Mountain States Cup Management LLC (“Mountain States Cup,” “MSC,” “we,” “us,” or “our”) operates the mountainstatescup.com website and online store, the MSC mobile application for iOS (the “App”), and related services (collectively, the “Services”). This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the Services.
By using the Services, you agree to this Privacy Policy. If you do not agree, please do not use the Services.
Children and Families
The Services are intended for a general audience and are designed to be used by adults, including parents and guardians who register and manage minor athletes. Mountain States Cup is a youth-inclusive race series, and parents and guardians do register minors — including children under 13 — to compete, so those minors’ information appears in the Services. Because we knowingly collect personal information from some children under 13, we handle that information consistent with the Children’s Online Privacy Protection Act (“COPPA”). See the Children’s Privacy section below. Minors do not create their own accounts; a minor’s profile exists only within a parent’s or guardian’s household.
Personal Information We Collect
We collect several categories of personal information depending on how you interact with the Services:
Information you provide directly:
- Contact and account details: name, email address (used to sign in via a one-time passcode), optional phone number, and your account and household settings
- Athlete / registration information (imported from BikeReg): date of birth, USAC license number, MSC license number, competition category, event registrations, bib assignments, start times, schedule, and race results
- Household information: the family members (for example, a parent and their registered children) grouped into your household, and each member’s role
- Photos and media consent: event and portrait photographs of riders captured by MSC race staff, and, for a minor, a record of whether a parent or guardian has consented to displaying that minor’s photos
- Store information: for online-store orders, your name, email, shipping/billing address, and order history
- Communications: customer-support inquiries, nominations, and other messages you send us
Information collected automatically:
- Device and technical information: device type, operating system version, device identifiers, IP address, and browser type
- Usage and diagnostic information: how you interact with the Services, plus crash reports and performance data used to keep the App reliable. Crash and diagnostic reports are associated with a pseudonymous identifier only — they do not include your name or email address and do not include screenshots or captured screen content.
- Location information: approximate location based on IP address. In the App, we collect your precise location only when you file a “rider-down” safety report, so race control can send patrol to the injured rider’s location. This is captured once, at the time of the report; we do not track your location continuously or in the background. You can revoke location permission at any time in your device settings. (Venue weather is based on the venue’s coordinates, not your location.)
- Push notification tokens: if you enable notifications in the App, we collect your device token to deliver race-day updates, schedule changes, course holds, safety alerts, and result alerts. You can disable notifications at any time in your device settings.
How We Use Your Personal Information
We use personal information for:
- Providing the Services: managing your account and household, registering and identifying athletes, assigning bibs and start times, and delivering schedules, start lists, live results, season standings, course status, and venue information — including Live Activities and home-screen widgets
- Authentication: verifying your identity via a one-time passcode (OTP) sent to your email
- Photos: displaying rider profiles and event photos to the families entitled to see them. Race photos are provided free of charge; the App contains no in-app purchases.
- Safety: rider-down safety reporting and dispatch
- Store orders: fulfilling and supporting merchandise orders placed through our online store
- Communications: sending race communications and, where you have opted in, promotional messages about MSC events and partners (you may opt out at any time)
- Security and fraud prevention: authenticating accounts and detecting fraudulent activity
- Improving the Services: analyzing usage and diagnostics to improve performance and reliability
- Legal compliance: complying with applicable law, regulation, and legal process
We do not sell the personal information collected through the App, and we do not use App data for cross-context behavioral advertising.
How We Disclose Personal Information
We share personal information only with service providers who process it on our behalf, under contract, and who are required to protect it consistent with this Privacy Policy and to use it solely to provide services to us. These include:
- Supabase — database hosting, authentication backend, file storage, and real-time data delivery
- Cloudinary — race-photo hosting and delivery
- Resend — transactional email (one-time passcodes and race communications)
- Sentry — crash and performance monitoring (diagnostic data only; hosted in the United States)
- Apple — push-notification delivery (APNs) and venue weather (WeatherKit)
- Shopify — website and online-store hosting, checkout, and order/payment processing
We also import registration data from BikeReg (event registration) to operate the race series. Payments for store orders are processed by Shopify and its payment processor; we do not receive or store full payment card numbers.
