Privacy Policy

Effective November 3, 2026 · Comeback Software LLC · mail@comebacksoftware.com

Covers Find The RunFind The ConcertBucket and comebacksoftware.com. It replaces the separate policies those products had before.

1. Who we are and what this covers

Comeback Software LLC ("Comeback Software", "we", "us") is a small software studio in San Francisco, California. This policy covers everything we make:

• Find The Run: the website at findtherun.com and the Find The Run iOS app.
• Find The Concert: the website at findtheconcert.com.
• Bucket: the Bucket iOS app and the website at trybucket.app.
• comebacksoftware.com, this site.

Each product is described in its own section below. Sections 6 through 18 apply to all of them. When a product's own pages link to a privacy policy, they link here.

We are the "controller" or "business" for this information, in the words of privacy laws. This policy does not cover other companies' sites and apps that we link to, such as race registration sites, ticket sellers, Spotify or the App Store. Their own policies apply there.

2. What we collect

Across our products, the information we collect falls into these groups. The product sections say exactly which apply to each.

• Account information. Whatever your chosen sign-in gives us: name, email address, phone number, and a provider ID from Apple, Google, Facebook, Strava or Clerk. Plus what you set yourself, such as a username, display name, profile photo, bio, home city and settings. With Sign in with Apple you can hide your real email address.
• Things you add or sign up for. Saved races, clubs or places; lists and notes; visits, ratings and votes; plans and comments; photos; race or club submissions; song picks; alert, reminder and newsletter sign-ups; messages you send us.
• Contacts (Bucket only, only if you allow it). See section 5.
• Location. Only where a section below says so, and never in the background.
• Device and usage information. Device and app or browser type, app version, push notification tokens, a random device identifier in some cases, screens and pages viewed, searches, buttons tapped, days you opened an app, and the IP address on each request to our servers.
• Payment information (race organizers buying a featured listing on Find The Run). Stripe processes the card. We receive your name, email, what you bought and a Stripe reference, never the full card number.
• Inferences. Find The Run infers a likely home city and state from your activity, and Find The Concert computes music-taste weights from the artists you pick. Nothing else is inferred about you.

We do not collect government IDs, financial account numbers, health data, biometric data, race or ethnicity, religion, sexual orientation, or anything about your background. We never ask for your date of birth.

3. Find The Run

findtherun.comFind The Run iOS app

Accounts

You can use the website and most of the app without an account. If you sign in, on the website you can use Google, Facebook or an email code; in the app you can use Apple, Google or an email code, through our sign-in provider Clerk. (Strava and Apple are also configured for the website and may appear as options.) We store your name, email address, which sign-in method you used, and the provider's ID for you. One account works in both places: an app sign-in is matched to an existing website account by verified email address.

What we store for you

• Saved races and run clubs, and whether you asked for a race-week reminder.
• Your settings: units, home city and state, newsletter choice, and notification choices.
• Email sign-ups that may not be tied to an account: weekly race alerts for a location, race-week reminders, the Run Charts digest, the newsletter, and coaching interest.
• Song of the Run picks (the Spotify track you choose for a race). If you are signed out, a random identifier stored on your device is used instead of an account.
• Races and run clubs you submit, edit or claim, including logos you upload, course files (GPX) and the email on the upload, and any coupon codes you add. Submitted content is public once approved.
• Searches you run on the site or in the app, what you selected, and which Register buttons you tap. These help us see which races people want and are kept without your account after you delete it.
• Which days you opened the app.
• If you buy a featured listing: the listing, the invoice email, and the Stripe payment reference.

Location

• In the app, only if you allow it, the app reads your device location while you are using it, turns it into a city name on the device, and sends the coordinates to our server with your search so we can sort races by distance. We do not save those coordinates to your account. They can appear in our server request logs for a short time, like any request.
• On the website, we may look up an approximate city from your IP address to show nearby races.
• Inferred home city. From where you set alerts, what you save, and a once-a-day signal of the city you are browsing, we infer a likely home city and state for your account. We use it to pick nearby races for you and to build aggregate counts (for example, how many Find The Run users are in Denver) for race organizers and partners. Those counts never identify you.

Notifications and email

• Push notifications in the app are race-week reminders only. We store your device's push token and a record of what we sent. You can turn them off in settings or in iOS.
• Emails are sent through Resend from mail.findtherun.com. Every alert, reminder and digest has an unsubscribe link, and reminders and the song digest support one-click unsubscribe from your mail app.
• The newsletter checkbox on sign-in is a choice you can untick. The newsletter itself is published on Substack; if you subscribe there directly, Substack's privacy policy applies to that subscription.

