Controlling version
Mile Commons Privacy Policy
English is the controlling version. The Chinese text below is a convenience translation.
1. Who we are and what this policy covers
Mile Commons is a platform for running clubs, their events, and the runners and volunteers who take part. It is operated by BRIER SYSTEMS LLC. Mile Commons is the platform and brand; BRIER SYSTEMS LLC is the operator responsible for the information described here.
This policy explains what personal information the Mile Commons website and organizer tools handle, why, who can see it, and how long it is kept. Mile Commons is being introduced in stages, so some features described below may not be available to you yet. Each part of this policy applies only when you actually use the feature it describes.
An event may show its own privacy notice, for example on its sign-up form. That notice describes that event's handling and applies together with this policy. This policy is separate from the Mile Commons platform Terms: reading or acknowledging it is not acceptance of any Terms.
2. Browsing public pages
You can read public pages, including event listings, without an account. We do not ask who you are to browse.
If you choose a language with the language switch, we set one cookie that remembers that choice for up to one year. If you never use the switch, that cookie is not set.
Like any website, our hosting provider processes the technical details of each request, such as your IP address, the page requested, and the time, in order to deliver the page and keep the service secure.
Mile Commons does not currently measure how public pages are used. If first-party aggregate product-usage measurement is later turned on, it works only as described in section 10.
If you choose to connect a verified event registration to a Mile Commons account, we may set a short-lived, secure cookie that carries that verified registration-linking context through the sign-in or account-creation step. This cookie is generated only after you have demonstrated control of the registration through the verification or self-service link Mile Commons already sent you, supports only the linking step you asked for, and expires automatically after a short time. It is a security and continuity mechanism, not a persistent advertising or tracking identifier, and section 4 describes how it is used.
3. Event registration
When you sign up for an event through Mile Commons, we collect your name, your email address, and your answers to that event's sign-up questions, such as expected pace or club affiliation. Apart from the optional phone number and the emergency contact described below, event sign-up questions handled by Mile Commons are limited to non-sensitive information. We do not collect a date of birth, payment details, or government identifiers.
An event's sign-up form may ask for your phone number. Providing it is optional, and it is used only for day-of coordination of that event. For the Seven Bridges 2026 event, the sign-up form also asks for an emergency contact: a person's name, their relationship to you, and their phone number.
We keep your registration status, including whether you are registered, waitlisted, or cancelled, and organizers may record whether you attended. We email you a verification link and, once you verify, a link you can use to cancel. We store only a keyed, non-reversible digest of those links' secrets, not the secrets themselves.
To keep automated abuse out of sign-up, real event registration uses a human-verification check provided by Cloudflare, and your IP address is sent to Cloudflare for that check. We also limit repeated attempts. The limits are keyed by a non-reversible digest of your IP address or email address; we do not store your raw IP address in our database.
4. Runner accounts and sign-in
Where runner accounts are available, you sign in with Google or Apple. The provider tells us a stable identifier for your account and may supply your verified email address and name. We store the identifier that links your sign-in to your Mile Commons account, and a display name and preferred language if you provide them. We never receive your Google or Apple password, and we do not store a profile photo.
While you are signed in, a session cookie keeps you signed in. It is restricted to this site, is not readable by page scripts, and expires. We store a digest of the session rather than the session secret.
A runner account may be linked to your event registrations so you can see them in one place. Holding a runner account, or belonging to a club, does not give you access to any club's private organizer information.
Event registration can happen before you have a linked Mile Commons account. After your registration is verified, you may choose to sign in or create an account and connect that verified registration to it. A short-lived handoff cookie, described in section 2, carries the verified registration-linking context through that sign-in or account-creation step; it is used only for security, to keep that specific linking flow working as you carry it out, and to help prevent a registration from being linked to the wrong account. It is never used for advertising, profiling, cross-site tracking, or the product-usage measurement described in section 10, and it expires automatically about 15 minutes after it is issued, as described in "How long we keep information".
Creating a Mile Commons account, by itself, does not give that account ownership of any event registration. Signing in with the same email address a registration used is not, by itself, treated as proof of ownership either. Linking a registration to an account always requires independent proof that you control that registration, through the verification or self-service link Mile Commons already sent you. Once linking succeeds, we create the connection between your account and that registration so it is available in features for signed-in participants, such as your list of events.
