Who is responsible
Frank Tiersch, Calle Tomás Miller 13, 3, 35007 Las Palmas de Gran Canaria, Spain — the full details are on the legal notice. Questions about anything on this page go to hello@hybridhuddle.com.
Two kinds of people are described here
Almost everyone on this site is here because they raced, not because they chose to be: their results were published by the results service and gathered from there. A much smaller number have created an account. What is held, why it is allowed, and how long it stays differ between the two, so they are set out separately rather than averaged into one paragraph.
If you never signed up
Everything about an athlete on this site was published by the official HYROX results service on its public results pages. Nothing was collected from you, and nothing was bought from anyone.
For each race entry that means:
- the name as the results service spells it
- gender, and the nationality shown beside the name
- the age bracket raced in — a band such as 30–34, never a date of birth
- the bib number, and the results service's own identifier for the entry
- finish time, station and running splits, timing-mat crossings, and the place and status published with them
One thing is worked out here rather than taken from the source: which entries belong to the same person. The results service publishes each race independently, so linking someone's races across events is done by matching names, gender, nationality and age bracket. That linking is the part of this site that goes furthest beyond what was already public, and it is deliberately cautious — where two entries are not clearly the same person they are left as two people.
Why that is allowed
The basis is legitimate interest (Article 6(1)(f) GDPR). The interest is this: a race result on its own is a number, and it only becomes meaningful next to the field that raced it and next to the same athlete's other races. Making that possible is what this site is for.
Weighed against that: the data was already published, by the organiser, on pages anyone can read; it is limited to how someone performed in a public competition they chose to enter; it contains nothing about health, beliefs or private life; and no attempt is made to profile anyone beyond their races. What is added is context, not exposure.
If you disagree with that balance in your own case, say so — see your rights below.
How long
Indefinitely, and deliberately. Seeing whether you have improved requires the race you are improving on: a results archive that forgot its older races would answer the one question it exists to answer with a shrug. Results are a historical record and are kept as one.
If you have an account
An account exists so you can say which of the published races are yours. Creating one is the only point at which this site collects anything from you directly, and it asks for as little as it can:
- the name you race under — this is the one that matters, because it is what your races are found by
- your email address, and whether you have confirmed it
- your password, stored only as a hash: the password itself is never kept and cannot be read back, not even here
- a sign-in token, if you asked to stay signed in
There is no date of birth, no address, no phone number and no payment data, because nothing here needs any of it. Two-factor authentication and passkeys are switched off at present and nothing is stored for either.
Why that is allowed
A different basis from the results above: performance of a contract (Article 6(1)(b) GDPR). You asked for an account and this is what running one requires. Objecting to it is not really the point — closing it is, and that is described under your rights.
Email sent to you
Four messages, all prompted by something you did: confirming your address when you register, resetting your password when you ask to, and — if you claim a race the automatic check cannot settle — telling you what a person decided about it, either way. There is no newsletter, no announcements and no marketing, and there is no setting to turn those off because there is nothing to turn off.
A record of what was sent
Every message is written down: the address it went to, which of the four it was, its subject line, and when. This is so a question like was that person ever told has an answer. It is kept because a log with gaps in it cannot be relied on to answer anything, and because the alternative is guessing.
What was written is never stored — only the fact that it went. A confirmation link and a password reset link are single-use keys to your account, and a record that kept them would be worth more to somebody who broke in than the passwords are.
A portrait, if you upload one
You can put a photograph of yourself on your account. It is optional, nothing asks for it, and an account without one is drawn with a plain silhouette like everybody else's.
It is public. It appears wherever you appear — on the races you have claimed, beside your name on your gym's board — and it goes up immediately, with nobody checking it first. If you would rather not have a picture of your face on a public page, do not upload one; that is the whole of the control, and there is no half-way setting that would be honest.
What a camera writes into a photograph is thrown away. Every upload is re-encoded here before it is stored, which discards the embedded metadata — including the GPS coordinates a phone records, the timestamp and the device it was taken on. What is kept is the picture and nothing else. Uploading a new one replaces the old file rather than adding to it, and you can remove it at any time from your account page, which puts the silhouette back.
