Privacy Policy

Last updated: 21 September 2026

This site records laps run by students taking part in the running club at Sundance Elementary School, part of the Poway Unified School District. It exists so that laps counted on a field can be totalled, turned into the charms students earn, and reported back to their teachers.

It is not a commercial service. There is no advertising on it, nothing is sold, and no information collected here is used for any purpose other than running the club.

Who this is for

There are two quite different groups of people in this policy, and it is worth being clear about which is which.

Students do not have accounts and cannot sign in. Their information is entered by the school from its own class roster, and they appear here only as a name, a class, and a number of laps.

Adults — the staff and volunteers who run the club — have accounts, sign in, and use the admin area.

What is recorded about students

• First name, last name, class teacher and grade, taken from the school's roster.
• A badge number, and a randomly generated code printed on the badge as a barcode. The code is meaningless on its own: it is a random identifier, not anything derived from the student.
• Each scan of that badge — the date and time, and which scanning device read it.
• The laps and charms that follow from those scans.

No addresses, dates of birth, photographs, contact details, health information or academic records are collected. Nothing about a student's household is collected.

On the public page. The front page of this site lists lap totals with a first name and a last initial only — "Cyril H", never "Cyril Hudson". Full names appear only to signed-in staff.

What is recorded about adults with accounts

• Name and email address.
• A password, if the account uses one. Passwords are stored only as a one-way hash and cannot be read back by anyone, including the people who run this site. An account may have no password at all, in which case it signs in with Google.
• Two-factor authentication settings, if enabled.
• Ordinary sign-in records: the browser session, and the time an account last signed in.

Signing in with Google

Where an account signs in with Google, this site asks Google only for the basic profile it offers at sign-in, and receives:

• the email address on the Google account, and whether Google has verified it;
• the name on the account;
• the account's Google identifier.

That information is used for one purpose: to match the Google account to an account that already exists on this site, and to sign that person in. Signing in with Google never creates an account here. Somebody whose address has no account is turned away.

The email address and Google identifier are stored so the same person is recognised next time. Nothing else from the Google account is stored.

This site does not request access to Gmail, Google Drive, Calendar, Contacts or any other Google service, and has no ability to read them. Google data obtained here is never sold, never used for advertising, never transferred to anyone else, and never used to train artificial intelligence or machine learning models.

Scanning devices

The phones and tablets used to scan badges are registered by name and hold an access token that lets them send scans. A device records what it scanned and when. It does not record location, does not photograph anyone, and the camera is used only to read the barcode in front of it — no image is stored or sent.

Cookies

This site sets a cookie to keep a signed-in person signed in, and one to protect forms against cross-site request forgery. There are no advertising cookies, no analytics cookies and no third-party trackers.

Who else sees this information

Student information is seen by the school staff and volunteers who run the club. It is not shared with anyone else, not sold, and not disclosed for advertising or marketing — by anyone, at any price.

Two service providers necessarily process information in the course of hosting the site:

• the company hosting the site and its database;
• Honeybadger, which records technical errors so faults can be found and fixed. An error report can incidentally include the web address being visited at the time.

Information may also be disclosed where the law requires it.

How long it is kept

Roster and lap information is kept for the school years the club has run, so that earlier seasons can still be reported on. A roster from a past year is archived rather than deleted, because the laps a student ran are part of the record of that year.

A school may ask for a student's information to be removed; see below.

Students' privacy

This site is operated by and for a school, and the student information on it comes from the school's own records. As a school record it is handled under the school district's obligations, including the Family Educational Rights and Privacy Act (FERPA). Parents and guardians have the rights the district's own privacy notice describes, including the right to see what is recorded about their child and to ask for it to be corrected or removed.

Requests about a particular student should go to the school, which can act on them here.

Changes to this policy

Any change will be posted on this page with a new date at the top. If a change materially affects how information is used, it will be announced to the staff and volunteers who use the site.

Contact

Questions about this policy, or requests about information held here, should go to the running club organisers at Sundance Elementary School:

Sundance Elementary School — Running Club Poway Unified School District 8944 Twin Trails Drive, San Diego, CA 92129 (858) 484-2950