Saints Run Club
Privacy Policy
Saints Run Club (“we,” “us,” “the club”) runs a community running club in Queens, New York, and a companion mobile app for members. This policy explains what the app collects, why, who we share it with, and the choices you have. We built the app to collect as little as possible.
The short version. We do not sell your data or use advertising or cross-app tracking. Membership requires a verified email and display name. Event check-in checks proximity on your device and stores a timestamp. Separately, an authorized admin may deliberately start live-run broadcasting, which sends the latest precise location to our backend, including in the background. It never starts automatically and has an explicit Stop control. New checkout and route/live tools are currently admin-only; the merchandise catalogue and partner offers remain available to members.
On this page
1. Information we collect
Account & sign-in
The app initially creates an anonymous account with a random identifier. To join the member experience, you provide a display name and verify an email address with a one-time code. Returning members normally sign in with an emailed code. Accounts provisioned with a password may instead enter that password, which our authentication provider validates. Private admin review passwords are not bundled in the app. We use account identifiers and email addresses to operate and recover membership. Authorized club administration may access the information needed to operate the club.
Profile information
You may optionally add profile details:
- Display name — shown on the club roster and event lists.
- Pace, Instagram handle, avatar — optional, shown on the public roster if you add them.
- Home area — a free-text neighborhood (e.g., “Astoria, Queens”). Private to you.
- Birthday — month and day only, never the year. Private to you; used so the club can celebrate members.
Location
Member event check-in: when you tap Check in, the app reads GPS to confirm proximity on your device and records an attendance timestamp. This check-in does not send or store your GPS coordinates.
Admin live-run broadcasting: a verified admin assigned to an enabled event may explicitly start a live session after granting location permission. The app can send precise latitude, longitude, accuracy and fix time to Supabase while foregrounded or backgrounded. Only the latest position is retained; a route trail is not recorded. The position is linked to the broadcaster and session and is used to display an authorized live run. Server-confirmed Stop removes the stored position; expired or revoked positions are removed by session cleanup and no longer shown as live. Broadcasting never starts automatically. The current member release restricts new route/live tools to admins. Maps use Apple or Google services under their privacy terms; beta 3D map viewers are not enabled in the member release.
Shop orders and payments
The merchandise catalogue and partner offers remain available to members. New checkout and order tools are currently admin-only and use Stripe test mode; live charges are disabled. Order records include account identity, products, sizes, quantities, amounts, payment status, pickup and refund history. Authorized admins use these records to manage orders.
Payment details are entered through Stripe or Apple Pay. We do not store full card numbers; Stripe processes the supplied payment information and returns payment status. Stripe's mobile SDK also collects product-interaction data for analytics and app functionality, including payment reliability and fraud prevention. Its privacy manifests identify payment information and product interaction as linked data, without advertising tracking. These practices apply when the relevant payment tools are used, including the current admin sandbox.
Activity & attendance
The app records which events you RSVP to, your check-ins (and how you checked in — on-site, self-reported, or via a linked Strava run), and, if you’re enrolled in a training plan, which workouts you’ve marked complete.
Strava (only if you connect it)
Connecting Strava is entirely optional. If you do, you authorize us — through Strava’s official sign-in — to read your Strava profile and running activities. We store your synced runs (distance, time, pace, elevation, and route) so you can view your stats and link a run to a club event. Your Strava access tokens are held securely on our server and are never accessible to the app on your device. We only read from Strava; we never post to it. You can disconnect Strava at any time from your profile.
Photos
The “run card” feature lets you build a shareable image. If you add a photo, it’s chosen through your device’s photo picker and stays on your device — the finished card is only shared or saved where you choose. We do not upload your photos to our servers.
Push notifications
If you allow notifications, the app registers a push token so the club can send announcements. The token is removed when you sign out or turn notifications off.
2. How we use your information
- Operate your membership: roster, events, RSVPs, and attendance.
