Casablanca International Marathon — Association des Coureurs du Grand Casablanca
Last updated: 26 July 2026. This policy describes personal data actually processed by
the official mobile app and its API (/api/mobile/v1). It does not replace
the website's Terms of Registration and Sale. A legal review is recommended before
store publication.
Association des Coureurs du Grand Casablanca
Contact: [email protected]
When you sign in (email OTP, Google or Facebook), we record:
Depending on the race chosen (Marathon 42K, Half Marathon 21K or Relay), registration data may include: first and last name, sex, date of birth (42K / 21K), phone, email, nationality, country, city, address, club, target finish time, emergency phone number, identity document, jersey size, bib number, and for Relay teams the manager's and teammates' contact details.
Online payment is processed by the CMI platform. The app and our servers do not store card numbers, security codes, or full card data. We only keep order metadata needed for tracking (billing identity, email, phone, amount, paid/unpaid status, transaction ID, payment method).
If you accept notifications, an FCM token is linked to your account to send event-related information (e.g. news, registration confirmation). You can revoke this permission in your phone settings.
Live tracking relies on timing-chip passages linked to a bib number (provided by the official timekeeper / RaceTimer), not on the runner's or spectator's phone GPS. No geolocation data is currently collected by the app.
If the app crashes, Firebase Crashlytics may automatically collect: device model and operating system, IP address, technical installation identifier, and the error stack trace. This data is used solely to diagnose and fix bugs — it never includes card numbers or passwords.
Race registration (Marathon 42K, Half Marathon 21K, Relay) is reserved for people aged 18 and over, per the race rules. The app is therefore not intended for minors and does not knowingly collect data about them.
Data is processed by the Association and the technical providers required for the service: hosting, email delivery, Google (Google Sign-In authentication, Firebase Cloud Messaging for push notifications, Firebase Crashlytics), Meta (Facebook Login authentication), the CMI payment platform, and RaceTimer timing. It is never sold to third parties.
Some of these providers (notably Google and Meta) process data on servers located outside Morocco. These transfers are limited to the purposes described in this policy and covered by those providers' contractual safeguards. See Google's privacy policy and Meta's privacy policy for details.
We do not use your data for targeted advertising and do not share it with advertising networks. Google Sign-In and Facebook Login are used solely for account authentication, not for cross-app advertising tracking.
Registration and order data is kept for as long as needed to organize the relevant edition, for administrative follow-up, and to meet legal obligations. FCM tokens are updated or removed when a device unsubscribes or the account is deleted.
You can delete your account directly from the app, under More → My account → Delete my account. This immediately removes your account, your session, and the runners you follow. Registrations and orders already paid are kept separately, as they are required for the Association's legal and accounting obligations.
You may request access, correction or deletion of your personal data by emailing [email protected], or by using the in-app account deletion feature (see section 8). We will process your request promptly, subject to legal retention obligations (e.g. transaction records). You also have the right to lodge a complaint with the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), the competent Moroccan authority.
Access to the mobile API is protected by authentication (JWT). Server-side secrets (payment keys, FCM service accounts, etc.) are never embedded in the app.
This policy may evolve, in particular to reflect new app features (e.g. switching live tracking to a real timing partner). The "last updated" date at the top reflects any change; substantial changes will be flagged inside the app.
For any question about this policy: [email protected]