Privacy Policy

Who we are

The Ennis Bluebonnet Run is organized by CROME — the Claudio Romero Organization for Minority Empowerment, a 501(c)(3) nonprofit based in Ennis, Texas (EIN 93-4577360). This policy covers the website at bluebonnetrun.com. Race registration itself happens on RunSignup, a separate company with its own privacy policy; what you enter there is governed by their terms.

Questions or requests about your information: use the contact form. It reaches CROME staff directly, and we reply to the address you give us.

Information you give us

Contact form

Name, email, optional phone number, subject, and your message. It is stored in our database and read by CROME staff so we can reply.

Store orders

When you buy from the race store, Stripe collects your payment details and passes us your name, email, the items you ordered and (for shipped orders) your shipping address and phone number. We keep that order record to pack, ship, support and refund it, and we email you about it: confirmation, changes you make, packing, shipping or pickup, and a notice if a ship date moves. Card numbers never reach our systems. Sold-out “notify me” requests store just your email and the item.

Race updates list (“notify me”)

Name and email, so we can tell you when registration opens and share race news. Ask us any time to be removed.

Shirt swap

First name, email, the name on your registration, shirt type and sizes, how you prefer to exchange, your city, and only the first three digits of your ZIP code. We check the registration name and email against the registration records our nonprofit already holds to confirm you ran the race. When two runners both confirm a match, we share each runner’s first name and email with the other — that is the point of the feature, and it is stated on the form. Listings expire after 14 days. To protect the feature from abuse, failed or suspicious attempts are logged with a hashed (one-way scrambled) network address and browser description.

Virtual race results

If you verify a virtual entry, the email you enter is checked against our registration records and is not used for anything else.

What we collect automatically

When tracking is enabled, our own visit measurement records the following on public pages. Vercel also provides cookieless page-view measurement, controlled by the same tracking preference:

• Pages viewed, buttons clicked, how far you scroll, and time spent on sections
• Device type (phone, tablet, computer), browser, operating system, and screen size
• Browser language and timezone
• The referring site’s origin (not its full URL) and selected campaign codes in the link — including advertising click IDs such as gclid when you arrive from an ad
• Country and city, estimated from your network address by our hosting provider — we do not store the address itself in analytics, and we never use GPS
• A random visitor ID saved in your browser to recognize repeat visits; it is pseudonymous, not anonymous
• If a public page crashes, a diagnostic report with a sanitized page path and browser information

If you start a store checkout while tracking is enabled, we save the analytics session ID alongside the checkout. A completed payment can add an event containing the order number, amount, item count, and fulfillment method. Authorized staff can connect this activity to your order and its contact details. Turning tracking off prevents new checkout attribution; it does not undo a checkout link already saved or delete earlier records. Contact us to request deletion.

Private order-status, order-lookup, and payment-confirmation pages are excluded from browser analytics and advertising tags. Our visit measurement stores public page paths without query strings or fragments, removes private URLs from diagnostic data, and stores only the origin of a referring site. Necessary order processing still runs on private pages.

Daily sponsor views, clicks and visible-time totals are also available to authorized CROME staff in the Supporter hub. Staff may share these aggregate results with the relevant sponsor. The hub does not receive visitor or session identifiers, locations, IP addresses or registration information from this export. Aggregate hub reports are retained for up to two years.

Your network (IP) address is processed briefly to protect the site from abuse (rate limiting) and to derive the rough location above; it is not kept in our analytics records.

Location-based race order

Our hosting provider, Vercel, estimates your country and state or region from your network (IP) address. We use that estimate to show virtual races first when you appear to be outside Texas. Visitors in Texas, or whose location is unavailable, see the standard race order. All races remain available. The estimate can be inaccurate, including when you use a VPN.

This feature uses no GPS or browser location permission and adds no cookies or browser storage. The race-order check does not save your state or its ordering decision in our database or analytics. It still operates when analytics and advertising are turned off; the choices below control visit measurement and advertising tags.

