yatotes

Privacy

Last updated 18 September 2026

yatotes is a small, invite-only site for runners, run by one person. This page says what it collects, who can see it, how long it is kept, and how to get rid of it. It describes what the software actually does today rather than everything it might one day be allowed to do.

Who runs this

yatotes is operated by Cody Elder. For anything on this page — a question, a correction, or a request to delete your data — write to privacy@yatotes.com.

Who can use it

Accounts are invite-only and restricted to adults of 18 or over. They are not available in the European Economic Area: the EU member states plus Norway, Iceland and Liechtenstein. That restriction is not a formality — this site does not yet have the processes GDPR requires, so rather than pretend otherwise it turns those visitors away. If you reach yatotes from one of those countries you are sent to a page explaining it and no account is created. The United Kingdom is not blocked, although UK law is substantially the same. That is a deliberate choice rather than an oversight, and it means a UK visitor with an invite can sign up today.

The block stops new accounts. It does not lock you out of an account you already have. If you signed up before moving, or while travelling, you can still sign in from a blocked country and reach your profile, your account settings and your privacy settings — the pages where you can see what is held, correct it, sign other devices out, and turn analytics off. The rest of the site is closed to you, and you will be sent back to the notice page if you try it. This is deliberate: refusing to let someone reach their own data would not reduce what is held about them, it would just stop them doing anything about it.

Reading a tracker page is different. Anyone with a link can open one, post a cheer or a photo, and be counted as a visitor, with no account, no invite and no age check. What that involves is described below.

What is collected if you have an account

Your identity. You sign in with Google, and yatotes stores the email address that returns, plus whatever you choose to add: a display name, username, photo, bio, home city, time zone, date of birth and gender. The date of birth exists to enforce the 18+ rule and to age-grade results; the rest is yours to leave blank.
What you record. Races you save or mark as registered, planned and completed workouts, times and results you claim as yours, and anything you write in a post, comment or direct message.
Who you connect with. Friends, crews, and the messages between you.
Who you are watching.If you open someone's tracking link while signed in, that is recorded against your account so the tracker can show you them next time.
How you use the site. Which pages and features you interact with, recorded against your account to improve what the site suggests. You can switch this off under Profile → Privacy; when you do, the browser stops sending these events, the server drops any that arrive anyway, and you are excluded from the analysis built on them. That switch covers yatotes' own usage events. It does not turn off the pageview counters described under Who it is shared with, which run for everybody.

What is collected if you do not

Most of the writing on a tracker page comes from people with no account, so this matters.

Which runners you are watching. Opening a tracking link stores that link in your browser for sixty days, so the page can show you the same runners when you come back. It holds up to twelve of them. Clearing your cookies ends it.
A token derived from your network address is stored with every cheer and every photo you post. It exists to stop one person flooding a page. It is a one-way hash mixed with a secret the site keeps and cannot be turned back into your address.
The waitlist. If you ask for an invite from the home page, the name, email address, phone number and notes you type are stored until someone deals with them.

Live race tracking, and the watch

This is the part that collects the most sensitive thing on the site, so it is spelled out in full. It only happens if you opt in to a specific race, and it is off until you do.

Your position during a race. If you connect a Garmin watch and start the activity, the watch records your latitude and longitude about every five minutes and sends them, through your phone, to yatotes. Positions are stored with the time they were taken. They are not continuous: it is a point every few minutes, not a trace of your every step.
Which watch. An identifier the watch generates for this app. It is specific to this app on that watch and is not a serial number or anything Garmin can be asked to link back to you.
Your watch code. A short code you type into the watch so it can prove it is yours. Only a one-way hash of it is stored, which is why it can be shown to you exactly once and never again.
Who can see it.Whoever holds the link you share. A tracking link is a long random string, unguessable in practice, but anyone you send it to can forward it, and there is no way to un-send one. Treat it as public. Some trackers are deliberately open to anyone with the race's address.
When it stops. When you stop and save the activity, or withdraw from the tracker. Withdrawing deletes the positions your watch sent. If crew have typed positions for you at an aid station, withdrawing is refused until they remove those first — the tracker will tell you so, and you can write to the address above if you cannot reach them.

Cheers, photos and visits on a tracker page

Cheers. Anyone with the link can post a short message and a name. These are public on the page, and they are delivered to the watches of runners on that tracker, where they appear on the wrist and buzz. Cheers are not addressed to one runner: every watch on the tracker receives every cheer. Do not put anything private in one.
Photos. Anyone with the link can post a photo to a tracker. It is public on the page and also public at its own web address — unlisted rather than protected, so anyone you give it to keeps it, and it does not stop working when the photo comes off the page. Photos posted from September 2026 onwards sit at an address containing 128 bits of randomness, so it cannot be guessed or worked out from the race. A handful of older imported photos are at a simpler address that could be. Either way, do not post a photo you would mind a stranger finding.
Counting spectators. A tracker page counts how many people are looking, including people with no account. Rather than store who you are, the site derives a one-way fingerprint from your network address, browser and the race, mixed with a secret it keeps. It cannot be reversed into your address, and the same person on the same race is counted once. Alongside it the site keeps the approximate city, region and country your network address suggests. yatotes does not work that out itself: Vercel, which serves the site, looks it up and puts the answer on the request before any of this code runs. Whoever is running the tracker can see a table of those places; nobody is shown your address. None of this is recorded at all if you are in one of the blocked countries — the visit is not counted, and a cheer or photo sent from there is refused rather than stored.

One thing is deliberately not refused from a blocked country, and it is the most sensitive thing here, so it should not be buried: a watch that is already enrolled keeps sending its runner's positions, wherever the race is. Cutting that off by the address the phone happens to be using would break tracking mid-race for someone who asked for it and whose family are watching, and it would cut off an American running in the Alps while doing nothing about a European running in America. Enrolment is the place that decision belongs, and it is blocked. A runner who wants it to stop can withdraw from the tracker, which deletes the positions their watch sent.

Cookies

Cookies here do one of three jobs, and none of them is advertising. Every one is set by yatotes itself, is marked so that scripts on the page cannot read it, and is sent only to this site.

Signing you in.A session cookie keeps you signed in for thirty days. Around it sit several smaller ones: the handshake cookies the sign-in itself needs, which are gone in minutes; an invite code, held ten minutes; the birth date you typed at the age gate, held thirty minutes and then discarded, with a separate cookie recording that you passed so you are not asked again for about thirteen months; a note that you are newly signed up, so the site offers you onboarding once, which dies after a week; and, if you arrived by somebody else's referral link, their username, kept for thirty days so they get the credit.
Remembering a tracker. If you open a tracking link without an account, a cookie records which runners you followed so the page can show you them next time. It lasts sixty days and holds nothing but those links. A crew member who opens a crew link gets a similar one lasting thirty days, which is what lets them type in positions without an account.
Counting. If you are signed in and have not opted out, a cookie holds a random id for thirty days so that the usage events described above can be grouped into sittings rather than counted as strangers. It is a random number, means nothing outside yatotes, and is never created for signed-out visitors or for anyone who has turned analytics off. Separately, if you answer a survey a cookie remembers for a year that you already did.

Nobody sets an advertising cookie here and nothing follows you to another site, which is why there is no banner asking you about them. Clearing your cookies signs you out and forgets which runners you were watching; nothing else is lost.

What is not collected

No advertising, no ad networks, no selling anything to anybody.
No payment details — the site takes no money, so there is nothing to store.
No continuous background location. The watch only records inside an activity you start.

Who it is shared with

Other people on yatotes see what you choose to make visible, and whoever holds a tracking or share link sees what that link is for. Nothing is sold, and nothing is handed to anyone else except where the law requires it. Beyond that, the site is built out of other people's services, and being vague about which ones would defeat the point of this page.

