Privacy
Effective 17 October 2026
CourseChalk is a service of Bores Sports Technologies, the trading name of Ethan Bores in Norwalk, Ohio. The short version: your meet plan stays on your computer unless you sign in and save it online. You can draw, measure and print without telling me anything at all. If you make an account or buy a license, I hold the handful of details listed below and nothing else. There are no analytics and no trackers on this site, and the only cookie is the one that keeps you signed in.
Your meet plans
CourseChalk runs in your browser. Everything you put into a meet plan stays on your computer unless you choose to save it online:
- Your course drawings and the coordinates in them
- Race schedules, entry fees, awards, policies and every other word you type
- Athlete and coach names, schools, email addresses and phone numbers
- School logos, sponsor artwork and imported map scans
- The finished flyers and packets
Signed out, or in the desktop app, none of that is uploaded, backed up or synced. It is held in your browser while you work, and Save writes it as a file on your own machine. One exception on the website: Export as PDF sends the finished sheet out to be printed to a PDF, and none of it is kept (see What passes through, and is not kept). Print, and every export in the desktop app, stays on your computer. On the website, changes you have not saved are also kept in your browser for up to 7 days, so a closed tab or a crash does not lose them (see What is stored in your browser). Nothing about that copy leaves your computer.
Signed in on the website, Save puts the meet in your account so you can open it on another computer. After that first Save, changes to that meet save themselves a few seconds after you make them. The whole meet goes, exactly as it is in the app: the course lines, every word, any names, emails and phone numbers typed into it, and the logos, sponsor artwork and map scans. It is stored with Cloudflare in North America, under your account and nobody else's: the meet in a database, and its images in Cloudflare's file storage. I do not look at saved meets. They are kept so you can open them, and for no other reason.
Earlier versions. While you work, an earlier version of each saved meet is kept about every ten minutes, for 30 days, so you can go back to one from My meets. They hold the same kind of content as the meet itself.
Deleting. Deleting a meet moves it to the trash in My meets for 30 days, so a mistake can be undone; after that it is deleted for good, with its earlier versions. Delete forever, in the trash, does that at once. Deleting your account deletes every meet, version and item in the trash straight away. After any of these, Cloudflare's recovery history for the database, which exists so a fault can be undone, lets the deleted copy expire within 30 days.
Backups. I keep a few recent backup copies of the database, and of the images in saved meets, on my own computer, so the service can be put back after a serious failure. A backup can still hold something you deleted until that backup is replaced by a newer one. Backups are never shared and are used for nothing else.
Download always gives you the file instead, signed in or not, and a downloaded file is never uploaded. If you would rather nothing of a meet ever reached a server, use Download and Print on the website, or use the desktop app.
If you make an account
You do not need one to use CourseChalk. An account exists so your license key can be handed back to you on a new laptop instead of hunted for in your email. If you make one, I hold this:
| What | Why | How long |
|---|---|---|
| Your email address | It is how the account is identified, and where the key goes | Until you ask me to delete it |
| Your first and last name | So quotes, invoices and purchase orders have a person on them | Until you ask me to delete it |
| Your school or organization, your role, and your state | To know who actually uses this, and to get a purchase order right | Until you ask me to delete it |
| Your phone number, team or meet name, and how you heard about us — all optional | The phone number is only used if a purchase order or payment gets stuck. Nobody is called otherwise. | Until you ask me to delete it |
| Whether you asked for occasional product email | So I only send it if you said yes | Until you ask me to delete it |
| If you set a password: a scrambled form of it, never the password | To check it when you sign in | Until you ask me to delete it |
| Meets you save online, if you save any: the whole meet, as described above | So you can open them on any computer you sign in on | Until you delete them (then 30 days in the trash), or your account. Earlier versions: 30 days |
| If you sign in with Google: nothing from Google but your email address | Google tells me the address is yours. I ask for nothing else and never call Google again. | Until you ask me to delete it |
| One record per device you are signed in on: the browser and system it reports (“Chrome on Windows”, or “CourseChalk app on Windows” for the desktop app), when you signed in, and when it was last used | So you can see where you are signed in and end any of them yourself | 90 days, or until that device signs out |
I cannot read your password. What is stored is the result of running it through 600,000 rounds of a one-way function with a random salt — enough to check the password you type without holding anything that could be turned back into it.
New and changed passwords are checked against public breach lists using Have I Been Pwned's Pwned Passwords service, so nobody ends up protecting their account with a password that is already in circulation. Your password is not sent. Only the first five characters of a one-way hash of it go out, which match hundreds of unrelated passwords, and the comparison happens here. The service cannot tell which password was being checked, or whose.
Product email is a separate, unticked box. Your license key is not marketing and arrives whether or not you tick it.
The device list holds no IP address and no location. It is there so you can recognise your own devices and end one you no longer have — not so anyone can see where you have been. You can end any of them, or all of them, from your account.
