Privacy Policy

Data Controller

The data controller within the meaning of the GDPR is:

What We Process & Why

• Account registration & management — Art. 6(1)(b) GDPR (contract performance)
• Competition participation & activity logging — Art. 6(1)(b) GDPR (contract performance)
• Leaderboards & team assignment — Art. 6(1)(b) GDPR (contract performance)
• Email dispatch (password reset, verification) — Art. 6(1)(b) GDPR (contract performance)
• Technically necessary cookies & session management — Art. 6(1)(f) GDPR (legitimate interest)
• Analytics cookies (e.g. Google Analytics) — Art. 6(1)(a) GDPR (consent), only with your explicit opt-in
• Strava activity import (optional) — Art. 6(1)(a) GDPR (consent). When you connect your Strava account, we access activity data (type, distance, duration, elevation, timestamps) solely to create scored competition entries. Raw Strava data is cached for no more than 7 days; scored entries contain only derived values and are retained as platform data.

Sub-Processors

Your Rights

Under the GDPR you have the right to:

• Access your data (Art. 15)
• Rectification (Art. 16)
• Erasure / "right to be forgotten" (Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)

To exercise any of these rights, contact us using the details above. You also have the right to lodge a complaint with your local data protection authority.

Data Retention & Deletion

• Account data: stored for the duration of the user relationship
• Activity data: stored for the duration of the competition plus 12 months
• On account deletion: personal data is anonymised (display name replaced, email removed). Activity data is retained in anonymised form for leaderboard integrity.
• Strava raw data: cached for no more than 7 days after import. Automatically purged when the cache retention period expires or when you disconnect your Strava account. Scored competition entries (derived values only) are retained for the competition lifecycle.

Cookies & Consent

This platform uses technically necessary cookies for session management and authentication. These cannot be disabled.

Analytics cookies are only set with your explicit consent via the cookie banner. You can withdraw consent at any time. We use the Consent Mode v2 protocol to ensure no analytics data is collected without your permission.

Changes to This Policy

We may update this privacy policy from time to time. The current version is always available on this page.