Privacy Policy

This Privacy Policy explains how Xluma ("Xluma", "we", "us") collects, uses, shares, and protects your information when you use our race timing and results products, including:

• Xluma Live — the public results website (this site).
• Timekeeper — our mobile app (participant tracking, spectator viewing, and timekeeper modes).
• Timekeeper Watch Connect — our Garmin Connect IQ watch app that streams your GPS location during a race.

Xluma is operated by Sudip Bala. If you do not agree with this policy, please do not use the products.

1. Summary

• We collect your account details, your race registration data, and — only when you choose to be tracked — your GPS location during an event.
• We use this data to show live positions, leaderboards, splits, estimated finish times, and results.
• Race results (such as your name, bib number, category, times, and rank) are public by nature and are shown on leaderboards and results pages.
• We do not sell your personal data.
• You can stop location tracking at any time, disconnect optional services, and request deletion of your data.

2. Information we collect

a. Account information

When you create an Xluma account you provide your name, email address, and a password (stored only as a secure hash). If you sign in with Google, we receive your name and email address from Google to create or match your account.

b. Race registration and identity data

To link you to your entry in an event, we use your bib number together with the email or phone number that the event organizer imported with the registration list. We use these only to verify that an entry belongs to you and to prevent someone else from tracking under your bib.

c. Location (GPS) data

When you start tracking in the Timekeeper app or run the Timekeeper Watch Connect app, we collect GPS data: latitude, longitude, accuracy, speed, and a timestamp. Location is collected only while you have chosen to be tracked for an event and the app is active. It is used to show your live position, compute splits and pace, and estimate your finish time.

d. Device and technical data

We may collect limited device and technical information needed to run the service, such as battery level (used by the watch app to slow GPS sampling and save power), connectivity status, app version, device type, and — if you enable push notifications — a push notification token.

e. Timing and results data

For chip-timed and manually-timed events, the event organizer's timing equipment produces timing records (passings, splits, and finish times) associated with your bib. This data is processed to produce official and live results.

f. Optional connected services

If you choose to connect Strava, we use Strava's authorization (OAuth) to import the GPS stream of a finished activity so your race can be scored. We access this only with your explicit authorization and only for the activity relevant to your event. You can disconnect Strava at any time.

3. How we use your information

• Provide live tracking, maps, leaderboards, splits, pace, and estimated finish times.
• Produce and publish event results.
• Authenticate you and secure your account and bib.
• Send push notifications you have opted into (for example, when a runner you follow reaches a checkpoint).
• Operate, maintain, debug, and improve the products.
• Comply with legal obligations and enforce our Terms.

4. Public display of race results

Xluma is a race results platform, so certain information is public by design. Your name, bib number, category, gender category (where used for ranking), times, splits, and rank may be displayed on public leaderboards and results pages, and your live position may appear on the event map while the event is in progress. Do not register to be tracked if you do not want this information shown for the event.

5. Timekeeper Watch Connect (Garmin) app

The Timekeeper Watch Connect app runs on your Garmin device and uses the device's positioning and communications capabilities to stream your GPS location (latitude, longitude, accuracy, speed, timestamp) directly to Xluma's servers during a race. Key points:

• Location is collected only while the app is open and running during your race. Closing the app stops collection.
• The app pairs to your event entry using a one-time code shown on the watch that you enter into the Timekeeper app. A pairing token is stored on the watch to authorize uploads.
• Your location data is sent to Xluma's servers only. We do not send your Xluma data back to Garmin, and we do not access other data on your Garmin device or your Garmin Connect account.
• You can stop at any time by closing the app, and you can unlink the watch by re-pairing or contacting support.

6. How we share information

We do not sell your personal data. We share data with service providers (processors) who help us run the products, and with event organizers, as described below:

We may also disclose information if required by law, to protect our rights or users' safety, or in connection with a business transfer. Public results are visible to anyone who visits the results pages.

7. Location permissions and how to turn it off

The Timekeeper app requests location permission (including background or "always" permission, so tracking continues while your screen is off during a race) and notification permission. The watch app uses the Garmin device's positioning permission. You can:

• Decline or revoke location permission in your device settings (tracking will stop).
• Leave a race in the Timekeeper app to stop tracking and remove the race from the device.
• Close the Timekeeper Watch Connect app on the watch to stop GPS streaming.
• Turn off push notifications in your device settings.

8. Data retention

We keep account data for as long as your account is active. Race results are generally retained as a lasting public record of the event. Raw GPS track points are retained to support live tracking and results and may be removed or anonymized on request, except where we must keep them to maintain the integrity of official results or to meet legal obligations. When data is no longer needed, we delete or anonymize it.

9. Your rights and choices

Depending on where you live (for example, under GDPR or CCPA/CPRA), you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can exercise these rights — including deleting your account and data — as described on our Data & Account Deletion page, or by contacting us at privacy@xluma.live. We will not discriminate against you for exercising these rights.

10. Security

We protect data in transit using encryption (HTTPS/TLS), store passwords only as secure hashes, and use access tokens and role-based access controls. No method of transmission or storage is perfectly secure, but we work to protect your information and limit access to it.

11. Children's privacy

Our products are not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, contact us and we will delete it. Where an event includes minors, the entry is managed by the organizer and/or a parent or guardian.

12. International data transfers

We may process and store data in countries other than the one where you live. Where required, we use appropriate safeguards for international transfers of personal data.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, where appropriate, provide additional notice. Continued use of the products after changes take effect means you accept the updated policy.

14. Contact us

For privacy questions or requests, contact us at privacy@xluma.live. See also our Support page and our Terms of Service.