Privacy policy
Version 0.4 · updated October 7, 2026
English translation provided for information only: the French version is binding.
Draft text
In short
Kilomeet is published by Robin Clerc, a private individual. It is the controller of accounts, the club directory, security and its own communication.
For the data of a club’s runners (memberships, run sign-ups, attendance, waivers), the club is the controller and Kilomeet its processor: the club’s notice, shown on every form, applies.
No audience-measurement cookie, no tracker, no advertising, no sale of data.
No health data, no date of birth, no phone number, no GPS trace kept.
Kilomeet is for people aged 18 and over.
Your rights: from your settings, or by writing to privacy@kilomeet.com. Answer within one month. You can also complain to the CNIL.
Who is responsible
The controller of the processing described here is Robin Clerc, a private individual not registered as a business, 41 Les Brosses, 45270 Villemoutiers, France. Contact for your data: privacy@kilomeet.com.
Kilomeet is not required to appoint a data protection officer; the founder is the contact for any privacy question.
Who decides what
Accounts, sign-in, notifications, the club directory, security and our communication: Kilomeet is the controller.
Data a club manages for its own organisation (member list, run sign-ups and attendance, guests, waivers, messages to participants): the club is the controller and Kilomeet acts on its behalf under the data processing agreement. For a crew with no legal entity, the controller is the person who created it.
A guest signing up for a run: the host club is the controller; when a run is co-hosted, the host club is the controller of the sign-ups and the co-host only sees totals.
Agreeing to receive a shop’s offers: the shop is the controller of its list; the consent text names it and links to its own notice.
What we process, why, and for how long
This list is kept up to date from our register of processing activities. Each line gives the purpose, the legal basis, the data and how long it is kept.
RP1 · Accounts & auth
- Role
- Provide the service
- Legal basis
- Contract (6.1.b)
- Data
- email (changed only after a step-up and a code to the new address: audited, the old address alerted), name, 18+ declaration date, last activity, restriction and erasure dates, sessions, passkeys (credential id and public key, label, dates; removed at erasure); an account that joined a group before confirming its address keeps the typed address apart until its code is typed
- Retention
- Account life + 30 d; an account whose address was never confirmed: 7 d
RP7 · Notifications
- Role
- Service messages, organiser Monday email
- Legal basis
- Contract / legitimate interest in keeping organisers informed of their runs, with opt-out
- Data
- email; notification preferences (per-crew run-announcement opt-in); private calendar feeds (scope, last day fetched)
- Retention
- Account life
RP8 · Platform marketing emails
- Role
- Newsletter to organisers
- Legal basis
- Consent; legitimate interest in promoting the service to businesses, with opt-out, for trade addresses only
- Data
- Retention
- Until opt-out, or 3 y without interaction
RP9 · Billing
- Role
- Subscriptions
- Legal basis
- Contract + legal obligation (C. com. L123-22)
- Data
- billing identity (Stripe)
- Retention
- 10 y (invoices)
RP10 · Audience measurement
- Role
- Stats
- Legal basis
- Not personal data (daily aggregate counts per path)
- Data
- page, day, referrer host
- Retention
- 25 months
RP11 · Error monitoring
- Role
- Reliability
- Legal basis
- Legitimate interest in keeping the service reliable
- Data
- technical data, redacted
- Retention
- 30 d
RP12 · Directory (unclaimed listings)
- Role
- Help runners find clubs
- Legal basis
- Legitimate interest in helping runners find a club (LIA docs/legal/lia-directory.md)
- Data
- org name, handle, website, arrondissement, day/time, meeting area
- Retention
- Until claimed, or removed within 72 h on request
RP13 · Security logs / audit
- Role
- Security, accountability
- Legal basis
- Legitimate interest in securing the service and preventing abuse / legal obligation
- Data
- actor, action, target ids; origin_ip on creation events only; rate-limit HMAC keys
- Retention
- 12 months (rate-limit keys 48 h)
RP16 · DSR register
- Role
- Accountability (Art. 12, 30)