Organizers and sponsors

If you claim or submit a race, we store your account as its owner so you can edit it, and you can see traffic totals for your listing. Featured listings are bought through Stripe Checkout. Some races we import come from registration partners who manage their own listings.

Website analytics and ads

The website uses Plausible and Google Analytics 4. It may show ads through Raptive. See section 8 for how that works and how to opt out.

Deleting your account

In the app: You → Delete account. On the website, email us. Section 11 says exactly what is removed.

4. Find The Concert

findtheconcert.com

Find The Concert has no accounts and no sign-in. Browsing it does not require giving us anything. These are the only ways it collects information:

• Email alerts. If you ask to be notified about an artist, venue or city, we store your email address, what you asked about, when you signed up, and which events we have emailed you about. Every email has an unsubscribe link (one-click from your mail app, too).
• For You and the monthly lineup email. If you pick artists on the For You page, your picks and the music-taste weights we compute from them are kept in a signed, HTTP-only browser cookie named ftc_taste for 60 days, so the page remembers you. They are not stored on our server unless you sign up for the monthly email. If you do, we store your email, display name, the artists and taste weights, and the location you gave (see next item).
• Location. On the For You page you can type a city or tap "use my location". If you tap it, your browser asks your permission, and the coordinates are rounded to about 100 meters and kept in your browser's local storage. They are sent to our server only with your request for recommendations, and not stored, unless you sign up for the monthly email, in which case the rounded location and its label are saved with your email so the lineup is local to you. You can remove the saved location on the page at any time. We do not geolocate you from your IP address.
• Technical data. IP addresses are used in memory to rate-limit sign-ups and our public data endpoint; they are not stored in our database. If someone hits a rate limit, a notice with the IP address is emailed to us so we can investigate abuse. Our hosting provider keeps standard server logs.
• Analytics. Plausible, which uses no cookies and no personal identifiers. We also count ticket-link clicks by type. See section 8.
• Browser storage. Besides the cookie above, local storage remembers which alerts you already signed up for and your For You location.

Event, artist and venue information comes from the Ticketmaster Discovery feed and public sources. "Get Tickets" takes you to Ticketmaster or the relevant seller; their privacy policy covers the purchase. Many of those links are affiliate links, which earn us a commission from the seller based on the anonymous click, not on who you are. Artist images and search on the For You page come from Spotify; what you type in the artist search is sent to Spotify to find matches. Images are served through Bunny CDN and wsrv.nl, which see your IP address the way any image host does.

To delete alert sign-ups or a For You profile outright rather than just unsubscribing, email us. "Start over" on the For You page clears the cookie.

5. Bucket

Bucket iOS apptrybucket.app

Bucket is built around friends, so it holds more than our other products. Here is all of it.

Account

Bucket requires sign-in from the first open, with Apple, Google or your phone number, through Clerk. Phone sign-in sends a code by text message; carrier rates may apply. Clerk holds your email address, phone number and Apple or Google identity. Our own database stores your Clerk ID, username, display name, bio, profile photo, home city, the neighborhood you say you live in (never shown on your profile), a keyed hash of your phone number so friends who share contacts can find you, when you joined, when you were last active, how you found Bucket, and your visibility and reminder settings. We do not store your email address in Bucket's own database.

Every new member starts out connected to one account belonging to the Bucket founder, so there is someone to compare lists with on day one. You can remove that connection like any other friend.

What you add

• The places you save, your lists (private, friends-only or public, private by default), and any notes you write on them.
• The places you have been, with your rating (loved it, fine, not for me), the date, and whether it was part of a plan.
• Your votes on places, including flags.
• Plans: the place, options and times, who is invited, answers, short notes and comments, reactions, declines, and who went.
• Photos you attach to a visit. The image file is stored with Cloudflare Images. We keep the date the photo was taken (from its metadata) and nothing else from the metadata; the image we deliver has no location data in it. Photos are re-encoded on your device before upload.
• Private places you add from a search, for example your home. These are stored as places only you can see.
• Suggestions you send us, and searches that found nothing, so we can improve the list. A log of what you searched for and what you opened is also kept.
• Friend requests, friendships, dismissed suggestions, blocks and reports.

Contacts, only if you allow it

If you grant access, the app reads the names and phone numbers in your address book (up to 5,000 numbers) and sends them to our server to find friends who are already on Bucket and to tell you when someone you know joins. On the server, each phone number is replaced with a keyed one-way hash (an HMAC with a secret only our server holds), and we store that hash together with the contact's name and when it was synced. The sync repeats about weekly while access stays on. You can turn it off and delete all your synced contacts at any time in Profile settings, and we delete them when you delete your account. We do not contact your contacts, and we never show your address book to anyone else. By sharing contacts you confirm you are comfortable with us using them this way.

