Privacy Policy
Last updated 30 August 2026
BibSwap is a marketplace for transferring race entries between runners in Australia and New Zealand. This page explains what we collect, why, and what you can ask us to do about it. If anything here is unclear, email hello@bibswap.com.au and we'll answer.
What we collect
Your account. When you sign in we hold your email address. We use a sign-in link rather than a password, so we never hold a password for you at all.
Listings. When you list a bib we store the race, the price, any notes you write, and the contact email and phone number you give for that listing. Those contact details are encrypted before they are stored and are only ever decrypted to run the transfer you asked for.
Race alerts. If you ask to be told when a bib appears for a race, we store your email address encrypted, plus a one-way hash of it. The hash exists only so we can tell that two requests are the same person without being able to read the address to do it.
Messages. When a buyer contacts a seller, the message goes through our relay: each conversation gets its own forwarding address, so the two of you can email each other without either address being revealed until the transfer is agreed. We store the messages that pass through the relay so the conversation survives and so we can look into a dispute.
Transfers. When a transfer completes, we record that each side confirmed it, and any feedback you give us if it went wrong.
Technical. Our hosting keeps standard server logs. We rate-limit some pages to prevent abuse; the counters are keyed on a hash supplied by the page, never a raw IP address or email.
Analytics and cookies
We use Google Analytics to count visits and see which pages people use, so we know what to fix. It sets cookies in your browser and tells Google your approximate location, browser and the pages you viewed. We do not send it your name, email address, or anything else that identifies you.
You can opt out for every site you visit with Google's browser add-on, or block cookies in your browser settings. Nothing on BibSwap stops working if you do.
The only other cookies we set are the ones that keep you signed in. There is no advertising or cross-site tracking on this site.
Who else sees it
We do not sell your information and we do not share it for marketing. It reaches four suppliers, each doing one job for us:
- Supabase — the database and sign-in system that stores everything above.
- Resend — sends our emails and carries the relay between buyer and seller.
- Vercel — hosts the website and keeps server logs.
- Google Analytics — counts visits, as described above.
These suppliers store data outside Australia. We would also disclose information if the law required it.
One thing worth being plain about: a transfer only works if the race organiser can put the entry in the buyer's name. That step happens on the organiser's own system, between the two of you — we don't send your details to the race, and whatever you give them is covered by their privacy policy, not this one.
How long we keep it
Listings, alerts and the messages attached to them are kept while your account is open, so you can see your own history. Ask us to delete your account and we remove your listings, alerts and contact details. We may keep a minimal record of a completed transfer where we need it to resolve a dispute or because the law requires it.
Your choices
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email hello@bibswap.com.au and we'll do it. Every alert and newsletter email has an unsubscribe link, which works without signing in.
Security, and its limits
Contact details and alert addresses are encrypted before storage. Access to the database is restricted per-user by the database itself, not only by the app. We use a sign-in link instead of a password so there is no password of yours to leak.
No system is perfectly secure, and we would rather say so than imply otherwise. If a breach ever affected you, we would tell you.
Children
BibSwap is not intended for under-18s and we don't knowingly collect their information. If you believe a child has given us details, email us and we'll remove them.
Changes
If we change how we handle your information we will update this page and the date at the top. If the change is significant, we'll tell you by email.
Contact
Questions or complaints: hello@bibswap.com.au. If you are in Australia and you are not satisfied with how we have handled a privacy complaint, you can escalate it to the Office of the Australian Information Commissioner at oaic.gov.au.