What I actually receive when you buy
If you buy a season pass, this as well:
| What | Why | How long |
|---|---|---|
| Your email address | To send you the license key, and to send it again when you lose it | Until you ask me to delete it |
| Which pass you bought and when it expires | To reissue the right key | Until you ask me to delete it |
| A random installation number, and the date it first appeared | To notice when one key is being used on dozens of machines | Until you ask me to delete it |
| The Stripe checkout and payment references | So a retried payment notification cannot issue you two keys, and so a refund turns off the right key | About 13 months, then deleted automatically. The payment reference also stays with your license record, until you ask me to delete it |
If I give you a free pass, I keep your email address, which app and plan, the last day it works, a short note of why, and which of my addresses gave it. There are no payment references. For CourseChalk this sits with your license record; for PaceChalk, in PaceChalk's database. It is kept until you ask me to delete it, also after the pass ends or I take it back, so I can see what I gave.
The installation number is not a device fingerprint. It is eight random bytes generated in your browser the first time you enter a key. It is not derived from your hardware, your browser, your network or anything else about you, and it cannot be traced back to a machine or a person. Its only job is to let me count how many separate copies a key is running on.
I do not receive your card number. I never see it. Stripe is the merchant of record for the sale — it takes the payment and tells me only that a payment succeeded and which email address to send the key to.
What passes through, and is not kept
Sheets you export as PDFs on the website. A browser cannot make a PDF file by itself, so when you press Export as PDF (or export all three as a zip), the finished sheet — everything on it, including any names, emails and phone numbers — goes to the site, which has Cloudflare's Browser Run service print it and sends the PDF straight back to you. Neither the sheet nor the PDF is stored or logged; only its size and whether it worked are. The page is printed with the network shut off, so nothing on it can call out anywhere. The desktop app makes its PDFs on your own computer, and Print on the website uses your browser's own print dialog.
When you search for a venue by its street address, the text you typed goes to the site, which forwards it to the US Census Bureau's geocoder and hands you back the answer. This exists for one boring reason: the Census service cannot be called directly from a web page.
That request is not logged, stored or associated with you. The answer is cached for a day so the next person looking up the same high school does not trouble the Census Bureau again.
What your browser talks to directly
Map images come to your browser straight from the USGS National Map, not through me. That means USGS can see your IP address and which map tiles you asked for — which is to say, roughly which part of the country you are looking at. I have no visibility into that and no way to connect it to you, but you should know it happens. The same applies to MapTiler if worldwide maps are switched on.
If you are signed in, a new meet opens the map on your school. To find it, your browser asks the National Center for Education Statistics (part of the US Department of Education), which publishes the location of every school. It sends one word of your school's name and your state — for “Lakeview High School” in Ohio, LAKEVIEW and OH — with no cookie, no name and no email address. NCES can see your IP address, as USGS can. If there is not exactly one match, the map opens on your state instead. The answer is kept only until you close the tab, or the Windows app.
A venue search that is not a street address goes from your browser straight to a public list, not through me. A school name goes to NCES as above: one word of the name, and the state if you typed one. A town goes to the USGS list of place names (the Geographic Names Information System): the town's name, and the state if you typed one. A ZIP code goes to the Census Bureau's TIGERweb: the five digits. Each is sent with no cookie, no name and no email address, and each service can see your IP address. In the Windows app, these go from the app on your computer, the same way. The answers are kept in your browser so the same search does not ask again (see below).
What is stored in your browser
CourseChalk keeps these in your browser. They stay on your device, are readable only by coursechalk.com in that one browser, and are never sent to me:
- Your license key, so you do not have to paste it in every time
- How wide you dragged the sidebar
- Recent venue searches and their answers, so repeating one is instant
- Unsaved changes to a meet, on the website only. While a meet has changes that are not saved to your account or downloaded, a copy of the whole meet — including any names, emails and phone numbers in it — is kept in the browser's storage. It is deleted when you save, after 7 days, or when you sign out. If you open CourseChalk again after closing the tab, it shows the meet's name and when it was last changed, and opens it only if you press Restore. If the meet is one you saved online, the copy also holds a one-way fingerprint of your email address, so it is not saved into a different account.
On a shared computer, sign out when you finish, or save and then close the tab. Clearing your browser's site data removes all of these at once. You would need to paste your key in again, and any unsaved changes would be lost.
The Windows app
Signing in from the app. The app opens this site in your browser, you sign in there as usual, and you confirm. The app then keeps a sign-in token — a long random number, like the cookie below — on your computer, encrypted with the protection Windows gives your user account. It uses the token to fetch your license key and your details for new meets, and for nothing else. Sign out in the app, or end “CourseChalk app on Windows” on your account, and the token stops working at once.
Updates. When it starts, the app asks coursechalk.com whether a newer version exists, and downloads it if so. That request carries nothing about you or your meets, and nothing from it is stored with your account.
Signing in to PaceChalk
PaceChalk (pacechalk.com), race analysis for cross country coaches, is also run by Bores Sports Technologies and uses your CourseChalk account to sign in. When you click Sign in there, you come to this site, sign in as usual, and click Continue. Only then does this site tell PaceChalk your account number, email address, name, school and state. Nothing else is shared: not your password, phone number, meets or license. What PaceChalk keeps is described in its own privacy page. Signing out of one site does not sign you out of the other.
