Privacy Policy

Who we are

The Ennis Bluebonnet Run is organized by CROME — the Claudio Romero Organization for Minority Empowerment, a nonprofit based in Ennis, Texas. This policy covers the website at bluebonnetrun.com. Race registration itself happens on RunSignup, a separate company with its own privacy policy; what you enter there is governed by their terms.

Questions or requests about your information: use the contact form. It reaches CROME staff directly, and we reply to the address you give us.

Information you give us

Contact form

Name, email, optional phone number, subject, and your message. It is stored in our database and read by CROME staff so we can reply.

Store orders

When you buy from the race store, Stripe collects your payment details and passes us your name, email, the items you ordered and (for shipped orders) your shipping address and phone number. We keep that order record to pack, ship, support and refund it, and we email you about it: confirmation, changes you make, packing, shipping or pickup, and a notice if a ship date moves. Card numbers never reach our systems. Sold-out “notify me” requests store just your email and the item.

Race updates list (“notify me”)

Name and email, so we can tell you when registration opens and share race news. Ask us any time to be removed.

Shirt swap

First name, email, the name on your registration, shirt type and sizes, how you prefer to exchange, your city, and only the first three digits of your ZIP code. We check the registration name and email against the registration records our nonprofit already holds to confirm you ran the race. When two runners both confirm a match, we share each runner’s first name and email with the other — that is the point of the feature, and it is stated on the form. Listings expire after 14 days. To protect the feature from abuse, failed or suspicious attempts are logged with a hashed (one-way scrambled) network address and browser description.

Virtual race results

If you verify a virtual entry, the email you enter is checked against our registration records and is not used for anything else.

What we collect automatically

We run our own visit measurement instead of relying on a third-party analytics account. For each visit we record:

• Pages viewed, buttons clicked, how far you scroll, and time spent on sections
• Device type (phone, tablet, computer), browser, operating system, and screen size
• Browser language and timezone
• The site that referred you and any campaign codes in the link — including advertising click IDs such as gclid when you arrive from an ad
• Country and city, estimated from your network address by our hosting provider — we do not store the address itself in analytics, and we never use GPS
• A random visitor ID saved in your browser so returning visitors are not counted twice — it is a meaningless string, not your identity
• If a page crashes, an error report with the page address and browser version

Your network (IP) address is processed briefly to protect the site from abuse (rate limiting) and to derive the rough location above; it is not kept in our analytics records.

Cookies & browser storage

Our own code sets no cookies for visitors. The one cookie we create is a login cookie for site staff. Our visit measurement uses browser storage instead: the random visitor ID, a per-visit session ID, and small conveniences like your race-day checklist and a “seen the map instructions” flag. These stay on your device and are not readable by other websites.

Google’s tags do set cookies. We use Google Tag Manager and Google Ads measurement (see the next section), and Google sets its own cookies — such as _gcl_au and DoubleClick cookies — to measure whether our ads work and to show relevant ads. If you have opted out (see Your choices), or your browser sends Global Privacy Control or Do Not Track, we do not load Google’s tags at all, so none of these cookies are set. You can also block or clear them in your browser settings.

Embedded YouTube videos use YouTube’s privacy-enhanced player and load nothing from YouTube until you press play.

Advertising measurement

We advertise the race with Google Ads. Google’s tag on this site counts conversions (for example, a click through to registration) and supports remarketing, which means Google may use its cookies to show you our ads elsewhere. We do not run a Facebook pixel or any other advertising tracker.

To limit this:

• Use the switch under Your choices, or turn on Global Privacy Control in your browser — either one stops Google’s tags from loading here
• Adjust your ad personalization at adssettings.google.com
• Use your browser’s tracking protection or block third-party cookies
• Install Google’s opt-out tools

Services we rely on

Like nearly every website, we use a few companies as processors to run the site. They receive only what is needed to do their job:

We do not sell, rent, or trade personal information, and outside of the services above we do not share it with anyone unless the law requires it.

How long we keep things

• Contact messages: kept while we handle them and for our records of the conversation.
• Race updates list: until you ask to be removed or the list is retired.
• Shirt swap: listings expire after 14 days; the records are kept for the event year, then reviewed.
• Analytics: kept long-term so we can compare seasons — but they contain no names or emails, and we delete a device’s records on request.

Your choices

• See, fix, or delete your information: send a request through the contact form and we will handle it — access, correction, or deletion.
• Privacy signals: if your browser sends Global Privacy Control or Do Not Track, our own analytics stay off and Google’s advertising tags are not loaded — automatically, with nothing to click.
• Leave the updates list: reply to any email from us or contact us, and we will remove you.

Children

This website is meant for parents, runners, and community members — it is not directed to children under 13, and we do not knowingly collect their information online. Kids 5K registrations are made by a parent or guardian on RunSignup.

Security & where data lives

The site is served over HTTPS, database access is restricted, and forms are rate-limited against abuse. Our services process data in the United States. No website can promise perfect security, but we keep what we collect small — that is the best protection there is.

Changes to this policy

When the site gains a feature that changes what we collect, we update this page and the date at the top before it ships.