Medal Scanner ("the app", "we") lets runners photograph, catalog, and share their race medals. The app is available at medal.dynweb.org and on mobile devices.
For any privacy question or request, contact us at privacy@medal.dynweb.org.
We do not collect precise location, contacts, advertising identifiers, or any analytics profile.
We do not sell your data, show ads, or use third-party analytics or tracking.
When you scan a medal, your phone first tries to read it on the device itself — nothing is sent anywhere for that.
If on-device reading fails and you have left "Cloud photo analysis" enabled in your profile settings, we may send that one medal photo to an AI image-analysis service acting as our service provider, to identify the race. Depending on our configuration this is one of: Anthropic (Claude), Google (Gemini), or OpenAI. The photo is sent alone — never your name, email, or account details — and the service returns the race details it could read (name, year, distance).
Under these providers' API terms, photos are not used to train their models and are deleted after a limited period (30–55 days depending on the provider, for abuse prevention).
You can turn "Cloud photo analysis" off at any time in your profile settings. Scanning then works entirely on your device, and you can always enter race details yourself.
Sharing is off by default. If you enable it, your collection (or a single medal) becomes reachable through an unguessable link containing a random token. Anyone with the link can view the shared content — no account needed. You can turn sharing off at any time, which immediately disables the link.
Tips and Supporter subscriptions in the iOS and Android apps are paid through Apple or Google; we never see your card details. RevenueCat, our purchase-management provider, receives your account ID and the purchase (product, price, date, store) so the Supporter badge can be shown. On the web, payments are processed by Stripe on its own page. We keep a record of each purchase event linked to your account and delete it when you delete your account. Whether you are a Supporter — yes or no, never the amount or date — is visible to other runners.
Your data is kept as long as your account exists. When you delete your account, your account data, medals, and photos are deleted. Server logs are retained for a short period (up to 12 months) for security purposes, then deleted.
Under the GDPR and applicable law, you can request access to, correction of, deletion of, or a portable copy of your personal data, and you may object to or restrict certain processing. To exercise these rights, contact privacy@medal.dynweb.org. You also have the right to lodge a complaint with your supervisory authority (in France, the CNIL at cnil.fr).
All traffic is encrypted in transit (HTTPS/TLS). Passwords are hashed with a modern algorithm, sign-in uses short-lived signed tokens, and share links use unguessable random tokens.
The app is not directed at children under 15, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.
If we change this policy, we will update this page and its effective date. Significant changes will be announced in the app.