Privacy Policy

1. Introduction

Run Clubs App (the "Platform" or "Service"), including the runclubsapp.com website and the Run Clubs App mobile and watch applications, is owned and operated by ATA Web LLC, a limited liability company organized in the Commonwealth of Virginia, United States ("ATA Web", "we", "us", or "our"). ATA Web LLC is the data controller responsible for your personal information under this Privacy Policy.

This Privacy Policy describes what information we collect, how we use and share it, how long we keep it, and the choices and rights you have. Our servers are located in the United States, and your information is stored and processed there. This Policy is incorporated into our Terms of Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address and name. Your password is handled by Amazon Cognito and is never visible to us.
• Profile Information: First name, last name, username, profile photo, home city, and role (runner or founder)
• Run Club Information (founders): Club name, city, meeting schedule and locations, description, logo, contact details, and social media links
• Event Information (founders): Event titles, dates, meeting points, descriptions, and routes
• Runs and RSVPs: Events you RSVP to, runs you track or import (route, distance, duration, pace, splits), and any photo or title you attach to a run
• Community Content: Messages you send in club group chats and in the Founders Lounge, posts you make to a club feed (text, optional photo, distance), ideas and votes you submit on the Founders Lounge ideas board, and announcements or broadcasts you send as a founder
• Reports: If you report a message or user, we record what you reported, the reason you give, and your account identity so moderators can act on it
• Waiver Submissions: If a run club asks you to sign its waiver through our website, we collect the information the club requests: full name, email address, phone number, emergency contact name and phone number, date of birth, and an image of your drawn signature. This information is collected on behalf of the club and is made available to that club's founder (see Section 5.1)
• Correspondence: Anything you send us by email or through in-app support

2.2 Automatically Collected Information

• Usage Data: In the mobile app, the screens you view and features you use, as described in Section 2.5. On the website, we keep only standard server logs; we do not run analytics on the website
• Device Information: Browser type, operating system, IP address
• Location Data: On the website, the city you search for or select. In the mobile app, your device's precise location, with your permission, as described in Section 2.4
• Cookies: The website sets a single first-party session cookie that remembers that you are signed in. It contains no personal information and expires after seven days. We do not use advertising or third-party analytics cookies on the website. See Section 11

2.3 Information from Third-Party Sources

• Social Media: Publicly available information from Instagram, Facebook, and other social platforms
• Mapping Services: Location, place search, and route data from Mapbox and CARTO
• Authentication Services: Information from AWS Cognito for user authentication

2.4 Mobile App Data (Health and Location)

When you use our mobile app or the Apple Watch app, we access the following additional categories of data only after you grant the relevant permission on your device. You can revoke any of these permissions at any time in your device settings, and the related feature will stop working until you grant it again.

• Location While Using the App:With your permission, we use your device's precise location while the app is open to show run clubs and group runs near you and to center the map. We use the coordinates to run the nearby search and do not keep a history of where you have been.
• Health and Fitness Data: With your permission, we access health and fitness data from Apple Health (iOS and Apple Watch) or Health Connect (Android). The specific data types we read are:
  • iPhone (Apple Health): workouts, walking and running distance, workout routes, heart rate, and active energy burned
  • Apple Watch (Apple Health): heart rate, resting heart rate, active energy burned, walking and running distance, and date of birth
  • Android (Health Connect): exercise sessions, distance, and exercise routes
  We write completed runs back to Apple Health or Health Connect as workouts. This data is used solely to record and sync your runs, display your run history, show live heart rate and heart-rate zones on Apple Watch, and let you import past workouts into the app. Your date of birth is read on Apple Watch only to calculate heart-rate zones and is never sent to our servers. Heart rate and calorie summaries from a run you track or import are stored as part of that run record and are visible only to you. Past workouts are only sent to our servers if you explicitly choose to import them. We do not sell Health data, share it with third parties, or use it for advertising, marketing, or analytics.
• Precise Location Data (GPS): With your permission, we collect precise GPS coordinates during an active run, including when the app is in the background or the screen is locked. This is used solely to record your run route, calculate distance and pace, and display the route on a map. Background location is collected only while a run is in progress and stops automatically when the run ends. You can revoke this permission at any time in your device settings.
• Camera and Photo Library: With your permission, we access your camera or photo library only when you choose to upload a profile photo or club image. Photos are not collected automatically.
• Push Notification Tokens:If you allow notifications, we store a device push token linked to your account so we can send run reminders, club announcements, chat messages, event updates, and founder digests. You choose which categories to receive in the app's notification settings, and you can turn notifications off entirely in your device settings.

