Privacy Policy

When you register, we collect:

• Full name — displayed to other runners on leaderboards and profiles.
• Strava profile — display name and avatar from your connected Strava account.
• Invite and referral data— your personal invite code and, if you joined through another member's invite link, a record of which member invited you, used to credit referral rewards. For invite-only challenges, we may also store hashed challenge passcodes and related invite codes so hosts can control who joins.

When you connect Strava, we collect:

• Distance (km) and date of the run.
• Strava activity identifiers and audit metadata needed for challenge verification and run review, including activity title, start time, moving and elapsed duration, average and maximum speed, per-kilometre split summaries, elevation gain, recording device, Strava activity flags (manual entry, indoor or trainer, and Strava-flagged), and a yes/no flag indicating whether the activity includes heart-rate data.

To process challenge pass purchases, Commitr Points (CMP) credits, pass vouchers, hosting bonds, and CMP cash-outs, we collect:

• PayMongo payment and checkout reference IDs linked to your account (when a cash checkout is required).
• Pass purchase amounts and CMP ledger history (progress credits, pass discounts, vouchers where applicable, hosting bond locks and returns, and cash-outs).
• Pending CMP credit balances tied to your verified runs and challenges (amounts that may later clear into your CMP balance as shown in the Service).
• Pass voucher records issued to you (discount type, percentage, status, and expiry), used to apply discounts at checkout.
• Contact email — collected and verified via a confirmation link before your first CMP cash-out, used to confirm your identity for cash-out requests.
• Cash-out destination details — the bank or e-wallet institution, account number, and account holder name you provide when cashing out CMP, shared with PayMongo to execute the transfer, together with the amount, status, and timestamps of each request.

If you choose to connect your Strava account, we access and store the following data from Strava via their official API:

• Athlete profile — your Strava display name and profile photo, used to confirm your identity in run verification.
• Strava connection data — your Strava athlete ID, OAuth access token, refresh token, and token expiry, used to keep your Strava connection active until you revoke access.
• Activity data — activity type, distance (metres), start date and time, activity title, moving and elapsed duration, average and maximum speed, per-kilometre split summaries (split distance, duration, and average speed), elevation gain, recording device name, Strava activity flags (manual entry, indoor or trainer, and Strava-flagged), and a yes/no flag indicating whether the activity includes heart-rate data, used solely to verify that a run occurred, counts toward the challenge target, and supports review of suspicious runs.

Because Commitr requests Strava's activity read scopes, including extended activity access, private Strava runs may be available to Commitr after you authorise the connection. We use only the activity fields listed above for run verification.

We do not access, store, or use:

• Your GPS route or map data.
• Heart-rate, power, or other health measurements. We store only a yes/no flag indicating whether an activity has heart-rate data, never the readings themselves.
• Strava followers, segments, kudos, or social data.
• Your Strava email address or payment information.

How Strava data is displayed:You see your own run data in the Service. Platform administrators may view stored audit metrics from your runs (for example pace, duration, elevation, device, and activity flags) when reviewing suspicious activity; they do not receive live Strava API responses or GPS route maps from Commitr. Other participants see Commitr's own derived records on leaderboards and challenge standings (approved km totals stored in our database), not raw Strava API data. Commitr operates as a Community Application under the Strava API Agreement and displays aggregated run progress for organisational purposes.

Data minimisation and caching:We request the Strava OAuth activity read scopes used for run verification. We do not intentionally store raw Strava API response bodies beyond the processing needed to create Commitr run records.

Prohibited uses:We do not use Strava data for artificial intelligence, machine learning, analytics, customer profiling, or any purpose other than verifying your individual run activity. We do not combine Strava data with unrelated third-party data for profiling, and we do not sell, license, or transfer raw Strava data to third parties except service providers needed to operate the Service.

Strava monitoring:Please note that Strava may independently monitor and collect certain usage data related to our use of the Strava API. That data collection is governed by Strava's own Privacy Policy and API Agreement, not this policy.

Authorization:We do not access any Strava data before you explicitly authorize our application through Strava's official OAuth flow. You may revoke Commitr's Strava access at any time from Strava's connected-app settings. When you revoke access, we delete your Strava connection and the Strava-derived details stored on your runs (activity titles, times, speeds, splits, elevation, and device information). Your kilometre totals, run dates, challenge results, and finish times already earned remain for challenge integrity and financial accountability.

If you delete activity data from your Strava account, we will stop syncing that activity and may reject the corresponding Commitr run record so it no longer counts toward challenge progress. Existing derived records may be retained where needed for challenge integrity, disputes, or financial accountability.

We may automatically collect standard server-side technical information such as error logs, request timestamps, and the identity of API endpoints accessed.

On our public website, we use Google Analytics 4 to understand aggregate traffic and usage (for example, pages viewed and general device or browser type). Google may set cookies or use similar technologies for this purpose. Analytics is loaded in production only and is separate from Supabase session cookies used to keep you signed in.

We also set first-party cookies needed to operate the Service: a Supabase session cookie that keeps you signed in, an invite-gate cookie that remembers a valid invite while you complete sign-up, and, if you open a member's invite link, a referral attribution cookie retained for up to 7 days so we can credit referral rewards.

If you enable push notifications, we store your browser push subscription endpoint, encryption key, authentication secret, and user agent so we can deliver account, run, reward, and challenge updates to your device. You can unsubscribe from push notifications from your browser or device settings.