Privacy Policy

Run & Resist Track Club (“Run & Resist,” “we,” “us,” or “our”) respects your privacy. This Policy explains what we collect, how we use it, and the choices you have. It applies to our website and related services (the “Services”).

Summary

• We collect only what’s needed to run the site (e.g., account profile, optional campaign/race membership, and mileage logs you add or sync).
• Donations are made directly to third-party nonprofits; we do not process or store payment card data.
• If you connect Strava, we import only basic activity metrics: distance, duration, and date. We do not store GPS routes or location traces.
• You can disconnect Strava anytime and request deletion of your account and data.
• Contact support: info@runandresist.com.

Information We Collect

Information you provide

• Account & profile: name, email, password, optional display name and location, and optional campaign/race memberships.
• Donations (self-reported): amount, date, cause, optional associations (runner/campaign), and optional receipt reference or link.
• Contact / support: email address and message contents when you reach out for help.
• Newsletter sign-ups: email address (optional).

Information collected automatically

• Server logs: IP address, user-agent, pages visited, and timestamps (used for security, diagnostics, and abuse prevention).
• Cookies: a minimal session cookie used only for authentication and CSRF protection. We do not use third-party ad cookies or trackers.

Third-party sources (optional)

• Strava (only if you connect): With your permission, we import limited activity data to power mileage, leaderboards, campaigns, and races.
  • What we read: distance, moving time, activity timestamp, Strava activity ID, and sport type (e.g., run vs walk).
  • What we do not store: GPS coordinates, route maps, raw streams, or detailed sensor traces.
  • Visibility: We respect your Strava privacy settings; private activities are synced but never shown publicly.
  More detail: API Data Handling.

How We Use Information

• Operate, maintain, and improve the Services.
• Show mileage, campaign totals, race results, and aggregate stats.
• Provide support and send transactional notices you request (e.g., password resets).
• Protect accounts, prevent abuse, and secure the site.
• Comply with legal obligations.

When We Share Information

We do not sell your personal information. We share data only when necessary:

• Service providers: hosting (DigitalOcean), email (Postmark), logging, and essential integrations—each under appropriate safeguards.
• Legal/safety: if required by law or when necessary to protect people or the Services.
• At your direction: where you choose to make information public (e.g., display name on leaderboards).

Data Security

We use reasonable administrative, technical, and physical safeguards, including HTTPS, CSRF protection, encrypted OAuth tokens, and role-based access. No online system is perfectly secure, but we take security seriously.

Retention

We retain information only as long as necessary to operate the Services. When you delete your account, we anonymize your profile, preserve only minimal mileage needed for campaign and leaderboard integrity, and schedule full data removal after a waiting period. You can request deletion anytime at info@runandresist.com.

Your Rights & Choices

• Access / correction / deletion: contact support to request changes or deletion.
• Strava: disconnect anytime in your profile or in Strava’s settings.
• Email preferences: opt out of optional emails at any time.
• Cookies: you may block cookies, though core site features (login, CSRF protection) may stop working.

International Users

We operate in the United States. Your data may be stored or processed in the U.S.

Children

Our Services are not directed to children under 13, and we do not knowingly collect their information. Accounts must be held by adults (18+), or by a parent/guardian managing an account on behalf of a minor.

Service Providers We Use

• Hosting: DigitalOcean (infrastructure), nginx/PHP.
• Email: Postmark (transactional), Google Workspace (team inbox).
• Integrations: Strava API (optional, minimal scope).

Changes to This Policy

We may update this Policy from time to time. We’ll revise the date at the top and, when appropriate, provide additional notice.

Contact Support

Questions, concerns, or requests? Email info@runandresist.com. We typically respond as soon as possible.