Cookies & browser storage

We use browser storage for visit measurement and preferences. The random visitor ID expires after 13 months and is replaced on a later tracked visit. A session ID expires after 30 minutes of inactivity. We save your tracking opt-out in local storage and in a functional cookie lasting one year so our server can honor it too. Local storage remains until you change the choice or clear it. Staff login and store-preview access also use functional cookies. Your bag, saved items, race-day checklist, and map preferences use browser storage to provide those features. These preferences are separate from analytics.

Google’s tags do set cookies. We use Google Tag Manager and Google Ads measurement (see the next section), and Google sets its own cookies — such as _gcl_au and DoubleClick cookies — to measure whether our ads work and to show relevant ads. If you have opted out (see Your choices), or your browser sends Global Privacy Control or Do Not Track, we do not load Google’s tags on subsequent page loads. The switch reloads the current page to stop tags already running. Cookies Google previously set may remain; you can clear them in your browser settings. Essential hosting, checkout, maps, and media requests are separate from this analytics control.

Embedded YouTube videos use YouTube’s privacy-enhanced player and load nothing from YouTube until you press play.

Advertising measurement

We advertise the race with Google Ads. Google’s tag on this site counts conversions (for example, a click through to registration) and supports remarketing, which means Google may use its cookies to show you our ads elsewhere. We do not run a Facebook pixel or any other advertising tracker.

To limit this:

• Use the switch under Your choices, or turn on Global Privacy Control in your browser — either one stops Google’s tags from loading here
• Adjust your ad personalization at adssettings.google.com
• Use your browser’s tracking protection or block third-party cookies
• Install Google’s opt-out tools

Services we rely on

These services receive information to provide hosting, payments, communications, measurement, advertising, and other website features. Their roles and privacy terms depend on the service:

We do not sell customer or participant lists for money. Google’s advertising services receive data as described above; depending on the applicable law and service configuration, advertising disclosures may be treated as a sale or sharing of personal information. Use Your choices to turn off those tags. Other disclosures include the services and runner-to-runner shirt swaps described here, and disclosures required by law.

How long we keep things

• Contact messages: kept while we handle them and for our records of the conversation.
• Race updates list: until you ask to be removed or the list is retired.
• Shirt swap: listings expire after 14 days; the records are kept for the event year, then reviewed.
• Our detailed visit and purchase analytics: scheduled cleanup removes records older than 13 months and clears checkout-to-analytics links after the same period. This lets us compare race seasons. Identified order, payment, and support records are kept separately as needed for fulfillment, refunds, accounting, and legal obligations.
• Our diagnostic error reports: scheduled cleanup removes reports older than 30 days.
• Summary totals: daily counts and monthly or yearly reports may be retained indefinitely to compare historical seasons. They contain totals and grouped statistics, including public page categories, campaign and sponsor performance, purchase amounts, and website performance. They do not retain visitor or session IDs, order identifiers, advertising click IDs, private URLs, or individual browsing histories. We combine small groups where needed, do not attempt to identify people from these reports, and require the same protection from anyone we share them with. Aggregate Supporter hub reports are retained for up to two years.

The analytics limits above apply to our live database. Hosting backups and records held by Google, Vercel, and other providers follow their retention settings and terms. Contact us for help with a deletion request involving those services.

Your choices

• See, fix, or delete your information: send a request through the contact form and we will handle it — access, correction, or deletion.
• Privacy signals: if your browser sends Global Privacy Control or Do Not Track, our own analytics, Vercel Web Analytics, and Google’s advertising tags stay off automatically. We also keep tracking off when we cannot read your browser’s stored preference.
• Leave the updates list: reply to any email from us or contact us, and we will remove you.

Children

This website is meant for parents, runners, and community members — it is not directed to children under 13, and we do not knowingly collect their information online. Kids 5K registrations are made by a parent or guardian on RunSignup.

Security & where data lives

The site is served over HTTPS, database access is restricted, and forms are rate-limited against abuse. Our providers may process information in the United States and other countries under their service terms. No website can promise perfect security.

Changes to this policy

When the site gains a feature that changes what we collect or how we use information, we update this page and the date at the top before it ships.