2.5 Product Analytics

The mobile app sends product analytics to PostHog, a third-party analytics service, so we can understand which features are used and improve the Service. The events we send are limited to things like: app opened, screen viewed, sign-up or sign-in completed, onboarding completed, club viewed, club faved, event viewed, RSVP joined, run started, run completed, chat message sent, announcement sent, and notification opened. Events are tied to your account identifier and include your role (runner, founder, or admin), the club you lead if you are a founder, your app version, and your device platform and operating system version. PostHog may derive an approximate location from your IP address.

We do not send message contents, GPS routes, Health data, photos, or waiver information to PostHog, and we do not use analytics for advertising. The website does not use PostHog or any other analytics service. If you object to analytics, contact us at info@runclubsapp.com and we will exclude your account.

3. How We Use Your Information

We use collected information for:

• Platform Operation: Providing and maintaining the Service
• User Accounts: Creating and managing your account
• Communication: Sending notifications, updates, and responding to inquiries
• Verification: Displaying verification badges for registered founders
• Analytics: Understanding usage patterns and improving the Service
• Community Features and Moderation: Delivering chat messages, feed posts, and announcements to the right people, and reviewing reports
• Hosting Waivers for Clubs: Collecting and storing waiver submissions on behalf of the club that requested them
• Safety and Security: Detecting fraud, abuse, or violations of Terms
• Legal Compliance: Complying with legal obligations and protecting our rights

4. Data Sources and Aggregation

4.1 Public Data Collection

We collect publicly available information about run clubs from:

• Social media platforms (Instagram, Facebook, etc.)
• Run club websites and online presence
• Community forums and running event calendars
• User submissions and contributions

4.2 No Ownership of Third-Party Data

We do not claim ownership of information originally published by run clubs or third parties. We aggregate and display this information for convenience but do not guarantee its accuracy or currency.

5. Information Sharing and Disclosure

5.1 Who Can See Your Information

Some information is visible to other people by design. Please consider this before you post.

• Public to everyone, including visitors without an account: run club names, descriptions, logos, meeting locations, schedules, social links, verification badge status, and event details and routes
• Visible to other signed-in users: your display name, username, and profile photo, for example in attendee lists of events you RSVP to and next to content you post
• Visible to members of a club's community: messages you send in that club's group chat, posts you make to that club's feed, and your membership in the chat
• Visible to founders and our team only: messages, ideas, and votes in the Founders Lounge
• Visible to the club founder only: waiver submissions you make for that club, including your contact details, emergency contact, date of birth, and signature. The founder is responsible for how the club uses that information
• Visible only to you: your tracked and imported runs, your run history, heart rate and calorie summaries, your notification settings, and your faved clubs

Routes you track reveal where you ran, including where you started and finished. Think carefully before sharing a run that starts or ends at your home.

5.2 Third-Party Services

We share information only with the service providers below, who process it on our behalf and under our instructions to operate the Service. Each provider is bound by its own privacy and data-processing terms that provide protection at least equal to this Privacy Policy. We do not sell your information to any of them.