Other device access

• Location: the map can show your blue dot while the app is open, if you allow it. The location stays on your device and is never sent to us.
• Photo library and camera: for your profile photo and place photos. The app only sees what you pick or take.
• Calendar: if you ask, the app adds plans to your calendar. It does not read your calendar.
• Push notifications: we store an Expo push token for your device, which notifications we sent you, and the text of each one. Notifications cover friends, plans, lists, badges, streaks, recaps and occasional suggestions. Suggestion pushes are capped at two a day and never late at night. Everything can be turned off in settings or in iOS.

Invites and attribution

When you share an invite or plan link, the page at trybucket.app shows your username and, for plans, the place, time and how many are going, to anyone who has the link. When someone opens the link we record a keyed hash of their IP address and their iOS version for 72 hours, so that if they install Bucket in that window we can credit you with the invite. The hash is then deleted. We never store the raw IP address.

Usage data

Bucket records how it is used (screens opened, pushes tapped, links shared, session length) in our own database, with no third-party analytics or crash-reporting software in the app. The raw event rows are deleted after 90 days; only daily totals remain. trybucket.app uses Plausible, which sets no cookies.

Deleting your account

In the app under Settings. Section 11 says what is removed.

6. How we use information

• To provide the product. Show you races, concerts and places; keep your saves, lists, plans and settings in sync; find your friends; send the alerts, reminders, digests and notifications you asked for; process featured-listing purchases; show organizers totals for their listings.
• To make it better. See which searches miss, which places people save, which features get used, and where our users are, in aggregate.
• To keep it safe. Rate-limit abuse, check submissions and profiles for spam and abuse, act on reports and blocks, and investigate problems.
• To talk to you. Answer your messages, and tell you about important changes to a product or this policy.
• To meet our legal obligations, such as keeping payment records for tax purposes and responding to lawful requests.

If you are in the European Economic Area, the United Kingdom or another place with similar laws, our legal bases are: performing our agreement with you (providing the product you signed up for); our legitimate interests (improving and securing our products, measuring aggregate use, and defending our rights), balanced against yours; your consent, where we ask for it (contacts, location, notifications, marketing email), which you can withdraw at any time; and compliance with law.

We do not use your personal information for automated decisions that have legal or similarly significant effects on you.

7. Who we share it with

We do not sell your personal information, and we do not rent or trade it. We share it only in these ways:

Service providers that work for us

These companies process information on our behalf, under contracts that limit them to providing their service. Which ones apply depends on the product.

Other people on the product

Section 10 describes what friends, organizers and the public can see.

Sites you leave for

Register and Get Tickets buttons take you to race registration sites and ticket sellers. Some of those links carry an affiliate or referral code (for example RunSignUp, Race Roster, Ticketmaster via Impact, and Amazon as an Amazon Associate) so the seller can pay us a commission. The seller learns that the click came from us, not who you are. Their privacy policies apply once you are there.

When the law or safety requires

We may disclose information to comply with law, a court order or a lawful request; to enforce our terms; to protect the rights, property or safety of our users, the public or Comeback Software; or to investigate fraud or abuse.

If the business changes hands

If Comeback Software or one of its products is sold, merged or reorganized, your information may transfer with it. This policy will keep applying to it until you are told otherwise and given any choices the law requires.

We may also share aggregated or de-identified information that cannot reasonably identify you, such as how many users are in a city or how often a race is saved. We will not try to re-identify it.

8. Ads, analytics and cookies

Ads on findtherun.com

The Find The Run website is built to show ads through Raptive (CMI Marketing, Inc.) and its advertising partners. When ads are switched on, Raptive and its partners set cookies and use similar technologies to choose and measure ads, which can involve your IP address, device and browser details, and the pages you visit on the site. Under California law this can count as "selling" or "sharing" personal information for cross-context behavioral advertising, even though no money changes hands for your data and we never give advertisers your name, email or account. When ads are on, a "Do Not Sell or Share My Personal Information" link appears in the website footer, Raptive's consent tool honors Global Privacy Control signals from your browser, and you can also opt out through Raptive's privacy statement. When ads are off, which is the case at the effective date of this policy, no ad cookies are set and no selling or sharing happens. The apps never show ads. Find The Concert and Bucket never show ads.

Analytics

• Plausible (all our websites) counts page views, referrers, outbound clicks, country and device type without cookies or persistent identifiers.
• Google Analytics 4 (findtherun.com only) uses cookies to measure how the site is used. We use it for measurement only, not for Google's advertising features. You can block it with Google's opt-out browser add-on or any cookie blocker.
• The apps use no third-party analytics or crash-reporting SDKs. Our own servers record what we describe in sections 3 and 5.

