Privacy Policy
Last updated: 13 August 2026
Checkpoint (“Checkpoint”, “we”, “us”, or “our”) is an orienteering platform operated by an individual based in Ontario, Canada. This policy explains what personal data we collect when you use the Checkpoint app, website, and commercial portal (together, the “Service”), why we collect it, and the rights you have over it. You can reach us at support@checkpointrun.com.
Who is responsible for your data
Section titled “Who is responsible for your data”The operator of Checkpoint is the data controller for personal data processed through the Service. For any privacy question or request, contact support@checkpointrun.com.
What we collect
Section titled “What we collect”Account data. When you register, we store your email address, a display name, and either a securely hashed password or, if you sign in with Google or Microsoft, an identifier and the email and name that provider shares with us. We never receive or store your Google or Microsoft password.
Content you create. Clubs, teams, events, courses, maps you upload, start and control locations, run results, and any GPS tracks recorded during a run. On the feedback board we store the ideas, votes, and comments you post, together with machine translations of them into the languages the Service supports (see “How your data is shared”).
Technical data. Basic server logs (IP address, browser type, timestamps, and pages requested) used to operate and secure the Service, plus a single essential sign-in cookie described below.
Cookies
Section titled “Cookies”We use one essential authentication cookie so you stay signed in across the app,
API, and portal (all subdomains of checkpointrun.com). It is strictly
necessary for the Service to function and is not used for advertising. We do not
use third-party advertising or cross-site tracking cookies.
How we use your data
Section titled “How we use your data”- To provide and operate the Service — authentication, building and running courses, recording results, and showing leaderboards.
- To send transactional email you request or that is essential to your account, such as password resets and event-related notifications.
- To maintain the security, integrity, and reliability of the Service.
- To understand and improve how the Service is used.
Legal bases
Section titled “Legal bases”Where the GDPR or similar laws apply, we rely on: performance of our contract with you (providing the Service); your consent (where we ask for it); our legitimate interests in operating, securing, and improving the Service; and compliance with legal obligations.
How your data is shared
Section titled “How your data is shared”We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract, to run the Service:
- Microsoft Azure — cloud hosting, database, and storage.
- Azure Communication Services — sending transactional email.
- Azure AI Translator — machine-translating what you post on the feedback board so other users can read it in their own language. Only the text of an idea or comment is sent; it is not used to train the provider’s models.
- Google / Microsoft — only if you choose to sign in with them.
- Google Workspace — hosts the mailbox behind our support and info addresses.
We may also disclose data where required by law or to protect the rights, safety, and security of our users or the Service.
International transfers
Section titled “International transfers”The Service is hosted on Microsoft Azure. Your data may be processed in the Azure region where the Service is deployed and by the providers listed above, which may be outside your country. We take reasonable steps to ensure such transfers are protected by appropriate safeguards.
How long we keep it
Section titled “How long we keep it”We keep your personal data for as long as your account is active. When you delete your account, or ask us to erase your data, we remove or anonymise your personal data except where we must retain it to meet a legal obligation.
Your rights
Section titled “Your rights”Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. Checkpoint gives you self-service tools for the most common of these:
- Export — download a copy of your data (including run tracks) from your account.
- Erase — delete your account and associated personal data from your account settings.
To exercise any other right, email support@checkpointrun.com. You also have the right to complain to a data-protection authority — in Canada, the Office of the Privacy Commissioner; in the EU/EEA, your local supervisory authority.
Security
Section titled “Security”We use industry-standard measures — encrypted connections (HTTPS), hashed passwords, and access controls — to protect your data. No online service can be completely secure, but we work to protect your information and to respond promptly to any incident.
Children
Section titled “Children”The Service is not directed to children under 13 (or under the minimum age required in your country). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
Changes to this policy
Section titled “Changes to this policy”We may update this policy from time to time. We will change the “last updated” date above and, for significant changes, provide a more prominent notice.
Contact
Section titled “Contact”Questions about this policy or your data: support@checkpointrun.com.