• Amazon Web Services (AWS): hosting, databases, file storage, and content delivery (Amazon CloudFront). Our servers are located in the United States.
• Amazon Cognito: account creation, sign-in, and authentication
• Amazon Simple Email Service (SES): transactional and notification emails
• PostHog: product analytics (which screens and features are used), so we can improve the Service. We do not send Health data or GPS routes to PostHog.
• Mapbox: maps, route display, and place search in the mobile app
• CARTO: base map tiles on the website
• Expo push service, Apple Push Notification service (APNs), and Firebase Cloud Messaging (FCM): delivery of push notifications to your device

5.3 Legal Requirements

We may disclose information if required by law or in good faith belief that such action is necessary to:

• Comply with legal obligations or court orders
• Protect and defend our rights or property
• Prevent fraud or security issues
• Protect the personal safety of users or the public

5.4 Community Features, Reporting, and Moderation

Club group chats, club feeds, and the Founders Lounge are moderated. When you report a message or a user, we store a copy of the reported content together with the identity of the person who posted it, your identity as the reporter, and the reason you give. Reports about a club chat are sent to that club's founder and to the Run Clubs App team. Our team reviews reports and may remove content, restrict or remove accounts, and, where required, share report details with law enforcement.

Club founders can approve, decline, remove, and block members of their club chat and can delete messages in it. A record that a founder blocked you from a club chat is kept so the block stays in effect.

When a founder sends an announcement or broadcast, it is delivered to the club's fans through push notifications, the in-app inbox, and, for some messages, email, according to each recipient's notification settings. Founders can see aggregate statistics about their club, such as fan counts and RSVP counts, but not your private run data.

5.5 Business Transfers

If ATA Web LLC is involved in a merger, acquisition, financing, or sale of all or part of its assets, your information may be transferred as part of that transaction. We will notify you by email or by a notice in the Service before your information becomes subject to a different privacy policy.

6. Your Rights and Choices

6.2 Deletion

You may request deletion of:

• Your account
• Your personal information
• Run clubs you have registered (founders only)

Note: Some information may remain in backups or as required by law.

6.3 Notifications, Email, and Other Choices

• Push notifications: In the app's notification settings you can turn each category on or off: run reminders, club announcements, club chat messages, club updates, founder digests, and marketing. You can also disable notifications entirely in your device settings.
• Transactional email: We send emails that are necessary to operate your account, such as sign-up verification, password resets, and responses to your requests. You cannot opt out of these while you have an account.
• Notification and marketing email: Reminder, digest, and newsletter emails each include an unsubscribe link. You can also turn off the marketing category in the app.
• Analytics: Contact us at info@runclubsapp.com to be excluded from product analytics (Section 2.5).
• Device permissions: Location, Health, camera, photo library, and notification access can each be revoked in your device settings at any time.

6.4 Data Portability

You may request a copy of your personal information in a structured, machine-readable format.

7. Data Security

We implement reasonable security measures to protect your information, including:

• Encryption in transit (TLS) for all connections between your device and our servers, and encryption at rest for our databases and file storage using AWS-managed keys
• Passwords that are never stored or seen by us: authentication is handled by Amazon Cognito, which stores only a salted hash
• Authenticated, per-user access to our APIs, so one user cannot read another user's private data
• Least-privilege access controls for our own staff and systems, and logging of API activity
• Short-lived, signed upload links for photos and signatures

8. Data Retention

We retain your information only for as long as necessary to provide the Service and for the purposes described in this Privacy Policy:

