Privacy Policy

Last updated: 8 May 2026

ClubSpace ("the app", "we") is a club analytics dashboard for running club members. This policy explains what data we collect, how we use it, and your rights regarding that data.

1. Data We Collect

We collect only the data necessary to provide the dashboard experience:

• Strava profile information — your athlete ID, first name, last name, profile picture URL, and gender, as returned by the Strava API when you connect your account.
• Strava activity data — activity records for activities you have made visible on Strava (title, sport type, date, distance, duration, elevation, heart rate, and pace). We request the activity:read_all scope to access activities regardless of their Strava visibility setting.
• Session cookie — a secure, HTTP-only cookie containing a signed JWT is set after login. It identifies your session on subsequent requests and expires after 30 minutes of inactivity (or as configured by the server).

We do not collect your email address, location, payment information, or any data beyond what is described above.

2. How We Use Your Data

• Display your personal activity statistics within the club dashboard.
• Compute club-wide leaderboards, challenges, and aggregate analytics.
• Synchronise updated activities periodically via the Strava API using a stored access token.

We do not use your data for advertising, profiling, or any purpose beyond operating the club dashboard.

3. Data Sharing

We do not sell, rent, or share your personal data with third parties, except:

• Strava — we communicate with Strava's API to fetch your activity data. Strava's own Privacy Policy governs data held on their platform.
• Infrastructure providers — your data is stored in a PostgreSQL database hosted on Supabase, and the application backend runs on Render. Both providers process data on our behalf under their own data processing terms.

4. Data Retention

Activity data is retained for as long as your account is active. You can disconnect your Strava account at any time from the app's account settings, which removes your access token. To request full deletion of your stored data, use our Account Deletion page or contact us at the address below.

5. Security

Session tokens are stored in secure, HTTP-only cookies and are not accessible to JavaScript. Strava access tokens are stored encrypted in the database. All traffic between the app and the backend is encrypted via HTTPS.

6. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Disconnect your Strava account at any time from within the app.

To exercise any of these rights, contact us at the address below.

7. Children's Privacy

The app is intended for use by members of running clubs and is not directed at children under 13. We do not knowingly collect data from children.

8. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the app after an update constitutes acceptance of the revised policy.

9. Contact

For any privacy-related questions or data requests, contact:
run4fun.analytics@gmail.com