Run for Freedom

Last updated: August 31, 2026

Run for Freedom ("we", "us", or "our") is committed to protecting your privacy. This policy explains what information we handle when you use our website, create an account, or register for an event.

Who we are

Run for Freedom is operated by The Bitcoin Learning Center, a core initiative under The Kostro Foundation. Our events combine athletic achievement with financial education in Northern Thailand.

Address: 186/4 Charoenraj Rd, Wat Ket, Mueang, Chiang Mai, Thailand

Email: info@runforfreedom.com

Website: https://runforfreedom.com

Information we collect

The exact fields depend on the event and registration form.

Account, identity, and contact information

Name, including an optional Thai name
Email address and phone number
Date of birth or age, gender, and nationality
National ID or passport number when an event requires it
Postal address when an event requires it
Account, login, session, and verification records

Health and emergency information

Blood type
Health conditions, current medication, and allergies
Emergency contact name, relationship, and phone number

We use this information for event safety and may make it available to authorized medical or event personnel when reasonably necessary.

Registration and payment information

Event, distance, shirt choice, price, discounts, and registration status
A snapshot of registration details, transfer/refund history, and operational notes
Referral or printed-QR attribution connected to the registration
Stripe transaction identifiers and payment status for card payments; we do not store full card numbers
Payment method and a bank-transfer receipt or other payment slip when uploaded. Slips are stored in a private Cloudflare R2 bucket and are available only to authorized users.
Manual bank-transfer or Bitcoin verification status

Communications

We may retain contact-form messages, event correspondence, email preferences, audience tags, and transactional-email delivery history.

Device, security, and usage information

When you use the site, we may process IP address, browser/user-agent data, requested pages, referrer, UTM campaign values, approximate timestamps, and security/rate-limit events. For affiliate and QR analytics, IP addresses are transformed into shortened hashes rather than stored in raw form.

When PostHog analytics is configured, it records page views, navigation, page-leave events, and application exceptions. Our configuration disables collection of full IP addresses and creates person profiles only for identified users, but PostHog may use cookies or browser storage for analytics continuity.

How we use information

We use information to:

create and secure accounts;
validate runners and process event registrations;
calculate prices, discounts, capacity, commissions, and campaign attribution;
process or manually verify payments, refunds, and transfers;
provide event logistics, safety support, results, and customer service;
send account, payment, and event-related transactional messages;
maintain optional marketing preferences and communicate about future events;
prevent abuse, investigate incidents, reconcile records, and meet legal obligations; and
understand and improve website and event operations.

Legal basis for processing

Depending on the information and purpose, we rely on performance of a contract, consent, legitimate interests in operating and protecting the service, protection of vital interests in an emergency, or compliance with a legal obligation. You may withdraw consent for optional marketing at any time; this does not affect service messages needed for an account or registration.

We disclose information only as reasonably necessary for the purposes above.

Service providers

Cloudflare: website delivery, security, D1 database hosting, and private R2 object storage
Stripe: card checkout, payment processing, refunds, and fraud prevention. See Stripe’s privacy information.
Amazon Web Services / SES: transactional email delivery
Mailcoach: subscriber records, email preferences, event/audience tags, and marketing campaigns
PostHog: website and product analytics when configured
Slack: limited operational alerts to authorized staff

Event operations

We may share the minimum necessary information with event organizers, authorized staff and volunteers, medical personnel, timing/results providers, payment verifiers, and other vendors needed to deliver an event.

Legal and safety requirements

We may disclose information when required by law, to respond to a valid legal request, to protect participants or other people, or to investigate fraud, abuse, or a security incident.

We do not sell personal information.

Cookies and browser storage

The site uses:

essential session and short-lived interface cookies for login and account actions;
a signed aff_ref cookie for affiliate attribution, normally up to the program’s configured attribution window;
a signed qr_src cookie for first-touch printed-QR attribution; and
PostHog cookies or browser storage for analytics when PostHog is enabled.

These attribution and analytics technologies are not used by Run for Freedom for third-party advertising. Browser settings can remove or block cookies, but doing so may prevent login or attribution from working and may reduce analytics accuracy.

Data retention

We keep information only for as long as reasonably necessary for the purpose for which it was collected, including operating the event, supporting an account, maintaining payment and accounting records, resolving disputes, preventing abuse, and meeting legal obligations.

Retention can differ by category. For example, payment and registration records may need to be retained longer than a payment slip or temporary authentication token. When information is no longer needed, we delete or anonymize it where reasonably possible, subject to backups, legal holds, and records we must retain.

You may ask us to review or delete information associated with you by contacting us. Some records may be retained when deletion is not legally or operationally available.

Data security

We use technical and organizational safeguards including HTTPS, access controls, signed and secure session cookies, private payment-slip storage, provider authentication, and role-gated administrative routes. No system can be guaranteed completely secure; contact us promptly if you believe your account or information has been compromised.

Your rights

Subject to applicable law, you may have rights to:

access personal information we hold about you;
correct inaccurate or incomplete information;
request deletion or restriction of processing;
receive eligible information in a portable form;
object to certain processing; and
withdraw consent for optional processing.

To exercise a right, email info@runforfreedom.com. We may need to verify your identity before completing the request.

Email communications

Transactional messages about login, payment, registration, safety, and event logistics may still be sent when needed to provide the service. Optional marketing can be managed through:

the unsubscribe or preference link in an email;
/account/emails while signed in; or
info@runforfreedom.com.

International data transfers

Some service providers may process information outside Thailand, including in the United States or other countries where they or their subprocessors operate. We use providers and contractual or technical safeguards intended to protect information during those transfers.

Children’s privacy

Some events allow participants under 18. A parent or legal guardian must complete or approve the registration where required by the event and applicable law. We process a minor’s information only for account, registration, payment, safety, and event-operation purposes.

Changes to this policy

We may update this policy as the product, events, or service providers change. We will post the current version on this page and update the date above; material changes may also be communicated through the site or email.

Contact us

For privacy questions or requests: