Privacy

Cailloux tracks runners in the mountains. That means names and GPS positions — so it is best to say plainly what is done with them.

Last updated: 17 October 2026 — the position read with the screen locked by the iPhone and Android apps; notifications that go through Apple and Google; OpenStreetMap maps, the QR code and the anonymous sign-in with Google; what a bug report keeps; encouragement from the public; deleting your account in the 1.2 app; your request to try the Android or iPhone app; the phone identifier of version 1.2 and of the iPhone app; impossible pebbles and check-ins, set aside; the version number of each app, recorded when your account signs in; and automatic enrolment in the test programme for an account created on the beta. On 7 October: your language, kept on your account. On 5 October: 1.1 is open to everyone: what was kept for the test versions — the Cupboard, the notebook, professional accounts, tracking the position during an SOS alert — joins the main lists. On 19 September: the GPS positions the app sends without you touching anything (the automatic pebble, and the SOS alert), a race going online by itself 24 hours before its start, organisers who submit a race sheet, the runner notebook, what a professional receives in addition, and the services that actually serve the site and send the emails. On 13 September: the confirmation of your email address, the 48-hour link when you change it, and the news question asked when you sign up. On 27 August: professional accounts, in full: the 2 doors, what a coach or a dietitian receives from a race opened to them, the 3 things never sent to them, why food reactions follow the nutrition strategy, and what that means for the runners in your race, who asked for none of it. Before that, on 23 August: the full inventory re-checked field by field against the code, last sign-in date, and a section on the test versions

Who is responsible

Cailloux is built and hosted by Pierre Miné Delplanque, in a personal capacity. There is no company behind it, no team, no investor. On the App Store, the name shown is “Pierre Mine”: it is the same person.

For any question or request: admin@cailloux.app.

What is collected

If you create a route planner account

First name, surname, email address, username — to recognise you and to get back to you.
Your password, never in clear text — only a hash is kept, produced by a deliberately slow and memory-hungry method (scrypt). Nobody, not even me, can read it back, and a stolen copy of the database would still be very expensive to crack.
Your consent to receive news, if you gave it when you signed up — by ticking the box, or by answering yes to the question, depending on the version. You can unsubscribe at any time.
The date your account was created.
Your language — French, English or Dutch: the one the app was speaking to you when you signed up, or the one you have chosen since. It lets Cailloux speak your language on each of your devices.
The confirmation of your email address — if your account was created from version 1.1. A link is sent to you when you sign up, and the date you open it is kept. Only a hash of the link is stored, with the time of the last one sent, so that links are not sent in bursts. When you change your address, the new one is kept alongside the old one until you click, then replaces it. Its link is only valid for 48 hours: without a click, the new address is erased the next time you log in.
The publication dates of your races — when a race first went online, and when it last did. 2 numbers, about the race, not about you. They let me answer “online since…” when you report a problem, and tell me whether a forgotten race is still running live.
The date you last used it — the day you last opened Cailloux. It tells me whether the app is still being used, and who to write to before changing anything. It is recorded at most once an hour. It is not a log — there is only one date, the most recent one, and the previous one is overwritten.
The version number of each app you open with your account: the app, Le Cairn or the app installed on your phone (iPhone or Android). For each one: its exact number (for example 1.2.24), the channel (the regular version, the beta or the alpha version), and the day and time. The channel is read from the page's address; the installed app has no address, so its channel is not recorded. The number is recorded when you sign in, when you create your account and when Le Cairn opens: at most once an hour, unless it has changed. It tells me who is using which version, for the beta and for updates. This is not a log either: one value per app, the latest, replaced at each visit and deleted with your account. An older app does not give its number: the version read from the address (1.1 or 1.2) is recorded instead, marked as inferred. That version read from the address is also kept on its own, one for the whole account, as before. Nothing is recorded for someone who only comes in with a 6-digit code: no account, no trace.
Your enrolment in the test programme, if you asked for it, with the date and the way you came in: your profile, a link in an email, or creating your account on a beta address (beta.cairn.cailloux.app or beta.app.cailloux.app). An account created there, with Le Cairn or with the app, starts out enrolled in the test programme. Like the others, this enrolment can be unticked in your Le Cairn profile.
Your request to try the Android or iPhone app, if you tap “I want to test on Android” or “I want to test on iPhone”: the platform, the date, the state of the request (requested, invitation sent, withdrawn) and the e-mail address where you receive the invitation. It is your account address, unless you give me another one. This request also enrols you in the test programme.
Your request for a professional account, if you make one: the profession you declare, your credentials — qualification, organisation, website, registration number — and the message you write. This information is used to decide whether to open the account, and for nothing else: it is shown to nobody, not to your clients, not on the site. It stays as long as the account exists; you can ask for it to be erased, or delete your account.

