Privacy Policy — Pub Run Clubs

This Privacy Policy explains what personal data Pub Run Clubs (the "Service") collects about you, how we use it, and the choices you have. We are the data controller for the information described below. Contact: admin@pubrunn.app.

1. What we collect

You give us

Account: name, email, password (hashed), and optionally a profile photo.
Profile: preferred units, home postcode (used only to compute an approximate lat/long for finding nearby runs), and search radius.
Content: runs you log, pubs you tag, clubs you create or join, event RSVPs, cheers, and reports.

If you connect Strava

Strava athlete ID, first name and profile photo (read once, when you connect).
OAuth access and refresh tokens (stored encrypted at rest by our database provider).
Activity suggestions. When Strava tells us you have recorded an activity that falls in the window of a club event you RSVP'd to, we store a short-lived suggestion so you can import or dismiss it: the activity ID, its name, start time, distance, moving time, elevation gain, and the activity's start coordinates (used only to check the run started near the event). Suggestions expire automatically and are deleted by a daily clean-up, whether or not you acted on them.
Imported runs. If you import a suggestion we keep the activity ID, name, date, distance, duration, elevation gain, and the activity's route line (the GPS polyline Strava provides) so we can draw your route map.

1a. Strava data — how we handle it

We request the minimum Strava scopes we need (read and activity:read). We only fetch activity data that matches a club event you've RSVP'd to, and only for as long as your connection is active. We never write to your Strava account.

Only your own data, only for you. Strava data is used solely to import your own activities into your own Pub Run Clubs account.
Never shared or sold. We do not sell, licence, redistribute, or share Strava-sourced data with any third party, advertiser, or data broker. The only processors that touch it are the hosting and database providers needed to store and display it back to you, plus Google Maps, which draws the route line in your own browser when you open a run — Google receives it only as map-drawing input for that page view.
Never used to train models. We do not use Strava data to train machine learning or AI models, and we do not use it for data mining, benchmarking, or any analytics product.
Excluded from analytics. Strava-sourced data is never included in the aggregate usage analytics described below.
Not shown to other athletes without your opt-in. Route maps and Strava links on your imported runs are private to you unless you turn on "Share my routes with club mates" in Settings. Other members always see only distance, time and the pub. We never show one athlete's Strava data to another athlete outside that opt-in.
Never paywalled. We do not charge any fee for access to Strava data or Strava-powered features.

Deletion. Disconnecting Strava in Settings (or deleting your account) revokes our access with Strava immediately. You can also revoke access at any time from your Strava apps settings. In either case we delete all Strava-sourced data we hold for you — tokens, Strava activity IDs, route maps, and pending activity suggestions — within 24 hours of the disconnection or deauthorization, and any copies in encrypted backups age out within 30 days. If Strava stops honouring our access for your account, the connection and its Strava data are removed the next time we try to use it. You can choose to keep your imported runs as plain manual entries (distance, time, pub) or to delete them entirely.

Pub Run Clubs is not affiliated with, endorsed by, or sponsored by Strava. Your use of Strava is governed by Strava's Terms of Service and Strava's Privacy Policy.

We collect automatically

Analytics events: anonymous page views and feature usage (e.g. "signup", "club_create") to understand how the app is used. This is stored in our own database, not sent to any third-party analytics service.
Technical: IP address and browser/user-agent at request time, held only briefly in server logs.

2. How we use your data

To provide the Service — accounts, sign-in, runs, clubs, notifications.
To match Strava activities to scheduled club events.
To calculate stats, badges, streaks, and city unlocks.
To enforce our Terms — moderation, profanity filters, rate limits, blocking.
To improve the app using aggregated, anonymous analytics — Strava-sourced data is excluded from this.
To send transactional emails: sign-in, password reset, event reminders.

We do not sell your personal data. We do not use it for advertising. We do not use your data — Strava-sourced or otherwise — to train AI or machine learning models.

3. Legal bases (UK/EU users)

Contract: to provide the Service you signed up for.
Consent: connecting Strava and using location features. You can withdraw consent at any time.
Legitimate interests: keeping the Service secure, preventing abuse, and understanding aggregated usage.

4. Who we share it with

We share data only with the providers we need to run the Service:

Supabase (hosted on AWS in Europe) — database, authentication, and file storage.
Cloudflare / Lovable — application hosting and edge delivery.
Strava — only when you connect and only to fetch data you've authorised.
Google Maps — to render maps and geocode postcodes. Your postcode is sent to Google for geocoding; nothing that identifies you is sent with it.
Email delivery provider — to send transactional emails.

Other Pub Run Clubs users see what you share publicly: your display name, avatar, clubs you're in, runs you post in private clubs, and events you RSVP to.

Strava exception. Strava-sourced data is never sold, licensed or shared with any advertiser or data broker. It is stored only by the hosting and database providers above so it can be shown back to you, and only to you — club mates, leaderboards and public pages never show or count runs imported from Strava. Strava figures and route lines are kept for no more than seven days; after that your run page reads them live from Strava when you open it. The single exception is map rendering: when you open one of your imported runs, your browser passes the route line to Google Maps so the map can be drawn. Nothing is sent to Google in the background.

5. Where we store data

Your data is stored on servers in the European Union. Some subprocessors (e.g. Cloudflare) route traffic globally; standard contractual clauses cover any transfers outside the UK/EEA.

6. How long we keep it

Account data: until you delete your account.
Strava tokens and Strava-sourced data: deleted within 24 hours of you disconnecting Strava, deleting your account, or revoking access on Strava's side.
Analytics events: up to 24 months, then aggregated and deleted.
Server logs: up to 30 days.
Backups: may persist for up to 30 days after deletion.

7. Your rights

Depending on where you live you may have the right to:

access a copy of the data we hold on you — download it yourself at any time from Settings → Your data;
correct inaccurate data (most fields are editable in the app);
delete your account and its data (Settings → Danger zone);
object to or restrict certain processing;
data portability — the Settings → Your data export is machine-readable JSON, with a CSV of your runs;
withdraw consent for Strava or location features at any time;
complain to your local data protection authority (in the UK, the ICO at ico.org.uk).

To exercise any right, email admin@pubrunn.app.

8. Cookies and similar

We use only the storage needed to run the app:

Auth session — kept in your browser's local storage by Supabase Auth so you stay signed in.
Preferences — units and other UI settings stored locally in your browser.

We do not use advertising or third-party tracking cookies.

9. Children

Pub Run Clubs is not intended for children under 16. If you believe a child has created an account, contact us and we'll delete it.

10. Security

We use industry-standard controls: HTTPS everywhere, hashed passwords, row-level security on the database, encrypted OAuth tokens, and strict access controls. No system is 100% secure — report vulnerabilities to admin@pubrunn.app.

11. Changes to this policy

If we make material changes we'll notify you in the app or by email. The "Last updated" date at the top of this page always reflects the current version.

12. Contact

Questions or requests: admin@pubrunn.app.