Your data, in plain words

Sign-in is Google-only — TrailGoat never sees or stores a password. From Google we keep exactly four things: your name, email address, profile picture URL, and Google's stable account ID (so your account survives an email change). Your email is used to identify your account and for nothing else — no newsletters, no marketing.

Signing in sets one signed, HttpOnly session cookie (tg_session). It contains only your account number, cryptographically signed so it can't be forged.

• Courses you save in the Course Creator (the GPX route, name, aid stations, elevation profile).
• Run & race plans from the Run Planner — the course, your fueling inputs, food pack, gear & drop-bag checklists, and your crew & pacer list. Crew entries can include the names, phone numbers and email addresses of people you add — that contact info is stored as part of the plan (so a plan opened on your phone has the same crew as on your laptop), visible only to you, and deleted with the plan. Please add someone's contact details only if they're okay appearing on your plan and crew sheets.
• Crew sheets you share — the "Get live crew sheet" button stores a read-only copy of the plan (including the crew list and its contact details) behind a secret-token URL, so your crew can open it without signing in. Anyone with the link can read it. The link is stable: re-sharing — or updating a saved plan that has been shared — refreshes the same URL in place, so your crew always sees the latest version you shared. Only you can update it (your account, or the browser that created the link). Sheets shared while signed in are tied to your account and erased when you delete it; sheets shared signed-out aren't linked to any account (email Kris with the link if you need one taken down).
• Live position on a crew sheet, only if you set it up under Crew & pacers. TrailGoat reads your tracker's public feed (inReach MapShare or SPOT) while your race is live, from an hour before the start to the last cutoff; texts from the phone numbers you list; your OpenSplitTime splits; or your phone's position while the sheet is open on it with the switch on. We keep only what the forecast needs: the newest position from each source, its distance along the course and its time, and the stop arrivals worked out from it. People with the crew sheet link see the distance and time; the follow link sees the distance, never the map point. A feed password stays on our server and is never shown on the sheet. If you also tick "show my position on the race's race-day page" and give your bib, and the race director has chosen to show positions runners share, anyone who looks up that bib on the race's race-day page sees the same distance and time, labelled as yours; untick it and it goes. All of it is deleted a week after the race, and with the sheet when your account goes.
• Race debriefs you save from the Run Planner's After the run section. Only the split summary is stored: per aid station the planned and actual arrival and how long you stopped, the climb, descent and flat totals, the night and heat estimates, and an ahead-or-behind line by distance. Never the GPS track: the watch file is converted in memory and dropped, and no coordinates or clock times from it are kept. Anyone with the link can read a saved debrief. Saved while signed in, it's in your ultra record and erased with your account; the browser that saved it can delete it too. If you tick Let TrailGoat use these splits, one anonymous copy of the planned and actual checkpoint times (the course, your goal, no name, no account, no track) joins the set the pacing model is checked against.
• Past races you add to the Run Planner's finish predictor: for each, the race, the year and your finish time, up to five. Signed out they stay in your browser; signed in they are kept on your account so they follow you, and they are erased with it.
• Training plans — your wizard answers (race, fitness, weekly schedule, terrain, free-text notes) and the generated plan, plus which workouts you've checked off.
• Athlete profile — experience level, body weight, sweat rate, sweat saltiness and heat acclimation, so your fueling numbers are the same on every device you sign in on.
• Fitness profile — if you upload watch or Strava export files, the files themselves are parsed in memory and never stored. We keep only the aggregate result: weekly mileage and vert, run frequency, longest run, and typical run days.

All of it is owner-scoped: only you (signed in) can see or change your stuff. One exception to know about: a training plan's calendar feed is a secret-token URL so your phone's calendar app can subscribe without signing in — anyone you give that URL to can read that plan's workouts. Deleting the plan kills the feed.

Display preferences live in your browser's local storage, not on our server: units (miles/km), temperature scale, theme, and which first-visit tips you've dismissed.

Your athlete profile (experience level, body weight, sweat rate, saltiness, heat acclimation — the inputs behind the fueling math) also lives in your browser. Signed out, it never leaves this device. Signed in, it syncs to your account so the same numbers follow you to any browser you sign in on, and it's erased when you delete your account.

Your working plan — the loaded course, fueling inputs, food pack, gear & drop bags, and crew list — also lives in your browser while you build it. If you use TrailGoat without an account, that's the only place it exists (so a cleared browser loses it, and other devices can't see it). Hitting Save plan while signed in copies all of it into your account so the plan opens complete on any device.

Your location: the "Add local weather" feature asks for your location only when you tap it — never automatically. The coordinates are rounded to roughly 100 m, saved only in your browser, and sent directly from your browser to the Open-Meteo forecast service when a forecast is fetched. Our server never receives them.