If a professional follows your races

A coach or a dietitian can work inside your race. It goes through 2 doors, never one: I open the professional account on the strength of the credentials they declare, and you choose which races are opened to them. What the account can edit there — information, kit, nutrition strategy, split times… — is set when it is opened, and shown to you before you accept. Race by race. The professional account is free. You can close it again at any time.

They receive the race — its track, its checkpoints, the kit, the feeding plan, and the name, race number and weight of every runner in it — the weight if it was entered, since needs are calculated from it. Without those they would not know who they are writing a plan for.
3 things are never sent to them: the personal 6-digit codes, your phone number and that of your emergency contact. Not hidden on screen — not sent at all. Whatever reaches a browser can be read by whoever is holding it.
Food reactions follow the nutrition strategy, and nothing else — as do the products each runner has starred, which they receive so they can write a plan with what the runner actually eats. What a runner found sickly, heavy or hard to keep down can only be read by a professional to whom you have opened that part. A coach to whom you opened only the split times does not see them. This is data that touches the body and health: that is why it follows that part, rather than having a permission of its own.
They change nothing. They suggest; you accept or refuse, change by change, and every suggestion carries a compulsory note explaining why. Until you have said yes, your race has not moved by a single figure — a refusal has nothing to undo.
What is kept in addition to your race: the link between your 2 accounts — who follows whom, since when, and which races are open — and their suggestions: the values proposed, their note, your decision. So that both of you can refer back to them. Closing their access erases their pending suggestions.

⚠️ And the point to read twice: your runners asked for none of this. If your race carries people other than you, opening that race to a professional gives them their names, their race numbers, their weight, and — if their account carries the nutrition strategy — their starred products, what they ate and how it went. They create no account, they ticked no box, and the app does not ask their opinion. It is up to you to tell them, exactly as for the tracking of a race. If you are not sure you have their agreement, do not open that race to a professional who has nutrition.

If you are tracked during a race

Your name and race number, as they were entered in Le Cairn.
Your times at the checkpoints.
Your GPS positions when you drop a pebble: latitude, longitude, time, the km you are at on the course, your distance from the track and the GPS accuracy. And if the automatic pebble is switched on for you, the app drops one by itself every 20 minutes, and when you open it again. It only does so between your checked-in start and your checked-in finish. In the web app, only as long as it is open on screen.
In the iPhone app and the Android app, the automatic pebble carries on with the screen locked. To do this, the phone reads your position continuously, each time you have moved 25 m. It asks you for the “Always” permission, and it shows it: a blue indicator at the top of the screen on iPhone, a notification on Android. These positions do not leave the phone, and it keeps only the last one: only a pebble is sent, about every 20 minutes. Before your checked-in start, after your checked-in finish and after a withdrawal, this GPS is off. A pebble dropped by hand and a crew alert always work.
With a Garmin watch connected to the iPhone app (in testing): a press on the watch's lap button drops a pebble, and the watch sends its position to your iPhone, one point every 250 m (at most once a minute) during the race, every 2 minutes before your start. These exchanges go over Bluetooth through the Garmin Connect app on your phone; the iPhone matches the position to the course and keeps only the pebble. The watch keeps nothing of the race once the activity has ended. You turn the connection off in the ☰ menu › Watch.
Pebbles and check-ins set aside. An impossible pebble or check-in does not go into the tracking. Impossible means: further than anyone can cover at 20 km/h since the start, plus a 3 km margin. For example, a finish checked in 39 minutes after the start, by a phone left at the finish. The server keeps it apart, in a closed space, with what it carried — the time, and the position for a pebble — and the reason. Neither your crew nor the public can see it, and it sends no notification. I can read it, to check that a real passage was not set aside by mistake. When the race is taken offline, it is archived, still closed; if the race goes live again, it goes back to its place apart. When the race is closed or deleted, it is erased.
Your position during a crew alert. As long as the alert is active, the app follows your position and sends it to your crew as soon as you have moved 50 m, and at least every 2 minutes: a position 10 minutes old would send them to the wrong place. The tracking stops when the alert is lifted. It is the only time Cailloux sends your position continuously.
The “Starting too fast” alert, if it is switched on for your race and you accepted it at the start: the app reads your position once a minute for the first 20 minutes, to work out your pace. Nothing is sent: those positions are only used for the calculation, on your phone.
The messages you exchange with your crew.
The encouragement the public sends you, in version 1.1, until 16 November 2026, and only if the race allows it: a first name and a message of 200 characters at most, written by someone following your race. They are stored with the race's messages. Version 1.2 and the iPhone and Android apps no longer offer to send them.
Your phone number, if it was entered. It is shown to your crew when you raise an alert: it is the first thing they look for, and they should not have to look.
The name and number of your emergency contact as given to the organisers. They are shown to you, on your phone, if you withdraw or raise an alert.
A notification subscription, if you accepted them. It designates your browser, or your phone in the iPhone or Android app. It also keeps your role, the athlete you follow, your language, and a name to find your way around: the athlete's name in the athlete app, otherwise the name on your account if it is signed in on this device.