5. Clubs, organizers, and volunteers
Organizers and club leads use a separate, access-controlled part of Mile Commons. For them we keep a name, email address, role, and club, along with invitations, membership approvals, and a history of access changes.
Organizers record operational information to run events: tasks, notes, activity and volunteer assignments, and a log of communications they sent through their own channels. Mile Commons does not send messages to third-party chat apps on anyone's behalf. Activity and volunteer records refer to participants by reference to an existing registration or by an identifier, rather than by copying contact details.
Organizers may also record operational contacts for event-day activities such as stations, bag drop, bag pickup, and finish operations, so that the people running the event can reach the right person on the day. For each contact, an organizer may enter the person's name, a phone number (such as a cellphone number), whether they are a primary or backup contact, a short description of their role, the club or group responsible for that activity, and private organizer notes. A contact is simply someone the organizer names, and may be a person who has no Mile Commons account: an organizer may enter this information about another person for event operations. Being listed does not create an account for that person, link them to one, or cause Mile Commons to contact them. The organizer decides what to enter and who may see it, as described in section 12. Mile Commons keeps a record of who created, changed, or removed such an entry and when, and which fields and audiences changed, without copying the contact's name or phone number into that record.
6. Terms acceptance records
If platform Terms are in effect and you accept them for your account, we record which version you accepted, when, and through which screen, linked to your account. We do not record your IP address or browser details with that acceptance.
These records exist only for Terms. This Privacy Policy has no acceptance step, and nothing you do with this policy is recorded as Terms acceptance.
7. Feedback, email, and other communications
We send operational email about your own registration: a verification message, a confirmation of your status with a cancellation link, and a notice if the event's schedule changes. These are sent through our email delivery provider. We do not send marketing email.
If you email a Mile Commons address, for example feedback@milecommons.com for product feedback or problem reports, we receive your email address and whatever you choose to write, and we use it to read, respond to, and act on your message. That address is for feedback; it is not the privacy contact. It is a standing feedback channel: it remains available even after other feedback channels exist.
Structured in-product feedback is now part of Mile Commons. Where Mile Commons accounts are available, a signed-in account can open a feedback form from the "Send feedback" link at the bottom of public pages, or from an event's page for feedback about that event. The rest of this section describes what that form records and who can read it; where it says "when structured feedback is enabled", it is describing that form. The form collects nothing unless you choose to send feedback through it. feedback@milecommons.com remains a way to send us feedback whether or not you use the form, and it will remain available.
When structured in-product feedback is enabled, sending it will require a signed-in Mile Commons account, and a submission will record the feedback category you choose; the message you write; the signed-in account you send it from, together with the Mile Commons account and profile identity needed to keep the feedback in the right scope, follow up with you, prevent misuse, and investigate what you reported; the time you submitted it; the status of the feedback as we work through it; limited context about where in the application it was sent from, such as the page or route; and, when the feedback is about a specific event, the event and workspace it concerns.
A feedback submission will not copy the contents of any other form on the page you were on. It will not store your raw IP address, an advertising identifier, an analytics identifier, or profile information unrelated to what you reported. Where a page address carries a secret — a verification or cancellation link, or a sign-in parameter — that secret will not be kept with the feedback. Please leave health, financial, and other sensitive information out of a feedback message: we do not need it to act on your report.
When structured feedback is enabled, we will associate a submission with your signed-in Mile Commons account so that we can keep it in the right scope, prevent misuse, investigate what you reported, and follow up with you where that is appropriate. Structured feedback will not be anonymous. You can always write to feedback@milecommons.com instead; email is handled as correspondence with you, not as a structured feedback record, and the two will be kept separate.
When structured feedback is enabled, feedback about the platform will be used to improve the product and how it works, to investigate bugs and problems, to correct content, to follow up operationally, and, where relevant, to look into safety or abuse. It will be available only to authorized Mile Commons platform personnel. It will not be shown to club leaders, event organizers, volunteers, or other users.
When structured feedback is enabled, feedback about a specific event will be linked to that event and the workspace running it, and will be used to resolve issues with the event, follow up operationally, improve the event experience, correct content or logistics, and, where appropriate, look into safety or abuse. It will be available only to the people authorized to operate that exact event, and to authorized Mile Commons platform personnel when necessary for platform operation, support, safety, or privacy or security responsibilities. It will stay inside that exact event and workspace: another club will gain no access merely by taking part in the same event, and event participation, club membership, volunteering, or ordinary account ownership alone will not give anyone the authority to review that event's feedback.