If a coach added you to their PaceChalk teams, PaceChalk emails you a link. Following it brings the address the invitation went to along with you, so the sign-in or Create an account form here can fill it in. It is kept only in the cc_connect cookie, for those few minutes, and changes nothing about who signs in.
Cookies and analytics
One cookie, and only if you sign in. It is called cc_session and it holds nothing but a long random number, which matches the device record described above. It lets the site know you are you for ninety days. Signing out deletes both the cookie and the record. A second short-lived cookie exists for a few minutes during a Google sign-in to make sure the trip to Google and back belongs to your browser, and a third, cc_desktop, for up to fifteen minutes while you connect the Windows app. It holds only the one-time request from the app. A fourth, cc_connect, does the same for up to fifteen minutes while you sign in to PaceChalk.
That is the lot. There is no Google Analytics, no Meta pixel, no session recorder, no A/B testing tool and no advertising network. Nothing here follows you between sites, and nothing is used to build a profile of you. There is no cookie banner because a cookie that only keeps you signed in is one you asked for by signing in.
I do not know how many people visit this site beyond what Cloudflare shows me in aggregate — page counts and countries, with no identifiers I could tie to a person.
Who else touches anything
| Service | What it handles |
|---|---|
| Cloudflare | Serves the site and stores the license records, the account details and any meets you save online, as described above. Prints sheets to PDF for the website, keeping nothing. Keeps standard security and request logs. |
| Stripe | Is the merchant of record for the sale. Takes the payment, issues your receipt and invoice, handles sales tax and disputes, and answers billing questions. Collects your name, email and billing details under its own privacy policy. I see the email address and nothing more. |
| Resend | Sends the email that carries your license key, and account email — confirmations, password resets and notices that something on your account changed. Account email comes from accounts@coursechalk.com; keys come from keys@coursechalk.com. |
| Google Fonts | Serves the typefaces on this page. |
| Google (sign-in) | Only if you choose "Continue with Google". It confirms your email address is yours and tells me nothing else. If you never use that button, Google sign-in is never involved. |
| National Center for Education Statistics | When you are signed in and start a new meet, or search for a school as the venue. It receives one word of the school's name and the state, as described above. |
| US Geological Survey and US Census Bureau | USGS sends the map images, and finds a town you search for. The Census Bureau finds a street address or a ZIP code you search for. Each receives only what is described above. |
| Have I Been Pwned | Checks a new password against public breach lists, as described above. It receives five characters of a hash, never your password or your address. |
I do not sell your information, share it for advertising, or hand it to anyone else. There is no mailing list. Buying a license does not sign you up for anything, and you will never get marketing from me unless you ask for it.
Schools and student information
If you are a school administrator vetting this tool: CourseChalk asks for no student data, and receives none unless a coach chooses to save a meet online. A meet packet is mostly times, fees, parking and rules, but a coach can type anything into it. Signed out, or in the desktop app, it stays in the coach's browser and in the file on the coach's computer, and no copy is kept by me. Exporting a sheet as a PDF on the website passes it through to be printed, and keeps nothing (see What passes through).
If a coach signs in and saves a meet online, what they typed is stored in their account, as described under Your meet plans, and deleted when they delete it. If your district wants nothing to leave the coach's computer at all, coaches can use the desktop app, or Download and Print on the website.
Children
CourseChalk is a tool for meet directors and coaches, and it is not directed to children. I do not knowingly collect personal information from anyone under 13, and accounts are meant for the adult running the meet. The personal information I hold is the account details listed above, all of them given deliberately by that adult.
Your choices
Email me at support@coursechalk.com and I will, within a few days:
- Tell you everything I hold about you, which will fit in one short message
- Correct it — though your name, school, role, state, phone and team are all editable yourself at your details
- Send you a copy of your saved meets — which you can also take yourself at any time: My meets, then Download all, gives every meet as a file you can open in CourseChalk
- Delete saved meets — which you can also do yourself, in the app under My meets
- Delete it, account and all
- Stop sending product email, which you can also turn off yourself in your details
Deleting your account means I can no longer resend your key if you lose it, so keep the email. Your license itself keeps working — it is a signed file, not a database row, and deleting my copy does not switch it off.
I do not sell personal information and never have, so there is nothing to opt out of.
Security
The site is served over HTTPS only. License keys are signed with a private key held as an encrypted secret that never appears in the code or in any backup. Payment card details never reach my systems at all.
I am one person and this is a small operation. I am telling you what I actually do rather than describing a security program I do not have.
Where this operates
CourseChalk is run from the United States, for use in the United States — the aerial imagery and address search are US-only. If you use it from elsewhere, your information is handled in the United States.
Changes
If this policy changes in a way that matters, I will change the date at the top and say so on the site.
Contact
Bores Sports Technologies — Ethan Bores
Norwalk, Ohio, United States
support@coursechalk.com