Privacy Policy

1. What We Collect

When you connect your Strava account to TheRunCloud, we collect and store:

• Strava Profile — your display name, profile photo URL, and Strava athlete ID
• Running Activities — distance, duration, pace, date, and activity type for runs that fall within challenge date ranges
• OAuth Tokens — access and refresh tokens to sync your activities (encrypted in transit, stored securely)

We do not collect your email address, GPS route data, heart rate, or any data beyond what's listed above.

2. How We Use Your Data

• Display your name, profile photo, and running stats on public challenge leaderboards
• Calculate your ranking, streaks, and distance totals
• Sync your Strava activities automatically every 2 hours

We never sell your data, use it for advertising, or share it with third parties beyond what's displayed on the public leaderboard.

3. Public Leaderboards

By joining a challenge, you agree that the following data is publicly visible on the challenge leaderboard:

• Your Strava display name and profile photo
• Total distance, number of runs, pace, and streaks
• Your rank among other participants

Anyone with the challenge URL can view this information.

4. Third-Party Services

• Strava API — we fetch your running activities via Strava's official API. See Strava's Privacy Policy.
• Railway — our app and database are hosted on Railway's cloud infrastructure in the US.

5. Data Storage & Security

Your data is stored in a SurrealDB database hosted on Railway (US region). All connections use encrypted HTTPS/WSS. OAuth tokens are stored server-side and never exposed to the browser.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, all your data (profile, activities, challenge entries, and tokens) is permanently removed within 24 hours.

7. Your Rights

• Delete your account — visit Delete Account to permanently remove all your data
• Disconnect Strava — revoke access at Strava Settings
• Contact us — email krc@qusai.org for any data requests

8. Children's Privacy

TheRunCloud is not intended for children under 13. We do not knowingly collect data from children. If you believe a child has connected their account, please contact us immediately.

9. Push Notifications

If you use our mobile app, we may send push notifications for sync updates and new challenges. You can disable these at any time in your device settings.

10. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of the app after changes constitutes acceptance.

Contact

Questions about this policy? Email us at krc@qusai.org