A site administrator can also remove a portrait, and that is the only thing they can do to an account. It is there so that a photograph of somebody who did not agree to be on this site can be taken down.
How long
Your account, the portrait on it, and the claims made with it last for as long as the account does. Closing it removes them — see the note below on what closing an account does and does not reach.
The record of sent messages is kept indefinitely, and asking us to remove your data takes your address and the link to your account off it. What remains is that a message of that kind was sent on that date, with nothing on the row pointing at you. That is deliberate: deleting the rows outright would leave a log that cannot be trusted to show what happened, which defeats the only reason to keep one.
Claiming a race
Claiming is you saying that a published race entry is yours. The site offers you races by comparing the name on your account with the names the results service published, and you answer one at a time.
What that records:
- which race, and which published entry it was matched through
- your answer, and when you gave it
- including when the answer is no. Saying a race is not yours is stored too — that is the only way to stop offering it to you again
Claiming is visible to other people
This is the part worth reading twice. When you claim a race, a small mark appears on that entry on the public pages — the race itself, both sides of a comparison, and the list of races to compare against. Anyone can see it, signed in or not, and what it says is: somebody with an account here has claimed this race.
It does not show your account name, your email, or which other races you hold. But it is a public consequence of a private action, so it should not be a surprise. If you would rather it were not there, withdraw the claim — the mark goes with it, and the race goes back to being offered to you.
Claiming does not change the race data itself. Your times, position and splits are the results service's, before and after, and they read exactly the same to everyone else.
Who else sees it
Nobody. The data is not sold, shared, licensed or handed to advertisers, and there are no third-party services embedded in these pages to hand it to.
The one exception this could ever have is the service that carries the emails described above, which necessarily handles your address to deliver them. Any such provider is named here. If none is named, none is in use.
Counting visits
Page views are counted, by Umami running on the same server as this site rather than by a service belonging to anyone else. A view records the page, the address you arrived from, your browser, operating system, device type, screen size and language, and the approximate place the request came from. That place, and the grouping of one day's views into a single visit, are both worked out from your IP address. The address itself is not stored.
The basis is legitimate interest (Article 6(1)(f) GDPR): knowing which pages are read is what decides what gets built next. There is no Google Analytics, no advertising network, no profiling, and no attempt to recognise you on a later day or on another site. You can object.
Cookies are set by the site itself and by nobody else — the counting above sets none of its own, and stores nothing on your device. Two of them always: a session cookie, and a token that protects forms against cross-site request forgery. A third only if you tick keep me signed in, which is what remembers you afterwards — you chose that one, and not ticking it means it is never set. None of them follows you anywhere.
Where it is kept
On servers in Spain, within the European Union. Nothing is transferred outside the EU/EEA, except insofar as an email has to travel to reach you.
Your rights
Under the GDPR you can ask for access to what is held about you, rectification of anything wrong, erasure, restriction of how it is used, and you can object to the processing described above. Because the basis for the results is legitimate interest, an objection there carries real weight rather than being a formality.
There is no self-service button for any of this. Write to hello@hybridhuddle.com and it will be dealt with by a person. Say which races are yours — a name alone is often not enough to tell two athletes apart, which is the same problem this site solves cautiously elsewhere. If you have an account and have claimed races, you have already answered that.
What closing an account does, and does not, reach
Closing an account removes the account and the claims made with it, and the public marks those claims put on race pages go with them. The portrait goes too — the file is deleted from disk along with the record of it, so there is nothing left to serve.
The record of messages sent to you is anonymised rather than deleted: your address and the link to your account come off it, and what is left says only that a message of that kind went out on that date. Nothing on it points at you afterwards.
It does not remove your race results. Those were published by the results service, they are held for the reason set out at the top of this page, and they are treated the same as those of every athlete who never had an account. Deleting an account is not a way to delete a race — if that is what you want, it is the objection described above, and it is a separate conversation rather than a button.
One honest limit on rectification: a wrong time here is almost always a wrong time at the results service, and this site re-reads from it. Correcting it at the source is what makes the correction stick; see how the numbers are made.
If you are not satisfied with how a request is handled, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD).
Changes
If what this site does with data changes, this page changes with it.