Structured feedback will be private operational information. It will not be published, will not be a discussion post, will not be shared automatically with participants, and will not be shared automatically with other clubs taking part in the same event. We may contact you about your feedback where that is appropriate, but we do not promise a reply to every submission.
When structured feedback is enabled, a submission will be stored in Mile Commons' own application data store, associated with your account and with the platform or event scope it belongs to, and will be kept for as long as it is reasonably needed to review it, resolve the issue, improve the product or the event, keep an operational record, look into safety or abuse, and meet legal or recordkeeping needs. There is no fixed period. It will be deleted or de-identified when no longer reasonably needed, subject to applicable retention needs — such as a security, abuse, or audit record, or a legal or recordkeeping obligation — as described in "How long we keep information".
Structured feedback is not analytics. Sending it will be something you choose to do, and it will be handled as a report we act on rather than as measurement of how you use the site. Mile Commons uses no analytics or tracking tools today, that remains separately gated, and feedback content is never used to build advertising profiles or to follow you across sites.
8. NYC 2026 pace-planning tool
Where the NYC 2026 pace-planning tool is available, it works without an account. It uses the goal and race-day choices you enter to produce a plan, and saves that plan as a snapshot reachable by an unguessable link for 180 days. A snapshot contains no name, email address, or account.
9. Security and audit records
We keep records of security-relevant and administrative actions, such as sign-in and account-linking events, changes to a registration, and organizer exports of a registration list. These records are designed to hold identifiers and digests rather than contact details, and organizer exports are limited to authorized coordinators and are logged.
We use these records only to protect accounts, investigate abuse, diagnose failures, and keep the service working. Access to them is limited to authorized operators who need it for those purposes. We do not use them for advertising or for analytics unrelated to operating and protecting the service, and they never make one club's information visible to another.
10. What we do not do
We do not sell personal information, show advertising, or share personal information for advertising. Mile Commons does not currently use analytics or tracking tools, advertising cookies, or cross-site identifiers.
Mile Commons may in the future use first-party, cookieless, aggregate product-usage measurement for basic product operation and improvement. It is not active today, and it will stay switched off in production until it is separately approved. If it is switched on, it will be limited to counting six things: a public page being viewed, a language being selected, and the start and completion of account sign-up and of event registration. Each count is stored only as a daily total by calendar day (UTC), type of event, the general kind of public page where relevant (for example "an event page" rather than the address you visited), and language where relevant.
That measurement will not use any visitor, session, account, device, or advertising identifier, cookie, or fingerprint. It will not store your IP address or build an identifier from it, and it will not record whether you are signed in. It will not record raw page addresses, query strings, form contents, or registration, event, club, workspace, or member identifiers, will not measure private event or workspace pages, and will not use personal or private runner information. It will not be used for advertising, profiling, or tracking across sites. Totals are kept in Mile Commons' own application data store, not sent to an analytics provider, and are deleted after 180 days. Individual visits are not stored, so one person's activity cannot be reconstructed from them. Access is limited to authorized Mile Commons platform personnel who need it. It is separate from the security and audit records in section 9, which are not used for it. Anything broader than this will require an update to this policy first.
If we introduce product analytics or any other new collection of information, we will update this policy before turning it on.
11. How we use information
We use information described in this policy only to:
- run event registration, waitlists, cancellation, and check-in for the event you signed up for;
- provide runner accounts and organizer access, and keep them secure;
- send the operational email described above;
- help clubs coordinate activities and volunteers;
- review and act on feedback you send us, and use it to improve the platform and its events;
- prevent abuse, investigate problems, and keep audit records;
- if and when it is separately approved and switched on, count basic product usage in aggregate, without identifying anyone, to operate and improve Mile Commons, as described in section 10;
- respond to messages you send us; and
- comply with law.
12. Who can see your information
Mile Commons is built on least-privilege access. Your registration is visible to the authorized organizers of the club or workspace hosting that event. Volunteers assigned to check-in see only what they need, such as your name, status, and attendance. Mile Commons does not publish participant lists.
Clubs are isolated from one another. One club's organizers cannot see another club's registrations or private records, and access to one club or event never carries over to another.
