Privacy policy

The “Freak Race” app and the website freakrace.com are operated by “VŠĮ TORA events,” legal entity code 307394611, located at Savanorių pr. 224-44a, Vilnius, email: info@freakrace.com.

We are the controller of your personal data. This means that we determine what data is collected and how it is used, and we are responsible for its security.

If you have any questions about this policy or would like to exercise your rights, please contact us at info@freakrace.com.

Account Information

When you create an account, we store your first name, last name, email address, and selected language. We do not see or store your password—it is managed by the Google Firebase Authentication service.

Contact and Payment Information

If you provide it, we store your phone number.

In your account, these two fields are stored separately from the rest of your account and are accessible only to you and the administrator. It’s important to know that when you register for an event, a copy of this information is included in the registration record, which is also visible to the event organizer—see Section 6.

Participation Data

When you register for and participate in an event, we store the following information: which event and in which city you are participating, your chosen mode of transportation, the event’s start and end times, your answers to the tasks, and your performance evaluations.

The start and end times of the event are determined by the server, not your phone, to ensure that all participants are subject to the same reliable timing based on the specific conditions of the event.

Photos

The app requests access to the camera for two purposes: to take a photo when registering for the event (a selfie) and to take photos of you completing tasks during the event.

Photos are taken only directly with the camera—you cannot select existing photos from your gallery. This is a deliberate decision to ensure that task results are verified and evaluated under uniform conditions.

Payment Information

When you pay the participant fee, we store the amount, currency, payment status, invoice number, and the buyer’s name and email address.

If you request an invoice in the company’s name, we also store the company name, registration number, VAT ID, and address.

We do not receive or store payment card information. This information is processed by Stripe, the payment service provider to which you enter your card details directly.

Sponsorship Inquiries

The website features a sponsorship proposal form. When you fill it out, we store the company name, company ID, email address, phone number, and the text of your message. No account is required. We use this data solely to contact you regarding a partnership.

Technical Data

When the app crashes, a crash report is automatically generated: device model, operating system and app version, and the location of the error in the code. This helps us find and fix the error.

Data on Your Device

The app stores the status of unfinished events on your phone (answers you’ve entered but haven’t sent yet) and copies of downloaded images so that screens load faster. This data remains on your phone and is deleted when you uninstall the app.

In the interest of transparency, it’s worth mentioning what we don’t do:

• We don’t track your location. The app doesn’t ask for GPS permission. You choose the city yourself from a list.

• We don’t collect advertising identifiers and don’t have any ad networks.

• We do not track your browsing activity outside the app.

• We do not use usage analytics—we do not record which screens you open or when.

• We do not sell your data to anyone under any circumstances.

For each purpose, we specify the legal basis in accordance with Article 6 of the GDPR:

• To create an account and allow you to log in — performance of a contract.
• To register for and participate in an event — performance of a contract.
• To determine results and compile rankings — performance of a contract.
• To issue invoices and for accounting purposes — legal obligation.
• To send emails related to the event and payment—performance of a contract.
• To respond to a sponsor’s inquiry—legitimate interest.
• To correct errors and ensure system security—legitimate interest.
• To prevent fraud and unfair participation—legitimate interest.

We only send emails related to your actions: payment confirmation, invoices, refund confirmation, and a password reset link when you request one.

Promotional emails are sent only when there is a valid legal basis for doing so and, when consent is required under applicable law, such consent has been obtained.

This is important, and we want to be clear about it.

In the event results table, other logged-in participants can see your first name, last name, city, mode of transportation, participation times, result ratings, and which tasks you completed.

The table does not include your email address, phone number, bank account, photos, or the content of your answers—it only shows that you answered a task, not what you answered. The table is visible only to logged-in app users; it is not available on the public website.

If you do not want your name to be visible to others, you will not be able to participate in the event—the results table is part of the evaluation and presentation of results for that specific event.

The event organizer can only view the information of participants in their own event: first name, last name, email address, phone number, bank account number, registration and payment status, results, profile photo, and photos uploaded for tasks.

Bank account information is available to the event organizer only when it is necessary to manage and process payments for participants of a specific event in accordance with the event’s terms and conditions.

The organizer cannot view participants from other events—neither their lists nor individual entries.

The administrator has access to all data managed in the system, as it is necessary for system maintenance, dispute resolution, and accounting.

We use services that process data on our behalf:

• Google (Firebase) — services for authentication, databases, file storage, server functions, and error reporting.
• Stripe — payment processing. With regard to card data, Stripe is an independent data controller.
• UAB “Interneto vizija” — email delivery server.
• DeepL — translation of event descriptions. Only the event text written by the organizer is transmitted: title, description, and task requirements. No participant data is included.

We do not transfer data to anyone else, except when required by law or law enforcement.

The website freakrace.com does not use tracking cookies, does not use analytics, and does not place advertising trackers. There is no consent window because there is nothing to consent to.

The database and your records are stored in the European Union—at a Google data center in Poland (europe-central2).

Some processing takes place in the United States. Server functions that process payments, generate invoices, send emails, and calculate results operate on Google’s infrastructure in the U.S. Error reports are also sent there.

This transfer is governed by the Standard Contractual Clauses approved by the European Commission and the EU–US Data Privacy Framework, to which Google is a signatory.

• Account data — as long as you have an account.
• Registration and results — 3 years after the event.
• Selfies and photos from challenges — 1 year after the event.
• Invoices and accounting documents — 10 years (legal obligation).
• Sponsor inquiries — 2 years from receipt.
• Glitch reports — 90 days.

When an account is deleted, the data is removed within 30 days. Only data that we are legally required to retain—primarily accounting documents—is kept for a longer period.

Under the GDPR, you have the right to:

• know what data we hold about you and receive a copy of it;

• correct inaccurate data;

• delete your data (“the right to be forgotten”);

• to restrict the processing of your data;

• to transfer your data to another service provider;

• to object to processing based on our legitimate interests.

To exercise any of these rights, please contact us at info@freakrace.com. We will respond within 30 days.

If you believe we are processing your data unlawfully, you have the right to file a complaint with the State Data Protection Inspectorate (vdai.lrv.lt).

This app is intended for individuals 18 years of age or older. We do not intentionally create accounts for individuals under 18 years of age.

If we learn that an account has been created by someone under 18, we will delete it.

If we allow individuals under the age of 18 to participate in the future, we will apply separate rules regarding the protection of minors’ data and their participation.

The program calculates the ranking of results in the table based on a set of criteria that are the same for everyone: the number of correctly completed tasks, the number of uploaded photos, and the time taken.

This is not an automated decision that gives rise to legal effects within the meaning of Article 22 of the GDPR: the assessment of the tasks is made by a person—the event organizer—after reviewing your answers and photos. If you disagree with the evaluation, you can contact us at info@freakrace.com

Data is transmitted over an encrypted connection and stored on Google's infrastructure. Access is restricted by server-side rules: each user sees only what they are authorized to see, and there is no way to bypass this restriction from within the app.

The most sensitive account fields—phone number and bank account—are stored separately from the rest of the account so that they cannot be viewed by those who only need to see the list of names.

If we change this policy, we will publish the new version here and update the effective date. In the event of significant changes, we will notify you by email.

The Platform’s Role

“Freak Race” functions as a technical platform that connects participants with event organizers. “Freak Race” is not the organizer of any specific orienteering competitions, challenges, or other events, unless this is explicitly stated in the description of a specific event.

Organizers’ Independence

Each specific event is organized by separate third-party organizers. All decisions regarding the event’s proceedings, rules, safety measures, results, rankings, and other matters are the sole responsibility of the organizer of that specific event.

Limitation of Liability

“Freak Race” assumes no direct or indirect liability for the actions, omissions, quality, safety, or failure to fulfill obligations on the part of the event organizer.

All claims regarding a specific event must be addressed directly to the organizer of that event. The “Freak Race” team may act as an intermediary by forwarding your inquiry to the event organizer.

Participant’s Agreement

By participating in the event, the participant confirms that they understand that the organizer of the specific event, and not the platform operator, is responsible for the organization and conduct of the event.

info@freakrace.com

Platform – The FREAK RACE website and mobile app.

Event – A real-world orienteering competition or challenge held on the FREAK RACE platform.

Organizer – The person or organization that organizes a specific event and sets the event’s rules, tasks, and procedures for evaluation and determining results.

Participant – a person who has registered and is participating in a specific event.

Result – the score of a participant or team calculated according to criteria predetermined for a specific event.

Ranking—the order in which participants or teams are listed based on their results.