Privacy Policy

This Privacy Policy explains how Lucta (“we”, “us”, “our”) collects, uses, and protects your data when you use the Lucta mobile application and website (the “Service”).

1. What we collect

• Account data: email address, password (stored as a hash), optional display name, and whether your email address is verified.
• Preferences: whether your runner profile is visible to other members, your email and push notification choices, and any running goal you set.
• Run sharing preference: whether you opt in to sharing eligible activity details with other signed-in Lucta runners. This is off by default.
• Competition data: league placements, rankings, promotion and relegation outcomes, and the private leagues you host or join.
• Strava connection: your Strava athlete ID, username and profile photo link, and the access tokens Strava issues so we can read your runs.
• Strava activity data: for each run, the activity ID and name, distance, moving and elapsed time, start date, GPS start location, elevation gain, average speed, sport type, your best-effort times (mile, 5K, 10K, half marathon), and whether the activity is private on Strava.
• Community activity: the runners you follow, the likes and comments you post, reports you make about runs or comments (the reason and any details you add), and the runners you block. The in-app notifications we send you record which runner and which run they are about.
• Sessions and devices: a record of each app sign-in (when it started, when it expires and whether it has been signed out), your device's push notification token if you allow notifications, and, while you connect Strava, a short-lived record tying that connection to the sign-in that started it.
• Email and push delivery logs: the address or device, subject or message, and whether each email or push was delivered.
• Subscription data (Lucta Pro): whether Pro is active, the product, the current period end, trial and renewal status, and the Apple transaction identifiers used to verify the purchase. Payment is handled by Apple; card details never reach Lucta.
• Waitlist data: if you join the waitlist before launch, your email address, when you joined, the random code in your unsubscribe links and, if you unsubscribe, when you did.

Your IP address is used briefly, in memory, to limit how often requests can be made. It is not stored in our database.

2. How we use your data

• To operate the league: validate runs, calculate standings, and determine promotions and relegations.
• To manage your account.
• To provide Lucta Pro: verify purchases with Apple and keep your subscription status current.
• To send you transactional emails (welcome, verification, password reset, results, league updates), and the push and in-app notifications you have allowed.
• To send waitlist emails: a welcome email and a short series of updates before launch, each with an unsubscribe link. Unsubscribing stops them straight away.
• To keep the community safe: review reports, remove content that breaks our Terms, and apply the blocks you set.
• To communicate important changes to the Service.
• To detect and prevent fraud or abuse.

3. Strava data

We access your Strava activity data to verify run eligibility, calculate league scores and provide your own running history and insights. We do not access your private messages, social activity, or data unrelated to running activities.

Private activities can contribute to league totals and every scoring format, including scores based on a single run. Their activity details are visible only to you. Other activity details appear to signed-in Lucta runners only after you turn on run sharing in Settings. This is a separate choice from Strava visibility; activities marked Only You in Strava are never shared in Lucta. Activities whose privacy has not yet been checked stay visible only to you.

Notifications about someone's run follow the same rules: another runner is only told about a run whose details they are allowed to see.

You can turn sharing off or hide your profile in the Lucta app. Hiding your profile masks your name and photo across shared feeds and boards and closes your runner page. League scores remain visible. Updates apply to content served by Lucta; emails, push notifications, screenshots or copies someone already received cannot be recalled.

If you block a runner, neither of you sees the other's runs, comments or runner page, and neither gets notifications set off by the other. League standings are not filtered, so names still appear there. Nobody is told who blocked or reported them.

4. Revoking Strava access

• You can disconnect Strava in the app. This removes your Strava connection and deletes Strava-sourced run data from our systems.
• You can also revoke access directly at Strava Settings > My Apps.

5. Data sharing

We do not sell your personal data. We share data only with:

• Strava: via their API for activity sync.
• Resend: for email delivery, including waitlist emails.
• Apple: to verify in-app purchases and receive subscription status updates (App Store Server Notifications), and to deliver push notifications through the Apple Push Notification service. Apple's own privacy policy applies to the purchase itself.
• Render: hosts the Service and its database.

Other runners see what the app shows them under the settings above. Unless your profile is hidden, that is your name and your Strava profile photo and, on your runner page, your Strava username, your running totals, your league record and your follower counts. If you have not set a display name, the part of your email address before the @ is shown as your name, in the app and in the round results emails that list the top of your division; set a display name in Settings to replace it. Your league standings and the comments you post are shown either way, and your run details only if you have turned on run sharing. Runners you have blocked, and runners who have blocked you, do not see your runs or comments.

We may disclose data where required by law.

6. Security & retention

• All connections use HTTPS. The app keeps short-lived access tokens and a refresh token in the iOS Keychain; the admin panel uses a secure, signed cookie.
• Every app sign-in is a session we can end. Signing out ends that session; changing or resetting your password, or deleting your account, ends all of them and removes the push registrations tied to them. Ended and expired sessions are deleted automatically.
• Connecting Strava only completes for the signed-in session that started it. The record that ties it to your session expires after ten minutes and is then deleted.
• Passwords are hashed and never stored in plain text. Password reset and email verification links are stored only as hashes and expire.
• We retain data needed for league operation, fraud prevention, and legal obligations.
• When Strava access is revoked, Strava-sourced activity data is removed. A Strava connection that has not been refreshed for a year is removed the same way.
• Email and push delivery logs are deleted after 90 days.
• A block is kept until the runner who made it lifts it, or either runner's account is deleted.
• Reports are kept until the account that made them is deleted, or until the run or comment they are about is deleted, whichever comes first. A run goes when its owner deletes it on Strava, disconnects Strava or deletes their account, and a comment goes with its run or its author's account. Deleting a comment in the app hides it from everyone at once but does not delete it, so the comment, and any report about it, is kept for review until then.
• If you unsubscribe from the waitlist we keep your address, marked as unsubscribed, so we do not email it again. Entering the same address in the waitlist form again, whoever does it, sends it one email with a link to confirm, and only once until the address has rejoined and unsubscribed again; nothing changes unless that link is used. Email us to have the address deleted entirely.
• Subscription records are kept while your account exists and for as long as needed for accounting and dispute handling.

7. Your rights

You can:

• Access, update, or correct your account data in Settings in the Lucta app.
• Delete your account permanently through the app. This also deletes your comments, likes, follows, blocks and reports.
• Disconnect Strava and remove Strava-sourced data.
• Unsubscribe from waitlist emails with the link at the bottom of any of them.
• Request a full data export or deletion by emailing us.

8. Cookies

The public website sets no cookies. The admin panel uses one essential session cookie. We do not use advertising or tracking cookies.

9. Changes

We may update this policy from time to time. Material changes will be communicated via email or in-app notification.

10. Contact

For privacy or data requests, contact support@lucta.co.uk.