ClassicsGo is operated by Matthew Coxall and is responsible for information submitted through this website. We do not sell personal information or publish organiser contact details on event cards. Privacy questions and rights requests can be sent to privacy@classicsgo.com or through the dedicated privacy-request page.
Information we collect
When you submit an event, we store the organiser name, email address, optional club name and the event details you provide. When you register partnership interest, we store your name, email, organisation details, website where supplied and message. Privacy requests are stored separately with your name, email, request type and message. We also process limited security information, including pseudonymous rate-limit identifiers and the outcome of bot checks.
Permitted organiser feeds, official pages, partner services and licensed sources may also supply normalized event facts, an organiser or club name, a public source URL and verification timestamps. We keep that limited provenance so operators and visitors can verify a listing. We do not collect attendee lists, private social-profile data, access credentials or raw social posts/pages through event discovery.
Member accounts
You can sign in with Google or, when the production email service is enabled, create an email-and-password account. Supabase verifies the identity, stores password verifiers and sends confirmation, recovery and security emails through the configured sender. ClassicsGo never receives your Google password and does not store or log plaintext email passwords; its server passes email credentials to Supabase over encrypted connections. The identity provider supplies a verified email address, provider identifier and optional display name. We store the linked identity, hashed session credentials, sign-in history, saved events, Going responses, home areas, vehicle and marque preferences, roadbooks, alert rules, notification history, digest preferences, membership tier and trial dates so the service can work securely across devices.
Payments
Roadbook Member payments are processed by Stripe. Stripe collects and processes payment-card details; ClassicsGo does not store complete card details. We store the Stripe customer and subscription references, membership status and renewal or expiry information needed to provide paid features. Stripe handles payment information under its privacy policy.
Purposes and lawful bases
Account, planning and paid-membership data is used to provide the service you request and administer the contract with you. Submission, enquiry and privacy-request details are available only to authorised operators through a private review queue and are used to review genuine listings, answer messages, handle rights requests and operate the service. Queue changes are recorded for accountability. Security records, rate limits and bot checks support our legitimate interest in preventing fraud and abuse. Payment and privacy-request records may also be retained where necessary to meet legal obligations. Public event listings use the event information and official link, not private contact fields.
We use limited sourced event facts and provenance in our legitimate interests to maintain a useful, accurate public directory, subject to source permissions and human review. If an organiser or club name identifies you, you can ask us to correct the listing or object through the privacy-request form; we will balance that request against the need to verify public event information.
Location and saved events
If you allow browser location, the coordinates stay in your browser and are used there to calculate event distances; they are not added to your profile unless you explicitly save an area. Typed town, postcode and place searches are sent to the configured Nominatim-compatible location provider. The original query text is not kept in our cache; the service stores a one-way SHA-256 cache key with the returned place label and coordinates for up to 30 days. The provider still receives the text you submit, so do not enter confidential information. The default provider is covered by the OpenStreetMap Foundation privacy policy. Anonymous saved-event choices stay in your browser’s local storage; signed-in saves are also synced to your account. A verified signed-in member can mark an event as Going. Event cards show only the combined number of Going responses; attendee names, email addresses and account identifiers are not published.
Service providers and transfers
Cloudflare provides website delivery, scheduled processing and database storage. Supabase provides managed identity and sends authentication emails through the configured SMTP provider; Google provides social sign-in, and a Nominatim-compatible provider handles typed location searches. Cloudflare Turnstile protects enabled public account forms. When discovery integrations are enabled, Firecrawl and approved event-platform APIs process public source URLs and limited event facts under reviewed source controls; raw pages are not retained in the event database. Stripe handles paid billing only after checkout is enabled. Some providers may process information outside the UK under their contractual transfer safeguards. Provider terms and transfer safeguards are reviewed as each service is activated; optional payment, email and discovery services remain fail-closed until their checks are complete.
Retention and requests
Account and planning data is kept while the account is active and is removed when an eligible free account is deleted. One-way keyed email and sign-in-identity markers may be retained for up to three years after deletion to prevent repeated trial use and stop a stale provider identity from recreating the deleted account; they cannot be used to send email or restore account data. Where managed-identity removal is required, the provider identifier is held in a retry record for no more than 30 days and is then removed, including when manual provider recovery was unsuccessful. Contact details are kept only while needed to review a submission, answer an enquiry, prevent abuse or meet a legal requirement. Administrator queue-audit records are append-only for accountability and are scheduled for deletion after 12 months. Authentication security logs are periodically pruned with a 12-month operational target; expired or revoked session records are pruned after a short security window. Billing records may need to be retained after cancellation for tax, accounting, dispute and fraud-prevention requirements.
You can download account data, correct your profile, sign out other devices and delete an eligible free account from the account page. You may also ask for access, correction, erasure, restriction, portability or object to processing where the right applies. You can complain to the Information Commissioner’s Office. Cancelling a paid subscription stops future renewal but does not itself delete the account or records that must be retained.
Make a privacy request