- Verify and recover your account (email code).
- Confirm attendance at club runs (check-in timestamp).
- Show your running stats and connect runs to events (Strava, if connected).
- Send club announcements and event reminders (if you opt in).
- Provide training-plan tracking to enrolled members.
- Operate explicitly started admin live runs and display their latest authorized position.
- Manage orders, pickup, refunds and payment reconciliation where enabled.
We do not use your data for advertising or to build a marketing profile.
3. How your information is shared
We do not sell your data. Information is shared only in these limited ways:
- With other members: your public profile fields (display name, pace, Instagram, avatar) and your RSVP/attendance for club events are visible to signed-in members — that’s how a roster works. Your private fields (email, home area, birthday) are never shown to other members.
- With authorized club admins: account and order information needed for club administration, and admin live-run positions while a session is authorized.
- With service providers that run the app’s infrastructure (see below).
- When you choose to, e.g., sharing a run card through your device’s share sheet.
- For legal reasons, if required by law or to protect the club and its members.
4. Third-party services
The app relies on a small set of providers, each governed by its own privacy policy:
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Backend, database, authentication, email verification codes | Account, profile, attendance, Strava cache, push tokens, orders and latest admin live position |
| Strava | Activity sync (only if you connect it) | Your Strava profile & activities, read-only |
| Expo | Push-notification delivery & app updates | Push token; standard app-update metadata |
| Stripe | Payment processing (currently admin sandbox) | Payment information, order/payment status and SDK product-interaction data |
| Apple / Google | Maps and optional wallet services | Map requests and information supplied to an enabled wallet |
We do not integrate advertising networks. Stripe's payment SDK collects the operational product-interaction analytics described above; we do not use that data for advertising.
5. Tracking & advertising
We do not use advertising identifiers, data brokers, or cross-app or cross-website tracking for targeted advertising. Stripe's payment-related analytics are described above and are not used by the club for advertising. Our App Store privacy disclosures identify data collected for app functionality and applicable third-party analytics, without advertising tracking.
6. Data retention
We keep your information for as long as your account exists so the app can function. Synced Strava data is removed when you disconnect Strava. Push tokens are removed when you sign out or disable notifications. When you delete your account (below), we remove your associated data.
Live positions are removed on Stop, expiry or revocation. Ended live-session metadata is eligible for cleanup after seven days. Order and payment records are kept as needed for fulfillment, reconciliation and recordkeeping. Account deletion removes or anonymizes the associated identity where an order record must remain.
7. Deleting your account & your data
You can request permanent deletion of your account and associated data at any time:
- Use the Delete account option in the app (Profile tab, below “Sign out”), or
- Email us at svintsrunclub@gmail.com from the address on your account (or with your display name) and ask us to delete your account.
Deletion removes your profile, RSVPs and attendance history, any Strava connection and synced activities, push tokens, and training records. Some records may persist briefly in encrypted backups before being overwritten on our provider’s normal cycle. See our Support page for step-by-step help.
8. Your rights
Depending on where you live (including under GDPR and the CCPA/CPRA), you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Because we do not sell personal information or use it for targeted advertising, there is nothing to opt out of on that front. To exercise any right, contact us using the details below; most profile data can also be viewed and edited directly in the app.
9. Children’s privacy
The app is intended for club members and is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it. Members under 18 should have a parent or guardian’s permission to participate in in-person club activities.
10. Security
Data is stored with our infrastructure provider using industry-standard protections. Access to your private data is restricted to your own account through database-level security rules, and sensitive credentials (such as Strava tokens) are held only on our server, never in the app on your device. No system is perfectly secure, but we work to protect your information.
11. Changes to this policy
We may update this policy as the app evolves. We’ll revise the “Last updated” date above and, for significant changes, provide notice in the app. Continued use after an update means you accept the revised policy.
12. Contact us
Questions about this policy or your data? Email svintsrunclub@gmail.com.