Privacy Policy

1. Who We Are

RaceClan is a virtual race competition platform for UK sports clubs, operated by Alec Darlow ("we", "us", "our"). The platform is accessible at raceclan.co.uk.

For the purposes of UK data protection law, Alec Darlow is the data controller for personal data processed through this platform.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at: contact@raceclan.co.uk

2. What This Platform Does

RaceClan allows sports clubs to run virtual competitions in which members accumulate "equivalent distance" from their real-world athletic activities tracked on Strava. Progress is visualised on Google Maps along a real-world route.

The platform is made available to sports clubs. Each club is responsible for informing its members that the platform is in use and that their Strava activity data will be used as described in this policy. By accessing the competition pages of this platform, you confirm that you have been made aware of this by your club.

3. What Personal Data We Collect and Why

We collect only the data necessary to operate the competition. The table below explains what we collect, where it comes from, and why.

3.1 Data sourced from the Strava Club API

When your club administrator connects RaceClan to your Strava club, the following data is automatically pulled from the Strava Club API for every member who has recorded an activity within the club:

• First name and last name
• Profile picture URL (where you have made this available on Strava)
• Sport type (e.g. Run, Ride, Swim)
• Activity distance (metres)
• Activity moving time (seconds)
• Activity elevation gain (metres)
• Activity date and time

We do not receive your Strava athlete ID, email address, heart rate data, GPS route data, power data, or any other data not listed above. The Strava Club API is specifically designed to limit what is shared for member privacy.

This data is used solely to calculate your equivalent competition distance and display your progress on the race leaderboard and map.

3.2 Data you provide when accessing the platform

Club members access the competition pages using a shared club password provided by their club secretary. We do not collect your name, email address, or any other personal data at login. No individual accounts are created.

3.3 Data collected automatically

When you visit raceclan.co.uk, standard web server logs may record your IP address, browser type, and the pages you access. This data is used only for security and operational purposes and is not linked to your competition profile. It is retained for a maximum of 30 days.

4. A Note on Fitness and Activity Data

Under UK GDPR, data concerning health can be treated as a special category requiring additional protection. Although the activity data we receive from Strava (distance, time, sport type) does not reveal specific health or medical information, we treat it with care and use it only for the purpose of calculating competition standings. We do not share it with third parties for any other purpose, we do not sell it, and we do not use it for profiling or marketing.

5. Our Legal Basis for Processing Your Data

We rely on legitimate interests (Article 6(1)(f) UK GDPR) as our lawful basis for processing. Our legitimate interest is operating a club competition platform where members have voluntarily joined a Strava club and have been informed by their club that this platform is in use. We have assessed that this processing does not override your individual rights and freedoms, because:

• The data is limited to what is necessary for competition purposes
• The data is not shared beyond the club community
• Participation in the club's Strava group is voluntary
• The club is responsible for notifying members before the platform is activated

6. How We Store Your Data

Your data is stored in a PostgreSQL database hosted by Supabase, which uses servers located in the European Economic Area (EEA). All data is encrypted at rest and in transit. Access to the database is restricted by Row Level Security policies, meaning only the platform and its administrator can read or modify the data.

The platform is hosted on Vercel, which may use servers in the United States. Vercel is certified under the EU-US Data Privacy Framework and provides appropriate safeguards for any such transfers.

7. How Long We Keep Your Data

We retain your personal data only for as long as your club is actively running a competition on this platform. Specifically:

• Activity data is retained for the duration of the race and for a reasonable period afterwards to allow final standings to be reviewed.
• If a club requests deletion of their data, all associated athlete and activity records will be permanently deleted within 30 days.
• Web server logs are retained for a maximum of 30 days.

8. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We share data only with the following third-party services that are essential to operate the platform:

• Strava (data source) — we retrieve data from the Strava Club API. Strava's own privacy policy governs the data you share with Strava directly.
• Supabase (database hosting) — stores athlete and activity data securely.
• Vercel (platform hosting) — hosts the web application.
• Google Maps (visualisation) — the Google Maps JavaScript API is used to display race progress. Google's privacy policy applies to map data.

All third-party providers are bound by their own privacy policies and applicable data protection law. We do not share your data with any advertising networks, analytics companies, or other third parties.

9. Your Rights Under UK GDPR

As a data subject under UK GDPR, you have the following rights:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — if the data we hold is inaccurate, you may ask us to correct it.
• Right to erasure — you may ask us to delete your personal data. Note that your name and activity data is drawn from Strava; to prevent it being re-synced, you should leave your club's Strava group or make your activities private.
• Right to restriction — you may ask us to restrict processing of your data in certain circumstances.
• Right to object — you may object to processing based on legitimate interests.
• Right to data portability — you may ask for your data in a machine-readable format.

To exercise any of these rights, please contact us at contact@raceclan.co.uk. We will respond within one calendar month.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Children's Privacy

This platform is not intended for use by children under the age of 13. We do not knowingly collect personal data from children. If you believe a child under 13 has had their data processed through this platform without appropriate parental consent, please contact us and we will delete that data promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the platform after any changes constitutes acceptance of the updated policy. We recommend checking this page periodically.

12. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy, please get in touch:

© 2026 RaceClan — Operated by Alec Darlow