Privacy Policy / 隐私政策
SU 2026 Year End Gala · Last updated: October 9, 2026
This policy describes how the Seattle United Runners Gala registration application handles information for event registration, payments, registration management, and related emails.
Information we collect
We collect the contact email address, participant names, and whether each participant is age six or under. We do not request a child's exact birth date. Optional annual review information includes SU volunteering, official races, first-time races, marathon or half-marathon results, and first BQ or six-star medal milestones. Organizers use these responses for annual event review and recognition; they are not included in the public summary. Registration records include registration identifiers, payment amounts and status, and timestamps. Transfers record the previous and new holder names and email addresses and update the participant name and ownership. Registration management stores hashed verification codes and session tokens, their expiration times, and verification attempts.
PayPal processes payments. Our application stores PayPal order and capture identifiers and payment confirmation information; it does not collect or store payment card numbers or PayPal passwords. Hosting and service providers may process technical information such as IP addresses and request logs to operate and protect their services.
How we use information
We use this information to register guests, calculate fees, confirm payments, send registration confirmations and verification codes, authenticate registration owners, process transfers, and resolve event or payment issues. The public homepage displays registration creator names, using the first participant entered for each confirmed registration, and aggregate participant and child counts. Other guest names and contact email addresses are not included in the public summary.
Email verification and delivery
To manage or transfer a place, enter the owner email and verify a six-digit code delivered to that mailbox. Cloudflare stores a hash of the code, its expiry and attempts, and creates a one-hour session after successful verification. No Google account or Google OAuth authorization is required from attendees.
The organizer authorizes a Google Apps Script to send verification codes, registration confirmations, and transfer notifications from the organizer's account using MailApp. Recipient email addresses and message contents are transmitted from our backend to Google Apps Script for delivery. The script validates signed requests and temporarily stores request identifiers to prevent replay; it does not store message bodies as application records. Google may retain delivered messages and operational information under its policies. The application does not read attendees' inboxes.
Only the organizer grants mail-sending authorization. Attendees do not grant access to their Google accounts. Firebase Authentication and Resend are no longer used by this application. Previously created Firebase accounts or provider records may remain until the organizer handles their deletion.
Sharing and service providers
Event organizers may access registration information to operate the Gala and provide support. Cloudflare hosts the application and database, Google Apps Script delivers email, and PayPal processes payments. A transfer notification shares the relevant participant names with the original owner and the new owner. We do not sell personal information or use it for targeted advertising. Information may also be disclosed when required by law.
Service providers handle information under their own policies: Cloudflare, Google, and PayPal. The venue link opens Google Maps, which is subject to Google's policies.
Storage, security, and retention
Registration and payment records are stored in the application's Cloudflare D1 database. Registration management uses an HTTP-only, Secure session cookie. Verification codes expire after ten minutes and management sessions after one hour. Expiration prevents further use; it does not guarantee immediate deletion of all stored records.
The application does not currently apply an automatic deletion schedule to event records. Organizers retain records for event administration, payment reconciliation, support, and applicable recordkeeping needs, and handle deletion requests as described below. Emails already delivered and provider backups or records may have separate retention periods.
Your choices and contact
You may request access, correction, or deletion of your registration information by replying to a Gala confirmation, verification, or transfer email sent by the organizer. Include your registration number if available. If you have not received an email, contact the Seattle United Runners Gala organizer through the channel used to invite you to the event.
We may need to verify ownership before changing or deleting information. Records needed for payment reconciliation or legal obligations may need to be retained. Please submit children's information only as their parent, guardian, or with appropriate authorization.
Policy updates
We may update this page to reflect changes to the application or its data practices. The date above indicates the latest revision.