When structured feedback is enabled, feedback sent through Mile Commons will follow the same boundaries. Platform feedback will be available only to authorized Mile Commons platform personnel; it will not be shown to club leaders, event organizers, volunteers, or other users. Feedback about an event will be available only to the people authorized to operate that exact event, and to authorized Mile Commons platform personnel when necessary for platform operation, support, safety, or privacy or security responsibilities. Another club will gain no access merely by taking part in the same event, and event participation, club membership, volunteering, or ordinary account ownership alone will not give anyone the authority to review feedback.
If you ask to volunteer for an event, the authorized organizers of the club or workspace hosting that event whose organizer access covers your request may see the display name you chose for your Mile Commons account (or a general placeholder if you have not set one), the status of your volunteer request or participation, and when it was made or answered, so they can review and manage volunteer participation. Your volunteer request does not by itself give them your email address, phone number, or other private account or contact details, and it is not made public or shown to other runners or to other clubs.
For the operational contacts that organizers record for an event (section 5), the organizer, not Mile Commons, decides who can see each piece of information; Mile Commons provides the controls. For a contact's name, phone number, role, and responsible club or group, and for each responsible club or group listed for an activity, the organizer chooses one of three audiences: authorized organizers only; people registered for that exact event, together with authorized organizers; or the public. Every setting starts as authorized organizers only, and it reaches a wider audience only when an organizer deliberately chooses that. Each is set separately, so, for example, an organizer may share a role without sharing a name or phone number. Private organizer notes are never shown to registered participants or to the public.
Mile Commons applies the audience the organizer chose on its servers, before a page is built: a registered participant or a public visitor is sent only the information chosen for that audience, and information chosen for organizers only is not sent to them, rather than merely hidden on the page. Operational information about a station is shown to participants and the public only once that station is published. If an organizer chooses to make a contact's name or phone number public, it may be seen by anyone who visits the event's public page, including people with no Mile Commons account, and others may copy or save it; changing the setting later cannot recall copies already made. Mile Commons does not make operational contact information public on its own.
Only the authorized organizers who manage that exact event can enter, view, change, or remove its operational contacts and their audience settings. Naming a club or group as responsible for an activity is a coordination label only: it does not give that club or group, or its leads or members, access to this information or any authority over the event. This is enforced by the same server-side access rules, scoped to the organizer's relationship to that event, that keep clubs and events separate from one another.
BRIER SYSTEMS LLC personnel access personal information only when needed to operate, support, or secure the service.
An emergency contact provided for an event (section 3) is available only to the authorized coordinators of that event, and each time an authorized coordinator views it in Mile Commons, the access is logged.
13. Service providers
We rely on a small number of providers that process information on our behalf:
- Cloudflare — website hosting, database, request logs, human verification at sign-up, and organizer access control.
- Postmark — delivery of registration email.
- Google and Apple — sign-in, only if you choose to sign in with them.
- Google Workspace — the mailboxes that receive email you send to Mile Commons addresses.
14. Other disclosures
We may disclose information when we reasonably believe it is required by law or legal process, or necessary to protect someone's safety or the security and integrity of the service. If the operation of Mile Commons is transferred to another entity, information may be transferred with it, and this policy will continue to apply until you are told otherwise.
15. How long we keep information
We keep personal information only for as long as it is reasonably needed for the purpose it was collected for, to operate the platform, to prevent and investigate abuse, to keep the records described in this policy, and to meet our legal obligations. Some of that keeping and deleting is carried out by an operator on a schedule rather than by an automatic job, so the periods below describe when information becomes due for deletion rather than a guaranteed moment.
Participant details for an event are scheduled for deletion or de-identification 90 days after the event ends. De-identification replaces your name and email address with placeholders and removes your sign-up answers, while keeping the registration's non-identifying status. Some of these steps are carried out by an operator on a schedule rather than by an automatic job. Information may be kept longer where a legal obligation or dispute requires it.
Verification links expire after 30 minutes. Sign-in sessions expire, and sooner if unused. Pace-plan snapshots are kept for 180 days. Security and audit records are kept for at least one year and may be kept longer. Organizer and club records are kept while the club uses Mile Commons. If aggregate product-usage measurement described in section 10 is switched on, its daily counts are deleted after 180 days.
The short-lived registration-linking handoff cookie described in sections 2 and 4 expires after about 15 minutes, and your browser stops sending it at that point. That expiry only ends the cookie itself; it does not undo a linking that already succeeded. The resulting account-to-registration connection is a durable record and follows the same retention rules as your other registration and account information described in this section -- it does not disappear merely because the cookie has expired.