The race's emergency numbers

The race itself carries 2 numbers entered by the route planner: race control and an emergency number for the organisation. They are shown to the runner at the moment they withdraw or raise an alert — the moment when they should not have to hunt through their contacts. Both fields are optional.

If you report a bug

What you write in the form, as it is.
The technical context: the app, its version, your screen size, the description of your browser (its name, its version, your system, sometimes your phone model), the code of the race concerned, and whether it is a beta. That is what lets me reproduce the problem. The app also sends your account key and the identifier of the open athlete: the server does not keep them.
Your name, or failing that your username, if the app knows it at that moment.

These reports are read by me alone, and serve only to fix things. You can of course ask me to delete them.

If you suggest a correction to a product sheet

The suggestion keeps your name and the link to your account, so I can come back to you if a value is worth discussing. It is visible to me alone, never to other users.

If you are an organiser submitting a race sheet

The organisers page keeps your name, your email address and, if you give it, your phone number, along with the language you filled it in and the address of your race's website. They are used to check that the submission really comes from the organisation, to write to you — to confirm the submission, then to tell you whether the sheet is published — and to send you the link that lets you correct it. They are never published: only the sheet is — the course, the checkpoints, the cut-off times. They are kept as long as the sheet exists, and a refused submission is kept with its decision. You can ask for them to be erased at any time.

I also sometimes write to the organisation of a race already in Cailloux, to suggest that they check and certify its course. I then use the organisation's contact address; it is kept with the sheet, for the letters that follow.

To prevent abuse

When somebody tries to sign in, create an account or send a report, the server counts attempts per network in order to slow automated attacks. It does not record your IP address: it keeps an irreversible hash of it, together with a simple counter. These counters erase themselves after a few tens of minutes and are linked to no account.

If you simply visit the site

A cookie-free, identifier-free audience measurement (Cloudflare Web Analytics) counts page views. It cannot recognise you from one visit to the next — which is why this site has no consent banner.

In the apps: counters, not tracking

To know which features are actually used, the app increments global counters: “finisher cards shared: 12 in August”. That is all that is recorded — a number.

No identifier, no time, no link to you, your race or your device. It is technically impossible to trace a counter back to a person, and the database rules allow nothing but adding 1: these counters cannot even be reset from the app.

The Cupboard, the notebook, and what touches the body

Since 1.1, Cailloux also keeps what the runner's Cupboard and the route planner's notebook need — for everyone, no longer only in the test versions.

Here is the list, in full:

A personal 6-digit code for each runner in your notebook, and a record of the sessions opened with it — so they can all be closed at once if you change that code.
What each runner has in stock at home: the products they have starred, how many they have left, and the threshold below which they want to be warned.
Their kit: category, name, weight, quantity — and, for containers, their type and capacity.
What they consumed, product by product, with the date, the race, and what they thought of it: liked or not, whether it turned the stomach, how it digested, and a free note. This is what lets the app stop suggesting what went down badly.
The intakes of their race: they tick themselves off as the plan moves on, and the runner unticks, from their phone, the ones they did not eat. And the drink sachets they make up at each aid station.
A free note the route planner can write about a runner — “dodgy knee”, “cannot take caffeinated gels”. Only they can read it.
The sharing of a drawer between several runners, when their route planner brings them together — a couple or a team counting its stock together.
The accounts you share the preparation of a race with, if you invite somebody to edit it alongside you.
Your runner notebook: for each runner, their name, their weight, their race settings — climb cost, threshold, drift —, their phone number, and the name and number of their emergency contact. They are kept from one race to the next, so you do not have to type them again.