Cookies and local storage we set ourselves

trybucket.app and comebacksoftware.com set no cookies of their own. We do not currently show a cookie banner because, apart from the ad cookies described above, we set only cookies that are needed for sign-in or for a feature you asked for. You can clear or block cookies in your browser; signing in will not work without them. We respond to Global Privacy Control signals as described above; we do not respond to "Do Not Track" headers, which have no agreed meaning.

9. AI and automated checks

We use AI models from OpenAI and Anthropic in limited, specific ways. None of them profile you, and none make decisions about you with legal effect.

• Spam and abuse checks. Race and club submissions on Find The Run (the description, logo URL, name and links) are checked by OpenAI's moderation API and by Anthropic's Claude for spam and policy violations before an editor looks at them. On Bucket, display names and bios are checked by OpenAI's moderation API, and every photo you attach to a visit is checked by OpenAI's image moderation before friends can see it. A human makes the final call on anything flagged.
• Generated content. Bucket's place illustrations and short place descriptions are generated by OpenAI from the place's name, category, neighborhood and a line about it. If you add a private place such as your home, its name (which may be an address) and neighborhood may be sent to generate its illustration; nothing about you is included. Find The Run uses Claude with web search to research and verify run clubs from public sources. Find The Run race descriptions are the organizers' own text, not AI-written.
• Public data endpoints. Find The Run and Find The Concert each run a public endpoint (an MCP server) that lets AI assistants look up races and events. They return public listing data only, never user information.

We use these providers through their business APIs, whose terms say they do not use what we send to train their models.

10. What other people can see

Find The Run

• There are no public profiles and no friends. Nobody sees your saves, alerts or settings.
• Races and clubs you submit or claim are public once approved, including logos and course files. Your name is not attached to them publicly.
• Song of the Run charts are built from everyone's picks and show counts, never who picked what.
• Race organizers see traffic totals for their own listing, never individual users.

Find The Concert

Nothing you give us is shown to anyone else.

Bucket

• Friends (people who have accepted a friend request, in either direction) can see: your lists set to friends-only or public; the places you have been and your rating of each, including "not for me"; your month-by-month memories unless you set them to private; your photos; what you and they have in common; and your recent activity in their feed. Friends you add later see the same as earlier friends, including older photos.
• Everyone on a plan sees the plan, who is in, answers, notes and comments. Comments never appear outside the plan.
• People who are not your friends can find you by username or, if you both share contacts, by phone number, and can see your username, display name, profile photo and bio when sending a friend request. They cannot see your lists, visits or photos.
• Anyone with an invite or plan link sees your username and, for a plan, the place, time and how many are going.
• The public sees nothing else. Bucket has no public profiles and no public web pages for your activity. Votes count toward a city's list anonymously, and "not for me" votes are never shown in public counts.
• Blocking someone hides you from them and them from you.
• Private notes on list items are visible only to you. Lists are private by default.

Our team

The people who run Comeback Software can see account activity, including plans and the text of notifications we sent, so we can run the products, keep them safe, act on reports, and fix problems. On Find The Run, staff can view the website as a specific user to reproduce a bug. We do not read Bucket private notes, and we do not look at anyone's data out of curiosity.

11. How long we keep it, and deleting it

We keep your information while your account is open or your sign-up is active, and then as described here.

Deleting a Find The Run account

In the app: You → Delete account. On the website, email us from the address on your account. Deletion removes your account from Clerk and from our database, which also removes your saves, settings, push tokens, notification history, app activity, and every alert, reminder, digest, newsletter, coaching and song-pick sign-up under your email address. What stays: your search history and Register taps, with your account removed so they are no longer linked to you; course files you uploaded that are already part of a public race, with your email removed; and featured-listing purchase records, which we must keep for tax and accounting purposes, with your account unlinked. Races and clubs you submitted stay public.

Deleting a Bucket account

In the app under Settings. Deletion removes your account from Clerk and from our database, including your profile and photo, lists and notes, visits, votes, photos (the files are queued for deletion at Cloudflare), plans you created, comments and answers, friendships, synced contacts, push tokens, notifications, usage events, search history, suggestions and blocks. What stays: lists and plans that other people are on pass to one of them without you; reports you made or that were made about you, so we can keep moderation history; private places you added, which no longer link to you; and the rows showing a notification was sent, with your identity removed. Invite and plan pages for links you shared stop showing you.

Find The Concert

Unsubscribing marks your sign-up as stopped but keeps the row so we never email you again by mistake. Email us to have alert sign-ups and any For You profile deleted outright.

