Privacy Policy
Last updated: August 5, 2026
1. Who we are
Syndicate Running operates syndicaterunning.com and related services, including Battle of the Run Clubs, a run club competition product that connects to Strava.
The controller of your personal data is Syndicate Running LLC, an Indiana limited liability company, at available on request. You can reach us about anything in this policy at hello@syndicaterunning.com.
2. What this policy covers
This policy applies when you visit the site, subscribe to our newsletter, create or use a Battle of the Run Clubs account, connect Strava, email us, or interact with cookies on the site.
It does not cover the practices of the brands we link to. When you click through to a brand's own store, that brand's privacy policy governs what happens next.
3. What we collect
Information you give us. Your name, email address, account profile information, marketing preferences, and the contents of messages you send us.
Information from Strava, only if you connect it. When you authorize Strava, we receive and store your Strava athlete ID, the name and profile photo Strava provides, access and refresh tokens used to sync activities, and the activity data we need for scoring: distance, elevation gain, activity date, and related activity metadata.
Information collected automatically. Necessary cookies and local storage for your session and your consent choices. Analytics cookies, depending on your region and preferences (see Cookies below). Standard server and security logs including IP address, user agent, and request metadata. We also use your approximate location (country) from our hosting provider to decide whether analytics requires opt-in.
What we do not collect. We do not process payment card details on this site. We do not seek special category data such as health records, and you should not send it to us.
4. How we use your data, and our legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Run the site and your Battle of the Run Clubs account | accounts, standings, squad invites, activity syncing | performance of a contract, and our legitimate interest in operating a secure service |
| Send messages needed to run your account or the competition | invite links, season notices, account status | performance of a contract |
| Send the newsletter and optional competition updates | the log, product news | your consent, which you can withdraw at any time |
| Measure site traffic | Google Analytics | consent in the EEA, UK, and Switzerland; legitimate interest / opt-out model elsewhere (including the United States) |
| Prevent fraud and abuse, debug problems | logs, rate limiting | our legitimate interest in keeping the service working and secure |
| Meet legal obligations | responding to lawful requests | legal obligation |
Rules we hold ourselves to, and they are built into the product:
In the EEA, UK, and Switzerland, analytics and marketing cookies stay off until you allow them. Outside those regions (including the United States), analytics cookies are on by default so we can understand traffic, and you can turn them off anytime. Marketing cookies stay off until you enable them everywhere. Connecting Strava does not subscribe you to marketing email. The marketing checkbox on your Battle of the Run Clubs profile is optional and unticked by default.
5. Cookies
Necessary cookies are always on. They handle security, your session, and remembering your cookie choices.
Analytics cookies help us understand how people find and use the site via Google Analytics. In the EEA, UK, and Switzerland they are off until you opt in. In other regions, including the United States, they are on by default and you can opt out. We use Google Consent Mode so measurement respects your choice.
Marketing cookies are optional and off by default everywhere.
Where we require a choice, you can accept all, reject everything non-essential, or set each category individually. Anywhere on the site, you can change your mind using the cookie settings control. When you turn analytics or marketing off, we clear the associated Google Analytics cookies and keep those storage types denied.
Your choice is stored in a versioned key called sr_cookie_consent_v1 for roughly 180 days, after which we ask again where a choice is required. We also store a short-lived region signal (sr_privacy_region) based on country so the site knows whether to use the opt-in or opt-out analytics model.
6. Email
You get on our newsletter list one way only: you ask to be. That means a signup form on the site, the newsletter page, the popup, an explicit Battle of the Run Clubs signup, or the optional marketing checkbox when you complete your competition profile.
Creating an account does not subscribe you. Connecting Strava does not subscribe you.
Every email has an unsubscribe link. Using it marks you inactive in our database and unsubscribed with our email provider. If you would rather be deleted entirely than suppressed, email us and we will handle it.
7. Who we share data with
We use these providers to run the service. They process data on our instructions, not for their own purposes.
| Provider | What they do |
|---|---|
| Vercel | hosting and application delivery |
| Supabase | database and file storage |
| Resend | newsletter and transactional email |
| Strava | activity source, only if you connect it |
| analytics (consent-required in the EEA/UK/Switzerland; on by default elsewhere with opt-out) | |
| Uppromote | affiliate link tracking and commission attribution |
We do not sell your personal information and we do not share it for cross-context behavioral advertising.
Syndicate Running participates in affiliate programs. When you click a link to a brand and buy something, we may earn a commission. That is a commercial disclosure about how we make money, not a sale of your data.
8. Where your data goes
We are based in the United States and our providers process data in the United States and elsewhere. If you are in the EEA, the UK, or Switzerland, transfers of your data rely on the standard contractual clauses and the data processing terms we have in place with each provider.
9. How long we keep things
| Data | How long |
|---|---|
| Battle of the Run Clubs account and activity history | while your account is active, and for a reasonable period after you ask us to delete it |
| Strava access and refresh tokens | while your connection is active, then deleted on disconnect |
| Active newsletter subscribers | until you unsubscribe or ask for deletion |
| Unsubscribe records | kept as a suppression list so we honor your opt out |
| Cookie consent record | up to 180 days |
| Server and security logs | a short operational window |
10. Security
We use HTTPS, access controls, httpOnly session cookies for the Strava session, and least privilege service keys. No system is perfectly secure, and we will not pretend otherwise. If something goes wrong that affects you, we will tell you.
11. What is visible to other people
Battle of the Run Clubs publishes squad level totals on the public leaderboard: combined miles and combined vertical gain, plus your squad name and the display names of its members. Your individual activity breakdown is visible only to you when you are logged in. We do not publish per athlete splits.
12. Children
This service is not for children. You must be at least 16 if you are in the EEA or the UK, and at least 13 in the United States. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.
13. Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service. You can withdraw consent at any time, which does not affect anything we did lawfully beforehand.
If you are in California, you can ask what we collect, ask us to delete or correct it, and opt out of sale or sharing. As stated above, we do not sell or share your data in that sense.
Email hello@syndicaterunning.com and we will respond within 30 days. If you are in the EEA or the UK and you are not happy with how we handled it, you can complain to your local supervisory authority, which in the UK is the Information Commissioner's Office.
14. Strava specifically
Connecting Strava is voluntary. It is required only for the parts of Battle of the Run Clubs that depend on your activity data. We request the minimum scopes needed to read the activities we score.
You can disconnect at any time from your Strava settings or by asking us. Disconnecting stops future syncing and deletes the tokens we hold, and we delete the activity data we stored within thirty days.
If you delete an activity on Strava, we stop displaying it within forty eight hours.
You can access and export your own Strava data at any time, free of charge, using Strava's Bulk Data Export Tool. That right sits with Strava and nothing here limits it.
We do not use any data obtained through the Strava API to train artificial intelligence or machine learning models.
Strava's own privacy policy applies to the data Strava holds: https://www.strava.com/legal/privacy
15. Changes
We will update this page when our practices change and update the date at the top. If a change is significant, we will tell subscribers by email, and where the law requires it we will ask for your consent again.
16. Contact
Questions, requests, or complaints: hello@syndicaterunning.com