• Account Information: Retained for as long as your account is active. Deleted within 30 days of account deletion, except where retention is required by law (e.g., for tax, fraud prevention, or legal compliance, in which case it is kept for the minimum period required, typically up to 7 years).
• Profile Information: Retained while your account is active and deleted within 30 days of account deletion.
• Run History and Routes: Retained while your account is active. You may delete individual runs at any time from within the app; deleted runs are permanently removed within 30 days. All run data is deleted within 30 days of account deletion.
• Health and Fitness Data: We do not store health data on our servers unless you explicitly import a run from Apple Health or Health Connect. Imported runs are retained as part of your run history (see above). Health permissions can be revoked at any time in your device settings, after which we no longer access this data.
• Location Data: GPS coordinates collected during a run are stored as part of that run record and follow the same retention rules as Run History (above). Background location collection stops immediately when a run ends.
• Run Club and Event Information: Public club and event information is retained for as long as the club is active. Founders may delete their clubs at any time, and associated content is removed within 30 days.
• Push Notification Tokens: Retained while your account is active and the app is installed. Automatically invalidated when you uninstall the app or disable notifications, and deleted with your account.
• Chat Messages, Feed Posts, Ideas, and Votes: Retained while your account is active. Messages and ideas you delete in the app are removed immediately and purged within 30 days. To remove a feed post, contact the club founder or email us. All of your messages, posts, ideas, and votes are deleted within 30 days of account deletion.
• Reports and Moderation Records: Retained for as long as reasonably necessary to handle the report, identify repeat behavior, and defend against legal claims. Records of a founder blocking you from a club chat are kept for as long as the block is in effect.
• Waiver Submissions: Retained for as long as the club remains on the Service, or until the club founder deletes the submission, because the club relies on them for its own records. If you want a waiver submission removed, contact the club or email us at info@runclubsapp.com and we will remove it unless the club has a legal reason to retain it. Waiver submissions are deleted when the club is deleted.
• Email Preferences: Your marketing and notification email choices are stored with your account and deleted with it. Unsubscribing from marketing email is recorded immediately.
• Analytics Identity: Your PostHog profile and associated events are deleted within 30 days of account deletion.
• Usage Data and Analytics: Product analytics events linked to your account (Section 2.5) are retained while your account is active and deleted within 30 days of account deletion. Aggregated statistics that do not identify you, such as daily active user counts, may be kept indefinitely.
• Server Logs: Retained for up to 90 days for security, debugging, and abuse prevention.
• Backups: Backups of our databases may persist for up to 90 days after deletion before being permanently purged.

You can delete your account and data at any time in three ways: from the Settings screen in the mobile app, by visiting runclubsapp.com/delete-account, or by emailing info@runclubsapp.com from the address on your account. Deleting your account removes your profile, runs, RSVPs, faves, photos, chat messages, feed posts, ideas, votes, push tokens, email preferences, and analytics identity, and releases your username. Copies may persist in backups for up to 90 days. We respond to emailed deletion requests within 30 days.

9. Privacy Rights for Residents of U.S. States

California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and a growing number of other states have comprehensive privacy laws. Some of these laws apply only to businesses above certain size thresholds that we may not currently meet. Regardless, we extend the following rights to all U.S. residents:

• Right to know and access: the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we share it with. Sections 2, 3, and 5 describe these.
• Right to correct inaccurate personal information. Most profile information can be corrected in the app.
• Right to delete your personal information, subject to the exceptions described in Section 8.
• Right to data portability: a copy of your personal information in a portable format (Section 6.4).
• Right to opt out of the sale of personal information, of sharing for cross-context behavioral advertising, of targeted advertising, and of profiling that produces legal or similarly significant effects. We do not do any of these, so there is nothing to opt out of.
• Right to limit the use of sensitive personal information. We use precise location and health data only for the purposes described in Section 2.4 and never for advertising or inference about you.
• Right to non-discrimination: we will not deny you the Service, charge you a different price, or provide a different level of service because you exercised a privacy right.
• Right to appeal: if we decline a request, you may appeal by replying to our decision. We will respond to an appeal within 45 days and, if we still decline, tell you how to contact your state attorney general.

How to Exercise These Rights

Email info@runclubsapp.com from the address on your account, or use the in-app Settings screen for deletion. We will verify your identity by confirming control of the account email and may ask for additional information for sensitive requests. We respond within 45 days and may extend once by a further 45 days with notice. You may designate an authorized agent to make a request on your behalf; we will ask the agent for proof of your written authorization and may still verify your identity directly.

California Notice at Collection

In the preceding 12 months we have collected the categories of personal information listed in Section 2 (identifiers, account and profile details, geolocation, health and fitness data, user content, device and usage data, and inferences limited to the product analytics in Section 2.5), for the purposes in Section 3, retained as described in Section 8, and disclosed only to the service providers in Section 5.2. We do not knowingly collect personal information of consumers under 16.

10. Notice for Individuals in the EEA, United Kingdom, and Switzerland

If you are in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR), the UK GDPR, or the Swiss Federal Act on Data Protection gives you the following additional information and rights. ATA Web LLC, Virginia, United States, is the controller. We have not appointed a representative in the EEA or the United Kingdom; you can contact us directly at info@runclubsapp.com.