Vercel hosts the site. Every request passes through it, including someone opening a tracker page with no account, so it sees network addresses and which pages were asked for. It is also what works out the approximate city described above.
Supabase holds the database and the stored files. Everything on this page that is kept at all is kept there.
Google, for sign-in, and only for sign-in. Until September 2026 the race-tracker pages also fetched their typefaces from Google Fonts, which told Google the address of every spectator watching a race. Those typefaces are now served from yatotes itself and no page asks Google for anything.
Pageview counting.Three scripts count pageviews across the site: Plausible, which counts without a cookie, and Vercel's Web Analytics and Speed Insights, which record which pages load and how fast. They see your address and browser. None builds a profile of you and none is an ad network — but they are third-party companies, and an earlier version of this page wrongly said there were none at all.
Where those three are loaded from, because it decides whether your own blocker can stop them. Plausible is fetched from plausible.io, so anything that blocks third-party requests blocks it and you simply go uncounted. Vercel's two are different: they are served from yatotes' own address, under a path beginning /_vercel/. The data still goes to Vercel, but the request does not look like a third-party one and most blockers will not stop it. That is how the library ships rather than something set up here, and saying so seems better than leaving you to find out.
Not on this page. None of those three run on this page, on the terms page, or on the notice shown to visitors from blocked countries. Nor on the sign-in page, or on the profile, account and privacy settings pages — the rest of what someone turned away at the border can reach. Running analytics on the people the site has just told it cannot lawfully handle their data would be indefensible, so none of those pages is measured, for anybody. The exception is honest but narrow: if you were already browsing yatotes and clicked through to here, scripts loaded by the previous page are still in your browser and keep counting. Opening this page directly loads none.
Map tiles. Most maps on the site are drawn by Mapbox, fetched by your browser, so Mapbox sees your address and which piece of map you are looking at. Searching for a meeting point sends what you typed to Mapbox to turn into a place. Mapbox's own reporting is turned down as far as it can be — the setting that would have sent it your graphics card, screen density and connection type is switched off at every map on the site — but it cannot be turned off entirely: it still reports that a map loaded, and it keeps a rotating anonymous identifier in your browser's storage. The race-tracker map instead uses tiles from the US Geological Survey and OpenTopoMap, which see your address and roughly where the race is. Snapping a drawn course to real paths sends those coordinates to a public routing service run by FOSSGIS.
Terra, if you connect a Garmin or Wahoo account for your training history. That connection does not go to Garmin directly: you sign in on a page Terra hosts, yatotes gives Terra an internal id so it knows whose workouts to send back, and Terra holds that training data too. This is separate from race-day tracking, which goes from the watch to yatotes with nobody in between.
Strava, if you connect it. The connection asks for permission to read your activities including private ones, and stores the ones you bring across. Separately, any page showing an embedded Strava activity loads it from Strava, so Strava sees the address of whoever is looking.
Sanity stores the blog posts and nothing about you. Its images are fetched by the server rather than your browser, so it never sees your address. The same is true of profile photos from Google.
Notifications, if you turn them on, are delivered through whichever push service your browser nominates — Google's for Chrome, Apple's for Safari, Mozilla's for Firefox. The text of a notification passes through them. There is no separate notifications company involved.

How long it is kept

Plainly: nothing on this site expires on its own. There is no job that deletes old positions, visits, cheers, photos or usage events, so assume everything described here is kept until somebody removes it. Your account and what you have recorded are kept until you ask for them to be deleted. Withdrawing from a tracker deletes the positions your watch sent, subject to the exception above. Cheers and photos belong to the tracker and can be removed by the people running it, though removing a photo is not retried if the storage delete fails, so on rare occasions its direct address can keep working after it has gone from the page — write to the address above if that matters. There is one deliberate version of the same thing: if an upload half-fails in a way that leaves the site unsure whether the photo was recorded, it keeps the file rather than risk deleting one that is still in use. Such a file is attached to no race, appears on no page, and is not reachable by any delete button, so it can only be cleared by hand. Backups are kept off-site on a rolling schedule and age out, so deleted data can persist in a backup for a short time after it is gone from the site.

Getting your data, or getting rid of it

Email privacy@yatotes.com and ask. You can have a copy of what is held about you, have mistakes corrected, or have the account and its contents deleted. There is no automated button for account deletion yet, so this is done by hand — which also means you can ask for part of it rather than all of it. Some things you can already do yourself: withdraw from a tracker to delete your positions, turn off usage analytics, change what your profile shows, and clear your cookies to forget which runners you were watching.

Security, honestly stated

Traffic is encrypted, secrets are held outside the code, tracking links are long random strings, and the watch authenticates with a credential only it and the server know. This is a site run by one person, not a company with a security team, and it should be judged that way. Do not put anything on it you would be harmed by losing.

Children

yatotes is for adults. Accounts require you to be 18 or over, and anyone who declares otherwise at sign-up is turned away. Reading a tracker page is not gated that way, because it cannot be without an account. If you believe a child has an account, write to the address above and it will be removed.

Changes

If this page changes in a way that matters, the date at the top changes with it and anyone with an account is told. Small corrections and clarifications happen without ceremony.