We may also disclose personal information to race timing partners (e.g., ArtTiming) who process race results and standings — rider name, bib number, category, and race times are shared for timing and displayed publicly in results; to legal authorities when required by law; and in connection with a business transaction such as a merger, acquisition, or asset sale, subject to applicable law.
Race Results and Public Information
Race results, standings, and rider information (name, bib number, category, team, finish times) are inherently public sporting data. This information is displayed within the App, on our website, and may be shared with sanctioning bodies (USAC), timing partners, and media outlets. By registering for an MSC event, you acknowledge that race participation and results are public.
Children’s Privacy (COPPA)
The Services are general-audience and are not directed to children as their primary audience. However, because parents and guardians register minor athletes — including children under 13 — we knowingly collect some children’s personal information and apply COPPA’s protections to it.
How a minor’s information enters the Services. A parent or guardian registers the minor on BikeReg and links that registration to their household in the App. Minors do not create their own accounts.
What we collect about minors. The registration and athlete information described above (name, date of birth, competition category, USAC/MSC license, bib, schedule, results), household linkage, and — only with the parent’s or guardian’s consent — event photographs of the minor. Diagnostic data may relate to a minor’s use of the App but is tied to a pseudonymous identifier and does not include a minor’s name or email.
Parental consent and display of minors. When you register a minor and add them to your household, you confirm that you are the minor’s parent or legal guardian or are authorized to act for them. We display a minor’s photographs on public or promotional surfaces only with the verifiable consent of the minor’s parent or guardian, and a parent may withdraw that consent at any time. We do not serve behavioral advertising to anyone in the App.
Parental rights. A parent or guardian may review the personal information we hold about their child, request that we correct or delete it, and refuse the further collection or use of their child’s personal information. To make a request, email shawn@mscracing.com with the subject line “Children’s Privacy Request.” We will verify that the request comes from the child’s parent or guardian before acting.
Third-Party Websites and Links
The Services may contain links to third-party websites, including BikeReg (event registration), social media platforms, and sponsor sites. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.
Data Retention and Deletion
We retain personal information for as long as your account is active and as needed to operate the Services, comply with legal obligations, and resolve disputes. Race results and standings are retained as part of the historical sporting record.
You can delete your account and associated personal information from within the App (Account settings) or by contacting us. For children under 13, we retain personal information only as long as reasonably necessary to provide the Services to that child. When a parent or guardian requests deletion of a minor’s information, we delete or de-identify the child’s directly identifying information (name, date of birth, email, phone, photographs, and household linkage); any historical competition result we retain is kept only in a form we do not link back to the child.
Data Security
We implement reasonable technical and organizational measures to protect your personal information, including encrypted data transmission (TLS/HTTPS), secure token storage on your device, and access controls on our backend systems. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your Rights and Choices
Depending on where you live (including under the Texas Data Privacy and Security Act and similar state laws), you may have the following rights:
- Access: request a copy of the personal information we hold about you
- Deletion: request deletion of your personal information
- Correction: request correction of inaccurate personal information
- Portability: receive a copy of your personal information in a portable format
- Opt out: on our online store, opt out of the sale/sharing of personal information and of targeted advertising through the cookie/consent controls on the site
- Push notifications and location: enable or disable these at any time in your device settings
- Marketing communications: opt out using the unsubscribe link in any marketing message
To exercise your rights, contact us using the information below. We may verify your identity before processing requests and will respond within the timeframe required by applicable law.
Website and Online Store
Our website and online store are hosted by Shopify. The store may use cookies and similar technologies for analytics and, where enabled, marketing, and may share limited information with advertising or analytics partners. These cookie, analytics, and marketing practices apply only to the website/online store — not to the mobile App, which does not use tracking technologies and does not share data for advertising. Where applicable, you can opt out through the cookie/consent controls on the site. Shopify’s own handling of this data is governed by Shopify’s privacy policy.
International Users
The Services are operated in the United States, and information is processed and stored in the United States. If you access the Services from outside the United States, you understand that your information will be processed in the United States.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the revised version on this page and in the App and update the “Last updated” date above. Material changes affecting children’s information will be handled consistent with COPPA.
Contact
For questions about this Privacy Policy, our privacy practices, or to exercise your rights, contact us at:
Mountain States Cup Management LLC
Email: shawn@mscracing.com
This Privacy Policy is governed by the laws of the State of Texas, USA.
