Privacy

You can browse Duwamu without an account and without being tracked. We collect personal information only when you sign in as an organiser or send us a form, and we use it only to run the service.

• Accounts (optional): your email address to sign you in, plus any profile details you add. Profiles are private unless you make them public.
• Registering for a free run: your name and email, and anything the organiser asks for (phone number, T-shirt size, answers to their questions, an emergency contact). The organiser’s team sees these to run the event.
• Check-ins: when an organiser checks you in, we record that you attended. Verified attendance builds your running history, XP and achievements.
• Club and event details you enter. Contact details you put in the public fields (public email, phone, links) are shown on your profile. That’s why they’re labelled public.
• Inquiry, contact and report forms: what you type, including your name and email if you give them.
• Abuse protection: a one-way hash of your IP address, kept for up to two days to limit spam on public forms. We don’t store raw IP addresses in our database.

Saved runs are kept in your browser’s local storage and never sent to us. Signed-in users get session cookies so they stay signed in. We don’t use advertising or analytics cookies.

Our database, sign-in and image storage run on Supabase. The website is served by our hosting provider. These providers process data on our behalf to run Duwamu. We don’t sell personal information or share it with advertisers.

When you follow a link to an organiser’s registration page, WhatsApp group or Strava club, their own privacy terms apply.

• Emergency contacts: deleted 7 days after the run.
• Phone numbers, T-shirt sizes and answers to organiser questions: removed 90 days after the run.
• Registrations made without an account: anonymised 12 months after the run.
• Unconfirmed registrations: deleted after 7 days.
• Your account, profile, attendance history and achievements: until you delete your account.
• Inquiries and reports: as long as needed to deal with them and keep a record of moderation decisions.

Signed in, you can download your data and delete your account yourself from Emails, data and account. Public profiles and leaderboards are off unless you switch them on, and reminder emails are opt-in.

You can also ask us to see, correct or delete the personal information we hold about you. Use the contact form and choose “Privacy or data request”.

We aim to follow Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 (as amended in 2025), as its provisions come into effect. Its main obligations apply from 1 January 2027.

We don’t collect GPS tracks, pace, medical information or location history, and we don’t sell data or use it for advertising.