Operational contact information that organizers record (section 5) follows the principles in this section, and this policy sets no separate retention period for it. It is handled like other organizer records: it is kept only for as long as it is reasonably needed for event operations, and an organizer can correct or remove an entry at any time. As with other organizer records, some deletion is carried out by an operator on request rather than by an automatic job. Information that was made public may already have been copied by others, as described in section 12.
An emergency contact provided for an event (section 3) is deleted 7 days after the event ends.
Some records are kept beyond those periods because we still need them: a record that an account accepted a version of the Terms, a security or abuse record, a documented incident, an audit record, and anything a legal obligation or a dispute requires us to hold. We keep those for those purposes only.
16. Your choices
You can cancel a registration with the link in your registration email. You can browse without choosing a language, in which case no language cookie is set. Where runner accounts are available, you can manage your linked sign-in methods in account settings.
You may ask us for a copy of the personal information we hold about you, to correct it, or to delete it. Depending on where you live, you may have additional rights under local law, and we will respond as that law requires. We may need to confirm that a request comes from you, for example through the email address on your registration. We act on a valid request as far as the records we still have to keep allow, so a deletion request does not remove the records described in "How long we keep information", and we cannot promise that every record about you disappears at once. Mile Commons has no self-service download or deletion tool; a person handles these requests. Send these requests to privacy@milecommons.com.
If an organizer has recorded you as an operational contact for an event, you can make the requests described above even though you may have no Mile Commons account. Tell us the event or the organizer if you know it. We may need to confirm that the request comes from the person named, and we may involve the organizer who entered the information so that it can be corrected or removed. Send these requests to privacy@milecommons.com.
17. Adults only
During the current pilot, Mile Commons registration and runner accounts are for adults only. We do not collect a date of birth and do not independently verify age. If we learn that we hold information about someone who is not eligible to use Mile Commons, including a minor, we take reasonable steps to delete or de-identify it. We keep only what we still have to retain — for example a security or abuse record, a documented incident, a Terms acceptance record, or information a legal obligation requires us to hold — and we do not use it for anything else.
18. Where information is processed
Mile Commons is operated from the United States and currently serves events in the New York area. Information is processed in the United States and in other locations where our service providers operate. If you use Mile Commons from elsewhere, your information will be processed in those locations.
19. Security
We protect information with encrypted connections, by storing digests rather than secrets for links and sessions, and with the access and isolation rules described above. No service can promise perfect security.
20. Changes to this policy
We will update this page when our practices change and revise the version and date shown at the top. If a change introduces new collection, a new provider, a new analytics tool, or a new cookie or identifier, the update will be published before that change takes effect. This includes any expansion of the aggregate product-usage measurement described in section 10. Earlier released versions remain traceable in our internal records.
This version (2026-10-04.r1) adds disclosure, in sections 3, 12, and 15, of the optional phone number an event's sign-up form may ask for, used only for day-of coordination, and of the emergency contact collected for the Seven Bridges 2026 event: who can see it, that access to it is logged, and when it is deleted. It is not a new analytics tool or provider and does not change the aggregate product-usage measurement described in section 10.
The previous version (2026-10-01.r1) added disclosure, in sections 5, 12, 15, and 16, of the operational contact information that event organizers may record for event-day activities, including about people who have no Mile Commons account, and of the audience controls organizers use to decide who can see it. It is not a new analytics tool, provider, or purpose and does not change the aggregate product-usage measurement described in section 10.
An earlier version (2026-09-23.r1) added disclosure, in section 12, of what authorized organizers may see when you ask to volunteer for an event. It is not a new analytics tool and does not change the aggregate product-usage measurement described in section 10.
An earlier version (2026-09-21.r1) added disclosure of the short-lived cookie described in sections 2 and 4, used only when you choose to connect a verified event registration to your Mile Commons account. It is not a new analytics tool, is not part of any advertising or tracking program, and does not change the aggregate product-usage measurement described in section 10.
Changes to this policy are separate from changes to the Mile Commons platform Terms. An update here is never an acceptance step, and nothing you do with this policy is recorded as Terms acceptance.
21. Contact
Privacy questions, and requests about your personal information — asking for a copy of it, asking us to correct it, or asking us to delete it — may be sent to privacy@milecommons.com. That address is for privacy and data-rights matters; product feedback and problem reports go to feedback@milecommons.com.