What we collect, and why
Last updated 2026-10-26 · Controller: Patrick Chen, trading as Sublimearts.io, Milano, Italy
PENDING LEGAL REVIEW
This reflects our real, current intent, but hasn't had a professional legal review yet. Questions in the meantime: reach out and we'll answer directly.
WHAT WE STORE
| Your email address | To identify your account and contact you: sign-in codes, notes about your rocket or a race you won, and one summary email a week (Mondays, see below). |
| Your sign-in provider ID | If you sign in with X or Google, so we can recognise you next time. We never receive your password. |
| Your rocket's content | Name, tagline, description, URL, and anything you add to a profile page. This is public by design. |
| Votes you cast (fuel) | Which rocket, which week. Needed to enforce one vote per rocket per week and to compute standings. |
| A hashed IP address per vote | A one-way HMAC, never the raw address. Used only to detect vote manipulation before a win stands. |
| A daily click count per rocket | When someone clicks the link to a rocket's own site we add 1 to that rocket's count for the day, so its owner can see how many visits runs.space sent. To count one browser once a day we keep a one-way hash of its IP address and browser that changes every day and is deleted after two days. It is never linked to a person or an account. |
| A winner's story | If your rocket wins a week and you choose to write one: five short answers, public only once you publish them, which you can unpublish at any time. We may hide one that breaks the rules. |
| A blessing and where it went | A weekly winner may give one fuel worth 5 to another maker's young rocket. Unlike every other fuel, that one is not anonymous: the record keeps which winning rocket gave it and which rocket received it, and the receiving maker is shown who blessed them. |
| Waitlist handle or email | If you joined the waitlist. Used to tell you when a race opens and to send the weekly summary email. |
| Badge referrer domain | If you install the badge, we record that a request came from your own domain, to verify the badge is live. |
| An analytics identifier | Set by Google Analytics on your first visit, so repeat visits can be told apart in aggregate traffic reports. Not linked to your account or anything you enter. |
WHAT WE DON'T DO
- We don't sell your data.
- We don't store raw IP addresses against your votes — only a one-way hash.
- We don't run advertising trackers or third-party ad pixels.
- We don't send marketing. The one recurring email is the weekly summary described below, and every copy has an unsubscribe link.
ONE ACCOUNT, TWO SITES
runs.space and its sister site runs-this.today (the Atlas, a hand-listed directory of what people are running) are run by the same person on the same database, so one account signs in on both. This site can see, read-only, which products are listed there, whether a listing is claimed and whether its address answered the weekly check (all of it already public on the Atlas), and the Atlas reads this site's public race standings. Nothing is copied from one site to the other unless you ask for it. The Atlas has its own privacy page.
THE WEEKLY EMAIL
Every Monday this site sends one summary email to each account and to each waitlist address: how the race went last week; for accounts, a few young rockets that could use a fuel; and, if you have rockets here or a profile on the Atlas, what is true about them (for a listing: whether it answered our weekly check, whether it is racing here, and the one thing worth doing next). It is the only recurring email and nobody gets a second one. Every copy has an unsubscribe link that works at once; sign-in codes and notes about your own rocket are separate and still come through.
WHO PROCESSES IT
We use a small number of providers, each only for what it says:
- Supabase — database and authentication
- Vercel — hosting
- Google Analytics — aggregate traffic and referrer reporting
- Resend — sending email (sign-in codes, notes about your rocket, the weekly summary)
- Cloudflare Turnstile — bot protection on sign-in
- Stripe — payments, if you buy something. Card details go to Stripe and never reach us.
If you embed a video on a profile page, that video is served by YouTube, Loom, or Vimeo, and those services will see the visitor's request.
HOW LONG
Account and rocket data is kept while your account exists. Votes and race results are kept indefinitely, because a finished race is a permanent public record — that is the “nothing dies” premise of the site. Hashed vote IPs are kept for 12 months and then deleted.
YOUR RIGHTS
Email hello@sublimearts.io to get a copy of your data, correct it, or delete your account. We'll action deletion requests within 30 days.
Deleting your account removes your rocket from the track. Historical race results may retain the rocket name where removing it would falsify a published result; tell us if that's a problem for you and we'll discuss it rather than refuse.
If a listing describes your project and you didn't create it — a reserved pad — email us and we will remove it without argument.
As an Italy-based controller, we're subject to the GDPR regardless of where you're visiting from. Depending on where you live you may also have rights under the UK GDPR or CCPA, including the right to complain to your own data protection authority — this section still awaits professional legal review for completeness.
See also Terms and Contest rules.