Capra is the chat in the Run Planner's Ask Capra card. When you send a question, it goes to Anthropic's Claude API together with the plan on your screen — the course name, distance and vert, your start time, the forecast, your fueling targets, your aid-station rows (their names and arrival times), your food pack, and the athlete profile behind the math (experience, weight, sweat rate, saltiness, heat acclimation). That's what makes the answer about your actual day instead of generic advice. Under Anthropic's API terms it isn't used to train their models.

Capra needs a free account. The first time you ask it something, it asks whether we may keep your questions to make it better. If you say no, your conversation isn't saved — it lives in the page and is gone when you close it. If you say yes, we keep each question, Capra's answer and which course it was about (not the rest of your plan) on your account, and read them to see where Capra helps and where it gets things wrong. You can change your answer any time from the Capra card; switching to no, or deleting your account, deletes what we kept.

One thing our server does keep either way: to avoid paying for the same answer twice, a generated answer is held in the server's memory for up to 24 hours, filed under a fingerprint of the question and the plan numbers it was based on. An identical question about an identical plan gets served that saved answer instead of a fresh one. Nothing in that cache is tied to you or your account, it's never written to the database, and it's cleared whenever the server restarts.

Asking about a race. On a race's runner's guide, or on the race's own site when it turns on Ask about the course, you can ask Capra about that race without an account. Your question goes to the Claude API with the race's own record (its course, aid stations and guide), nothing about you. We count every question. When Capra can't answer one, we keep its words, with no account, address or device, so the race director can read it on their stats page and add the answer to their guide. After 180 days we delete those words and keep only the count.

Capra is general guidance from a language model, not medical advice — and like any such model it can be wrong. Your own judgment, and a doctor for anything medical, beat it every time.

Three first-party cookies, zero trackers:

• tg_session — keeps you signed in (only exists after you sign in).
• tg_vid + tg_vday — an anonymous random ID used to count unique visitors once per day. It isn't linked to your account, doesn't follow you across other sites, and exists because we count our own visitors instead of installing Google Analytics.

We also keep daily totals of how the site gets used — how many courses were loaded, plans printed and questions asked, which pages were viewed, and which sites sent us traffic. These are plain counters ("47 plans printed today"), not a log of who did what: they aren't linked to your account, your visitor ID, or each other.

TrailGoat runs on a small set of infrastructure providers. What each one sees:

• Google — sign-in only (the standard "Sign in with Google" flow).
• Anthropic (Claude) — two features call the Claude API: building a training plan sends your wizard answers (including fitness aggregates, never your raw files), and asking Capra sends your question plus your plan's numbers (see the card above). Under Anthropic's API terms, neither is used to train their models.
• Open-Meteo — weather forecasts, called directly from your browser with your device-stored coordinates.
• OpenStreetMap (its Overpass service): when you ask the Run Planner to find water along a self-supported route, our server sends the route's line, the course and never your location, and keeps the answer so the same route is not asked again.
• Render — hosts the site and server (United States).
• Turso — the database where your account and creations live.

That's the whole list. No ad networks, no data brokers, no social-media pixels.

TrailGoat publishes its course flyover films and promotional videos to its own YouTube channel, @trailgoatrun, using YouTube API Services. Only TrailGoat's own channel account authorizes this. TrailGoat doesn't access, store or share any of your YouTube data, and signing in to TrailGoat never connects to your YouTube account.

When you watch our videos on YouTube, you're using YouTube, and the YouTube Terms of Service and the Google Privacy Policy apply.

Our films page plays the same videos in YouTube's own player, from youtube-nocookie.com. Until you press play, the page loads only the films' cover images from YouTube, and no YouTube player or cookies. When you press play, YouTube's player loads, and YouTube's terms and Google's privacy policy apply to it.

You can review or revoke any app's access to your Google account at Google security settings.

• Sell, rent, or share your data for advertising or marketing.
• Run third-party analytics, ad trackers, or fingerprinting.
• Email you anything except replies to emails you send us, and, if you ask for a plan by email in the Run Planner, that plan and one race-week reminder for it. We keep the address with the plan link and the race date for that purpose only; the unsubscribe link in each mail deletes it.
• Pull data from your Strava or watch accounts behind your back — the only activity data we ever have is what you explicitly upload.
• Keep your data after you delete it. Deletes are real deletes, not "deactivations."

This erases your account and everything in it, immediately and permanently: your profile, saved courses, run & race plans (including their gear and crew lists), crew sheets you shared while signed in, training plans (and their calendar feeds), and fitness profile. There's no grace period and no way for us to undo it.

Any ongoing subscription is canceled automatically before deletion, and Pro access ends. If cancellation cannot be confirmed, your account stays available so you can retry. Refunds follow our existing policy.

One carve-out, in the open: if a course you saved has been linked into the public race catalog that other runners plan from, the course itself stays in the catalog but is fully disconnected from you — nothing about it points to your account, because your account no longer exists.