- Legal basis
- Legal obligation
- Data
- email hash, request kind, dates
- Retention
- 3 y
RP17 · Attendance reports
- Role
- Proof for stores, brands, sponsors
- Legal basis
- Host's own data / legitimate interest in measuring the service with anonymous aggregates
- Data
- counts only
- Retention
- 3 y
RP18 · Waitlist and landing sign-ups
- Role
- Tell people when we launch
- Legal basis
- Consent
- Data
- email, locale, sign-up date, page and plan signed up from, confirmation status
- Retention
- Pending until confirmed by email; unconfirmed deleted after 30 days; confirmed: until launch + 12 months, or opt-out
RP19 · B2B sales prospecting
- Role
- Sell the Store/Brand plans
- Legal basis
- Legitimate interest in selling the Store and Brand plans, professional addresses only
- Data
- name, role, shop, professional email/phone, pitch log
- Retention
- 3 y after last contact
RP20 · Notice and action, abuse
- Role
- DSA/LCEN duties
- Legal basis
- Legal obligation
- Data
- report, target, reason, statement of reasons
- Retention
- 12 months after closure
RP21 · Hosting identification data
- Role
- Judicial requisitions
- Legal basis
- Legal obligation (LCEN art. 6; décret 2021-1362)
- Data
- account-creation and publication IPs (audit_log.origin_ip)
- Retention
- 12 months
RP22 · Product events
- Role
- Product decisions
- Legal basis
- Legitimate interest in improving the product (pseudonymous within the month: a monthly salt; anonymous once the month is over)
- Data
- event name (3 allowed), club, closed-list props, hour; a closed month keeps name, props and the week only
- Retention
- 13 months
RP24 · Research interviews
- Role
- Validate the plan
- Legal basis
- Consent
- Data
- interview notes, quotes
- Retention
- Raw notes deleted 12 months after the interview
RP25 · Email suppression list
- Role
- Honour bounces, complaints and unsubscribes
- Legal basis
- Legal obligation / legitimate interest in never mailing someone who refused
- Data
- email hash, category, reason
- Retention
- 3 y after the last event
RP27 · Run-together announcements and responses
- Role
- Organise short-notice runs
- Legal basis
- Contract (6.1.b)
- Data
- crew memberships (personal crews, connected both ways by a personal link; private groups and their group links), the join notice to a personal group's owner (first name only), announcements, responses (in / in_if / maybe), slots, run-day message markers, presence confirmations (« On a couru ensemble », a timestamp)
- Retention
- 3 seasons, then aggregated (like run attendance); the run plan deleted 7 days after the run
RP28 · Start pins and last-hour statuses
- Role
- A fair meeting spot and approach; who is on the way in the last hour
- Legal basis
- Contract (6.1.b); location data, hence a data protection impact assessment
- Data
- a 250 m cell id or a landmark id, an approach constraint, a status chip and its time (« Au rdv » kept as a timestamp only); never coordinates
- Retention
- Deleted at starts_at + 4 h, at withdrawal or cancellation
RP29 · Web push subscriptions
- Role
- Same-day notifications the user subscribed to
- Legal basis
- Contract (6.1.b)
- Data
- endpoint, keys, platform family, delivery timestamps
- Retention
- Until unsubscribed, 404/410, 180 days without delivery, sign-out everywhere or erasure
RP30 · Personal-crew safety controls
- Role
- Remove or block someone from a crew
- Legal basis
- Legitimate interest in the crew owner's safety
- Data
- the suspended membership
- Retention
- Kept while the owner's crew exists; erased with either account
What we do not collect
No health data: no medical certificate, no questionnaire, no expiry date. Certificates stay with the club or the FFA.
No date of birth: you confirm that you are 18 or older.
No phone number, no gender, no photo of a person.
No GPS trace kept and no live location. A GPX file you import to create a route is read in memory, then forgotten. Its first and last points are taken as your door: no point of the file within 400 m of either is used, nothing within 300 m of either is kept or sent (the route included), whichever way the run goes, the route starts at a public landmark 500 m away at most (and ends at another, or the same one for a loop), and only the route snapped to the streets is kept. A home that is neither the file’s first nor its last point (a warm-up recorded elsewhere) is not detected.