2 of these deserve to be named for what they are. Food reactions and notes about a runner touch the body and health. They leave their route planner's account in one case only, and you decide it: a professional to whom you opened the nutrition strategy reads the reactions — never the notes. No other user sees them, they feed no global calculation, and they are not in the public part of a race. A runner in a team shares the stock count, never the reactions — what a stomach can take belongs to that stomach alone.

If you want the exact detail — the field names, where they are stored, what each one holds — write to me and I will send it: admin@cailloux.app. This data is erased like the rest, with the “Delete my account” button or on simple request.

The next test versions may record new things before being opened to everyone: this page will say so, as it did for 1.1.

The important point about runners

A tracked runner creates no account: their route planner enters their name and race number, then passes them a personal 6-digit code that opens the app for them. No password, no email address, no sign-up. It is therefore up to the route planner to make sure they are entitled to do so, and to tell their runners they will be tracked.

⚠️ A dated race goes online by itself 24 hours before its start, if the route planner has not published it: it is a safety net for the forgetful, and an email tells them so. To prevent it, switch off the race's “Automatic go-live” toggle. In other words, runners can be tracked without anybody having clicked “Publish”: tell them beforehand, not on race day.

On my side, I provide the tool and I host the data. If you are a runner and you want your data gone, you can go through your route planner or write to me directly — I will handle it.

What you should know about phone numbers

Your number, your next of kin's and the organisation's do not live with the public part of the race. They are stored in a closed area that nobody can read directly — not even knowing the race code. To obtain them you must present a personal 6-digit code that the route planner passes to each person, and it is then the server that decides what to show: your crew receives the numbers it needs, a runner receives only their own contacts, and public tracking receives none.

The race code, on the other hand, is made to circulate: it can be dictated, copied and shared. It opens the tracking — it does not open the numbers.

2 honest clarifications. First, I can technically read this data, since I administer the database — that is true of every host, and I would rather write it down than let you guess it. Second, a route planner who would rather do without can always leave these fields empty: tracking, alerts and notifications all work without them.

Why, and for how long

Data	What it is for	Kept
Route planner account	To let you create and manage your races	As long as the account exists
Race, check-ins, positions	To show live tracking to the crew and to family	Until the route planner deletes it
Pebbles and check-ins set aside	To keep an impossible passage apart, without showing it and without losing it	Archived when the race is taken offline. Erased when it is closed or deleted
Crew messages — and, in 1.1, encouragement from the public	To communicate during the race	With the race
Phone numbers — runner, emergency contact, race control, emergency	To be able to call each other when a race does not go to plan	With the race. Optional: an empty field is not recorded
Personal 6-digit codes — one per runner, one for the crew	To open the app at the right level of access, with no account to create	The crew code with the race; a runner's code with their notebook, as long as they are in it
Phone identifier — version 1.2, the iPhone and Android apps	So that only one athlete app at a time sends your pebbles and check-ins	On your phone, until you clear its data or uninstall the app. On the server, erased when the race is taken offline, closed or deleted
Notification subscription	To send the check-in alerts	Until you turn notifications off, or the race is taken offline, closed or deleted. Also erased when the notification service says it has expired
Sign-in session	To save you retyping your password	30 days — and changing your password immediately signs out your other devices
Last used date	To know whether the app is still in use, and who to write to before changing anything	One date only, replaced each time. Goes with the account
Version number — of the app, of Le Cairn, of the iPhone or Android app	To know who is using which version, for the beta and for updates	The latest value per app, and the version read from the address, replaced at each visit. Go with the account
Request to try an app — Android or iPhone	To send you the invitation to install the test app	Until you ask for it to be withdrawn, or with the account
Stock, kit, intakes and reactions	To prepare the aid stations, and stop suggesting what went down badly	As long as the account exists. Erased on request, or with the account
Runner notebook	Not having to type your runners again for every race	As long as the account exists. Erased on request, or with the account
An organiser's contact — name, email, phone	To check a race sheet, write to the organisation, and let them correct it	As long as the sheet exists. A refused submission is kept with its decision. Erased on request
Bug reports	To reproduce and fix a problem	Until I deal with it, or you ask me to erase it
Anti-abuse counters	To slow automated attempts	A few tens of minutes, then erased
Audience measurement	To know whether the site is read	Aggregated, with no identifier

There is not yet an automatic purge of old races. Write to me and I delete them, immediately.