Everything else

• Bucket raw usage events: 90 days, then only daily totals.
• Bucket invite attribution (hashed IP and iOS version): 72 hours.
• Find The Run inferred home city: as long as the account exists.
• Server and request logs at our hosting and monitoring providers: their standard short retention, typically days to a few weeks.
• Emails you send us: as long as needed to answer and keep a record of the exchange.
• Payment records: as long as tax law requires, generally seven years.
• Backups: our database backups roll over on a short cycle; deleted data drops out of them as they expire.

12. Your rights and choices

We give everyone the same rights, no matter where you live. You can ask us to:

• Tell you what personal information we hold about you, where it came from, what we use it for and who we share it with.
• Give you a copy of it in a usable format.
• Correct anything wrong. Most profile fields you can change yourself in the app or on the site.
• Delete it, as described in section 11.
• Stop marketing email: use the unsubscribe link in any email, or untick the newsletter choice in your settings.
• Withdraw consent you gave for contacts, location or notifications, by changing the permission in the app or in iOS settings.
• Opt out of the sale or sharing of personal information for advertising, where that happens (section 8).
• Limit the use of sensitive personal information. We use the sensitive information we hold (precise location, contacts, phone numbers) only to provide the feature you asked for, which the law allows without a separate opt-out, and never to infer characteristics about you.
• Object to or restrict processing based on our legitimate interests, where you live somewhere that gives you that right.

How to ask. Email mail@comebacksoftware.com from the email address on your account, or from the app with your username. We will confirm receipt within 10 business days and respond within 45 days (we may extend by another 45 days for complex requests and will tell you if so). We may ask you to verify that you are who you say you are, for example by replying from the email on the account or confirming details only the account holder would know. An authorized agent may make a request for you if they provide your signed permission and you confirm it with us. We will never treat you differently for exercising your rights: no different prices, service or quality. If we turn down a request, we will tell you why, and you can appeal by replying to our decision; we will answer the appeal within 45 days and tell you how to complain to your state's attorney general or your data protection authority if you still disagree.

Residents of California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia and other US states with privacy laws: the rights above cover what your state's law gives you, including the rights to know, access, correct, delete, obtain a copy, opt out of targeted advertising, sale and profiling, and appeal. We do not engage in profiling that produces legal or similarly significant effects, and we do not sell personal information for money.

Nevada residents: we do not sell personal information as Nevada law defines it. You can still send us an opt-out request for the record.

EEA, UK and Swiss residents: you also have the right to lodge a complaint with your supervisory authority. We would appreciate the chance to address it first. We have no establishment in the EU or UK and have not appointed a representative; contact us directly at the address below.

13. California notice at collection

This table is our notice at collection under the California Consumer Privacy Act. It lists the categories of personal information (using the law's categories) that we have collected in the past 12 months, why, and whether we sell or share them.

We do not collect the other CCPA categories (protected classifications, biometric information, professional or education information). Retention periods are in section 11. We have no actual knowledge that we sell or share the personal information of anyone under 16. Opt-out instructions are in section 8. Your other rights are in section 12. We are not required to publish request metrics because we handle the personal information of fewer than 10 million consumers.

14. Outside the United States

We are based in the United States and our servers and providers are there. If you use our products from somewhere else, your information is transferred to and processed in the United States, where privacy laws may differ from your country's. For transfers from the EEA, UK and Switzerland, we rely on our providers' standard contractual clauses and, where available, the EU-US Data Privacy Framework, together with the safeguards in this policy.

15. Children

Our products are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. We do not ask for a date of birth. If you believe a child under 13 has given us information, email us and we will delete it. If you are between 13 and 18, you may use our products only with a parent or guardian's permission.

16. Security

All traffic to our servers uses HTTPS. Databases are encrypted at rest by our hosting provider and reachable only by our own services and staff. Sign-in tokens live in the iOS keychain. Phone numbers from your contacts and IP addresses used for invite attribution are stored only as keyed hashes. Access to production data is limited to the people who run the products. No system is perfectly secure, and we cannot guarantee that unauthorized access will never happen; if a breach affects you, we will tell you and the authorities as the law requires.

17. Changes

When we change this policy we will update the effective date at the top. If a change materially reduces your rights or expands what we collect or share, we will tell you first by email or inside the product, and where the law requires it we will ask for your consent. Earlier versions are available on request.

18. Contact

Comeback Software LLC
San Francisco, California, United States
mail@comebacksoftware.com

Email is the fastest way to reach us for any privacy question or request. If you need a postal address for a legal notice, ask and we will provide one.