No IP address in our tables, except when an account is created and when content is published (the host’s identification duty, 12 months). Server logs keep the IP address truncated, for 7 days.
Running together: your starting point
Your starting point is rounded to 250 m on your phone, nobody else sees it, and it is deleted 4 h after the run.
Kilomeet never receives your coordinates: only the number of a 250 m square, or a public landmark (a metro station, a park gate). Never an address.
It is used to choose a meeting point that is fair to everyone and to show you your warm-up; the other runners see the meeting point, the loop and a time rounded to 5 minutes, never your start (except a landmark you choose to show).
It is also deleted when you withdraw or the run is called off, and it is never backed up.
The map (“Show the map”, “Pick on the map”) comes from our own servers: no third-party map service sees where you run. A point you tap on the map is rounded to 250 m on your phone, like “Near me”.
Your answer (“I’m coming”, “I’m coming if…”, “maybe”) and the times you can do decide whether the run happens; the others see your first name and how many said maybe, never who.
In the last hour, buttons (“I’m leaving”, “5 min late”, “At the meeting point”): no GPS, no position. Only the run’s runners see your first name and your button, deleted 4 h after the run; “At the meeting point” is kept as a time only.
After the run, “We ran together” counts runs done together. No rating, no score, no no-show counter.
Required data
Your email is needed to create an account and sign in (contract): without it, there is no account. Your first name and your confirmation that you are 18 or older are needed to sign up for a run: without them, sign-up is not possible. Everything else is optional and marked as such.
No automated decisions
Kilomeet takes no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, and does no profiling. A waitlist follows the order of sign-up, set by the club.
Who receives your data
We neither sell nor rent any data. Our providers (hosting, backups, email, payment) act only on our instructions; their list, with the independent recipients and the providers that receive no personal data, is on the sub-processors page.
Artificial-intelligence tools and coding agents never receive production personal data.
Transfers outside the European Union
The service is hosted in the EU, in Germany. Only the storage of our backups (encrypted before upload and kept in Ireland, by a provider whose parent company is in the United States: EU–US Data Privacy Framework and standard contractual clauses) and, if you turn notifications on, your browser’s push service may involve a transfer outside the EU; details are on the sub-processors page.
Other retention rules
Each processing’s retention period is in the list above. These rules come on top:
Inactive account: with no sign-in and no sign-up for 24 months, an email warns you at 23 months, then the account is deleted.
Server technical logs: 7 days, with the IP address truncated.
Backups, encrypted before upload: the database can be restored to any moment of the last 14 days; the files (club logos) are kept as 14 daily, 8 weekly and 6 monthly copies. A deleted account is deleted again after any restore.
Security
Encrypted connections (HTTPS), password-free sign-in with one-time codes, each club’s data partitioned in the database, encrypted backups, access limited to the founder. If a data breach creates a risk, we notify the CNIL within 72 hours and, if the risk is high, the people concerned.
Your rights
Access and portability: “Download my data” in your settings produces an archive of all your data.
Rectification: edit your profile; the club edits membership details.
Erasure: “Delete my account” locks the account at once and deletes it after 30 days; your past attendance becomes anonymous.
Restriction and objection: notification settings, the “hide me from rosters” option, or a written request.
Withdrawing consent: at any time, as easily as it was given.
Instructions on what happens to your data after your death (French Data Protection Act, art. 85).
For any other request, write to privacy@kilomeet.com: we check your identity with a code sent by email and answer within one month. A request about a club’s data is handled on the club’s behalf, or forwarded to it within 5 working days.
You may lodge a complaint with the CNIL: cnil.fr/fr/plaintes.
Minors
Kilomeet is for people aged 18 and over for now. An account reported as a minor’s is deleted.
Changes
Each version has a number and a date. If an important change affects you, we tell you by email before it applies.