Where the data is, and who else touches it

The database is hosted by Firebase (Google) in a data centre in Belgium. The site, Le Cairn and the web app are served by OVH, in France, which also manages the domain name. The iPhone and Android apps carry their code inside them: they are distributed by Apple and by Google. The server that does the calculations and sends the notifications runs at Netlify. Emails are sent through Brevo, a French company. The audience measurement is done by Cloudflare.

If you ask to try an app, your e-mail address is passed on, and only in that case, to Google (Firebase App Distribution) for the Android app, or to Apple (TestFlight) for the iPhone app. They send you the invitation and install the test app.

Notifications go through the notification service of your device. On the web, it is the one of your browser (Google, Apple or Mozilla, depending on the browser), and the text goes through it encrypted. In the iPhone app, it is Apple (APNs); in the Android app, Google (Firebase Cloud Messaging). They receive the identifier of your phone and the text of each notification, which can contain the name of a runner.

Google, Apple, Netlify and Cloudflare are American companies: even with servers in Europe, access from the United States is not theoretically ruled out. That is true of very nearly every service of this kind, and it should be known.

Other services are called directly from your device, and so see your IP address. OpenTopoData finds the altitude of a track when you import it, and Open-Meteo gives the weather at the time you will pass: they only receive points on the course, and a date for the weather. OpenStreetMap provides the pieces of map: it sees the area of the map you are looking at. QR Server draws, in Le Cairn, the QR code of a tracking link: it receives that link, which carries the race code and an athlete identifier, with no name. None of them receives your name.

Finally, each time the app or Le Cairn opens, it opens an anonymous session with Google (Firebase): that is what lets it read the database. It carries neither your name nor your account, and its identifier is stored nowhere in the database.

Apart from these services, nobody has access to the data. It is neither sold, nor shared, nor used for anything other than making the app work.

What Cailloux does not do

No advertising, no ad trackers.
No selling or sharing of data with third parties.
No continuous GPS tracking sent to the server — a position when you drop a pebble, or about every 20 minutes if the automatic pebble is switched on for you. In the iPhone and Android apps, the phone reads your position continuously for this, between your checked-in start and finish, but those positions are not sent. The one exception: during a crew alert, until it is lifted.
No tracking cookies, hence no banner to click.
No profiling, no automated decision-making about you.
No call and no text message is ever sent to the numbers recorded: they serve only to show you a button, and it is always a person who decides to call.

What stays on your phone

The app keeps some things locally, on your device, and they do not leave it:

Your check-ins, the runner you follow, your session.
Check-ins and pebbles waiting while you have no signal — they leave as soon as it returns.
The ticked boxes of your “Before the race” checklist: what you slipped into each ziplock, what you prepared. None of it is sent to the server — it is your list, on your phone.
A copy of the product catalogue, so it is not downloaded again every time you open the app. It contains nothing personal.
The intakes of your race — which tick themselves off — and the sachets you make up: they stay on your phone if there is no signal, and leave as soon as it returns. A copy of your stock, so the app opens without waiting for the network.
A phone identifier, in version 1.2 and in the iPhone and Android apps. It is a number drawn at random the first time the app opens. It has no link to your phone, your name or your account. It does one thing only: it makes sure that only one athlete app at a time sends your pebbles and check-ins. Without it, a phone forgotten at the finish, opened with your code, could drop pebbles in your place. The last phone to enter with your code takes over. On the other one, whatever has not been sent stays on that phone, until you tap “Take over here”.
What the server keeps of it. This identifier does leave your phone, with your pebbles and check-ins. While your race is live, the server remembers which phone holds it, since when, the time it last wrote, and whether it is an installed app, iPhone or Android. It is stored in a closed space: neither your crew nor the public can see it. It is erased as soon as the race is taken offline, closed or deleted.

All of this disappears if you clear the browser's data or uninstall the app.

Your rights

The European regulation (GDPR) gives you the right to access your data, to correct it, to have it erased, to retrieve it in a readable format, and to object to its processing.

For erasure you do not even have to ask me: the “Delete my account” button erases everything at once — your account, your races, the race codes they were holding and the suggestions you had sent. It is in your profile in Le Cairn. From version 1.2, it is also in the app, on the web, on iPhone and on Android. The product sheets you had certified stay in the shared catalogue, but detached from you.

For the rest: write to me at admin@cailloux.app and I will handle the request. The project is small enough for this to be done by hand, quickly, with no form.

If my answer does not satisfy you, you can lodge a complaint with the CNIL, the French data protection authority.

Write to admin@cailloux.app