automated decisions that significantly affect you. The only automatic things are the level and sessions of AI Training and the AI coach's suggestions, which are guidance only and which you can change or ignore whenever you want.

5. Health data (Apple Health, Health Connect and AI coach)

The data we read from Apple Health or Health Connect is used only to import your runs as activities in the app (with their route, elevation and average heart rate) and to calculate your statistics and points. It is not used for advertising or to build profiles, it is not sold, it is not shared with third parties (except the providers that host the app, section 7), it is not used for purposes unrelated to the app and it is not stored in iCloud.

The use of information received from Health Connect complies with the Health Connect Permissions Policy, including the Limited Use requirements. You can stop sharing this data at any time from the Health settings (iPhone) or Health Connect settings (Android), and from the app in Activities → Connect watch. Activities already imported remain in your account until you delete them or delete your account.

AI coach. Only when you send the questionnaire at the end of a training block, we send OpenAI (section 7) a summary so the coach can build the next one: your goal, level and training days, your recent sessions with the distance and pace you ran (they may come from runs imported from your watch), how many days are left until your race, your answers and, if you report pain, the body area and how it hurts. Pain you report in the middle of a block is not sent until that questionnaire. We do not send your name, email, routes or location. According to the terms of its business service, OpenAI does not use this data to train its models and keeps it for up to 30 days only to prevent abuse. If your answers show warning signs (severe pain, not being able to walk, a lot of swelling or tingling), we do not ask the AI: we pause your plan and recommend that you see a doctor. The coach does not diagnose and does not replace a health professional.

6. What other people see

• KM in the App (Results): your name, your kilometers for the year, your average pace and how many activities you recorded appear in the app's user table.
• Recommended routes: only the routes you decide to recommend from one of your activities. They are published without your name or photo: people see the route's line, distance, elevation gain, area, the tags you choose and your comment. Before publishing, the app removes the start and the finish of the run (300 m by default; you choose how much) so it doesn't show where you live. Nobody sees who ran a route, only how many people did it. You can remove your route whenever you want. Carreras Panamá can see who published it in order to review reports.
• Coaches: if you tap "I'm here" at a training session or belong to a group, the coach sees only your name (not your email or other data).
• Organizations (Running Teams and Brands): if you ask to join, accept an invitation or are a member, their administrators see your name and Prestige rank, and your membership history (requests, approvals, departures). They only see your email if you tick "Share my email" when requesting or accepting, so they can contact you. When you ask to join, that same information is emailed to them (to the organization's email and its administrators) so they can review your request. You can leave an organization at any time from the app.
• Brands: when a store validates a promotion you redeemed, the brand sees your name, the promotion and the redemption date.
• News: organizations that post in News see only numbers for their posts (how many people viewed, opened or shared them, and how many codes for their promotion were generated from there). They never see who it was. In the app, a post shows how many people viewed it, without names.
• Live tracking: anyone with the code you share sees in the app your name, your photo and where you are at that moment (also when leaving or arriving home), your route, distance, time and pace, while you run and up to 30 minutes after you finish. Share the code only with people you trust; you can stop sharing at any time and the code stops working when you finish.
• Carreras Panamá team: the panel administrators see the data needed to operate the app and handle your requests (for example, who has a medal or who attended a training session). They never see your password or your registration details.

7. Providers that help us run the app

We use providers that process data on our behalf and only to provide their service to us:

• DigitalOcean: hosting of the servers, the database and the photos.
• SendGrid (Twilio): sending emails (your name, your email and the content of the email).
• Google and Apple: only if you choose "Sign in with Google" or "Sign in with Apple": they confirm who you are and give us the data above. If you delete an account created with Apple, we ask Apple to revoke the access.
• OpenAI: generates the AI coach's answers, only when you ask for them, with the summary without name or email described in section 5.
• Stadia Maps and OpenStreetMap: map images; they receive your IP address and the area of the map you are viewing, not your account. If you tap "Add elevation" on an activity, Stadia Maps receives the points of that route (without your name or account) to return the terrain elevation.
• Apple and Google: distribute the app (App Store and Google Play) and, only if you connect them, Apple Health and Health Connect. Face ID, fingerprint, reminder notifications and the voice of the directions are handled by your phone's system.

If you tap "Directions" on a training session, Google Maps, Waze or Apple Maps opens with the meeting point; what you do in those apps is governed by their own policies.

Race registrations are completed on the carreraspanama.com website (with its own policy), which receives your registration details only when you register from the app, and payments are processed by PagueloFácil or Banco General (Yappy) — see the website's privacy policy. The app does not receive or store card or payment data.

Outside these cases we would only hand over data if a competent authority requires it in accordance with the law.

8. Where your data is stored

Our servers and those of SendGrid, OpenAI and Stadia Maps are in the United States, so your data is transferred outside Panama. By accepting this policy you consent to that transfer. We choose providers that protect data with security measures equal to or better than those required by Law 81 of 2019, and we only give them what is necessary for their service.

Some things stay only on your phone and never reach our server: day/night mode and language, voice settings for guided routes, guided routes you download to use without signal (the route and its map), the codes of the people you follow live, your reminder settings and, if you turn on Face ID or fingerprint, your email and password in the system keychain (section 10). They are deleted when you uninstall the app.

9. How long we keep it

As long as you have your account. If you delete it, we delete your profile, activities, routes, photos, training plan, AI coach pain reports and reviews, attendance, organizations and groups, redemptions, medals and achievements, registration details, notices, the record of what you viewed in News (each post's totals do not change), and the codes and invitations linked to your email. Medal scans remain only as anonymous statistics, without your account. "Live tracking" location is deleted the day after each run, whether or not you have an account; the password change code expires after 15 minutes and the registration permission after 2 minutes. Technical server logs and backups are deleted within up to 90 days.

10. Security

We use encrypted connections (HTTPS), store passwords encrypted, encrypt your ID number and date of birth, and limit access to data to the people who need it to operate the app. If a security incident affecting your data occurred, we would notify you and the authority in accordance with the law.

If you turn on "Sign in with Face ID / fingerprint", your email and password are stored encrypted only on your phone (in the system keychain: Keychain on iPhone, Keystore on Android) and the app uses them only after the phone recognizes your face or fingerprint. Your face and fingerprint are handled by the operating system: the app does not see them, store them or send them anywhere. You can turn it off in Profile, and it is deleted when you delete your account.

11. Your rights

You can access your data, correct it, ask us to delete it, object to its use and ask for a copy in a commonly used format (rights of access, rectification, cancellation, objection and portability under Law 81 of 2019). You can edit your profile and delete your activities, your registration details and your account from the app, or write to us at administracion@carreraspanama.com or through the contact form. To protect your account, we will ask you to write from your registered email. We will respond within a maximum of 10 business days. If you are not satisfied, you can go to the National Authority for Transparency and Access to Information (ANTAI) of Panama.

12. Minors

The app is not directed at children under 13. When an account is created we ask for the date of birth: if it shows an age under 13, the account is not created and we keep no data about that person. The date of birth of created accounts is kept while the account exists, as a record of the declared age, and deleted when it is deleted. If you are under 18, use it with the authorization of your mother, father or legal guardian. If we detect data from minors without that permission, we will delete it.

13. Changes to this policy

If we change this policy we will let you know in the app or by email before the change applies, and if the change requires new consent we will ask for it. The date of the last update appears at the top of this page. This English version is a translation; if it differs from the Spanish version, the Spanish version prevails.

© 2026 Xtrategy Consultants Int, Corp · Panama City