10.1 Legal Bases for Processing

• Performance of a contract (Art. 6(1)(b)): creating and operating your account, showing you clubs and events, recording and storing your runs, delivering chat messages and notifications you have enabled, and hosting waivers at a club's request.
• Consent (Art. 6(1)(a)): access to your device's precise location, camera, photo library, and push notifications; marketing email and the newsletter; and product analytics. You can withdraw consent at any time through your device settings, the app's notification settings, unsubscribe links, or by contacting us, without affecting processing that took place before withdrawal.
• Explicit consent for health data (Art. 9(2)(a)): heart rate, calorie, resting heart rate, workout, and date-of-birth data from Apple Health or Health Connect are special-category data. We process them only after you grant the Health permission on your device, which is your explicit consent, and only for the purposes in Section 2.4. Revoking the Health permission withdraws that consent.
• Legitimate interests (Art. 6(1)(f)): securing the Service, preventing abuse, handling reports, improving features using aggregated usage data, and compiling club listings from information clubs have made public. We have balanced these interests against your rights and do not use them for profiling or advertising.
• Legal obligation (Art. 6(1)(c)): responding to lawful requests and retaining records where law requires.

10.2 Your Rights

You have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data, including by deleting your account (Section 8);
• restrict processing in certain circumstances;
• receive data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller;
• object to processing based on legitimate interests, including the product analytics described in Section 2.5;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EEA it is the data protection authority of your country.

To exercise any of these rights, email info@runclubsapp.com. We respond within one month, which may be extended by two further months for complex requests, and we will tell you if that is the case. We do not make decisions based solely on automated processing that produce legal or similarly significant effects.

10.3 International Transfers

We are located in the United States, and your personal data is stored and processed there when you use the Service. The United States has not been found by the European Commission to provide an adequate level of data protection in general, and ATA Web LLC is not currently certified under the EU-U.S. Data Privacy Framework. Your data is transferred to us because the transfer is necessary to perform the contract you have requested (Art. 49(1)(b)) and, for optional features, on the basis of your explicit consent to the transfer (Art. 49(1)(a)), which you may withdraw by stopping use of the feature or deleting your account. Our service providers in Section 5.2 that may process data outside your country are bound by data-processing agreements that incorporate the European Commission's Standard Contractual Clauses or the UK Addendum where applicable.

11. Cookies and Tracking Technologies

Cookies We Use

• Session cookie (essential): A single first-party cookie named runclubs_session that records that you are signed in on the website. It holds no personal information and expires after seven days or when you sign out.
• Authentication storage (essential): Amazon Cognito stores your sign-in tokens in your browser's local storage so you stay signed in. Mapbox and CARTO map tiles may set technical cookies needed to serve the map.

We do not use advertising cookies, third-party analytics cookies, or tracking pixels on the website. The mobile app does not use cookies; its analytics are described in Section 2.5.

Do Not Track

Because we do not track users across third-party websites or services, we do not respond differently to browser "Do Not Track" signals or Global Privacy Control signals. We do not sell or share personal information for targeted advertising, so there is nothing to opt out of in that respect.

Managing Cookies

You can control cookies through your browser settings. Note that disabling cookies may affect Platform functionality.

12. Children's Privacy

Run Clubs App accounts and the mobile app are intended for adults. You must be at least 18 years old, or the age of majority in your jurisdiction if higher, to create an account. We do not knowingly collect personal information from anyone under 18, and we do not direct the Service to children. If you believe a minor has created an account or that we hold a minor's information, contact us at info@runclubsapp.com and we will delete it promptly. Waiver forms hosted for clubs may be signed on behalf of a minor participant by a parent or guardian; that information is collected for the club as described in Sections 2.1 and 5.1.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make a change that materially reduces your rights or expands how we use your personal information, we will give you at least fourteen (14) days' advance notice by posting the updated Policy with a new "Last Updated" date and by email to the address on your account or by a prominent notice in the Service. Other changes take effect when posted. If you do not agree to a change, you may delete your account before it takes effect. Where a change requires your consent under applicable law, we will ask for it.

14. Contact Us

For privacy-related questions or to exercise your rights, contact us at: