Privacy Policy

This Privacy Policy explains how Lucta (“we”, “us”, “our”) collects, uses, and protects your data when you use the Lucta mobile application and website (the “Service”).

1. What we collect

• Account data: email address, password (stored as a hash), optional display name.
• Profile preferences: whether your runner profile is visible to other members.
• Competition data: league placements, rankings, promotion and relegation outcomes.
• Strava data: activity IDs, run distance, timing, date, GPS start location, and Strava account identifiers needed for sync and validation.
• Subscription data (Lucta Pro): whether Pro is active, the product, the current period end, trial and renewal status, and the Apple transaction identifiers used to verify the purchase. Payment is handled by Apple; card details never reach Lucta.
• Waitlist data: email address if you join the waitlist before launch.

2. How we use your data

• To operate the league: validate runs, calculate standings, and determine promotions and relegations.
• To manage your account.
• To provide Lucta Pro: verify purchases with Apple and keep your subscription status current.
• To send you transactional emails (welcome, verification, results, league updates).
• To communicate important changes to the Service.
• To detect and prevent fraud or abuse.

3. Strava data

We access your Strava activity data solely to verify run eligibility and calculate league rankings. We do not access your private messages, social activity, or data unrelated to running activities.

Strava data displayed in the app is labelled and links back to Strava where relevant. Runner profiles are visible only to signed-in runners, and you can hide your profile at any time from Settings in the Lucta app.

4. Revoking Strava access

• You can disconnect Strava in the app. This removes your Strava connection and deletes Strava-sourced run data from our systems.
• You can also revoke access directly at Strava Settings > My Apps.

5. Data sharing

We do not sell your personal data. We share data only with:

• Strava: via their API for activity sync.
• Resend: for transactional email delivery.
• Apple: to verify in-app purchases and receive subscription status updates (App Store Server Notifications). Apple's own privacy policy applies to the purchase itself.

We may disclose data where required by law.

6. Security & retention

• All connections use HTTPS. The app signs in with short-lived access tokens and a refresh token stored in the iOS Keychain; the admin panel uses a secure, signed cookie.
• Passwords are hashed and never stored in plain text.
• We retain data needed for league operation, fraud prevention, and legal obligations.
• When Strava access is revoked, Strava-sourced activity data is removed.
• Subscription records are kept while your account exists and for as long as needed for accounting and dispute handling.

7. Your rights

You can:

• Access, update, or correct your account data in Settings in the Lucta app.
• Delete your account permanently through the app.
• Disconnect Strava and remove Strava-sourced data.
• Request a full data export or deletion by emailing us.

8. Cookies

The public website sets no cookies. The admin panel uses one essential session cookie. We do not use advertising or tracking cookies.

9. Changes

We may update this policy from time to time. Material changes will be communicated via email or in-app notification.

10. Contact

For privacy or data requests, contact support@lucta.co.uk.