Privacy Policy

Enduric ("Enduric", "we", "us") operates a race catalog and personal race history service for endurance athletes. This Privacy Policy explains what personal data we collect, how and why we use it, who we share it with, and the choices and rights you have. It applies to the Enduric website, applications, and related services (the "Service").

For the purposes of the EU/UK General Data Protection Regulation (GDPR), Enduric is the data controller for personal data processed through the Service.

Account information: email address, display name, username, and any profile details you choose to provide (such as bio, location, avatar, and date of birth). If you register with email and password, we store a securely hashed password, never the password itself.

Social sign-in information: if you sign in with Google, Facebook, or Strava, we receive a limited set of profile data from that provider (see Section 5). We store a provider identifier to link the account, and, where available, your name, email, and profile picture.

Race and activity data: race results, reviews, planned races, club memberships, messages, and social interactions you create on Enduric.

Strava data (optional): if you connect Strava, we receive activity data authorized by you under the activity:read_all scope. See Section 6 below and our Strava Data page for details.

Technical data: device and browser type, IP address, and usage and security logs needed to operate and protect the Service.

Communications: messages you send to us for support or feedback.

We use personal data to:

• provide and operate Enduric features (profiles, race history, reviews, clubs, messaging, and the catalog);
• authenticate you and keep your account secure;
• process Strava activity data only as a helper: suggest race imports for you to review, and store Enduric results you explicitly publish;
• maintain, improve, and develop the Service;
• prevent, detect, and respond to fraud, abuse, and security issues; and
• send you service-related notices and respond to your requests.

We do not sell your personal data or your Strava data.

Where the GDPR applies, we rely on the following legal bases:

• Contract — to provide the Service you request (account, profile, race features).
• Consent — for optional integrations such as connecting Strava; you can withdraw consent at any time.
• Legitimate interests — to secure, improve, and promote the Service, balanced against your rights.
• Legal obligation — where we must process data to comply with the law.

When you choose to sign in with a third-party provider, we receive only the information needed to create or link your account:

• Google: your Google account identifier, name, email address, email-verification status, and profile picture (scopes: openid email profile).
• Facebook: your Facebook account identifier, name, email address (if granted and verified), and profile picture (permissions: public_profile, email).
• Strava: your Strava athlete identifier, name, and profile picture. Strava does not provide an email address through sign-in.

We use this data only to authenticate you and populate your profile. We do not post to your social accounts. Your use of these providers is also governed by their own privacy policies.

What we collect. Connecting Strava is optional and always requires your explicit authorization. Under the activity:read_all scope we read your own activities: activity name, sport type, start date and time, elapsed and moving time, distance, and start coordinates. We do not read your Strava private notes, messages, or follower lists, and we do not access data belonging to other Strava athletes.

How we collect it. Only through authorized calls to the Strava API using the tokens you granted us, and through Strava webhook notifications about your own activities. We do not scrape Strava or obtain Strava data by any other means.

How we use it. Strava acts as a helper. We group your swim, bike, and run activities into a suggested race and show you the times. You review them, edit anything that is wrong, and decide whether to publish the result to your Enduric profile. Nothing is published automatically.

Who can see it. Strava-derived suggestions, activity links, and Strava source labels are visible only to you. They are never shown to other Enduric users, and no Strava data belonging to other athletes is displayed anywhere on Enduric.

How long we keep it. Strava data is held in a transient cache for no longer than seven (7) days and is then permanently deleted from our systems. Race results you have reviewed and published stay on your profile as your own content — these are your times, confirmed by you — and we retain them until you delete the result or your account. If you delete an activity on Strava, we remove it from our cache within 48 hours.

Withdrawing consent. You can disconnect Strava at any time from your Enduric profile, or revoke access directly in your Strava settings. On disconnection we revoke our tokens, permanently delete all cached Strava data and all pending suggestions, and email you a written confirmation.

Usage Data. Strava may monitor and collect Usage Data relating to the Strava integration and may use that Usage Data for any business purpose, internal or external, including providing enhancements to the Strava API or the Strava platform, providing developer or user support, ensuring compliance with its developer agreement, or otherwise.

Your data at Strava.Independently of Enduric, you have the right to access and export your own Strava data free of charge through Strava's Bulk Data Export Tool. Nothing in this policy limits that right.

We use browser local storage to keep you signed in by storing your session tokens on your device. We use only essential storage required to operate the Service and to secure authentication. You can clear this data by signing out or clearing your browser storage, which will end your session.

Other users: public profile fields and race results you choose to publish are visible to other users according to product settings. Strava activity links and Strava source labels are shown only to you, not to other users.

Service providers (processors): we share data with infrastructure providers that help us run Enduric under contractual safeguards, including hosting, database and object storage, email delivery, and authentication providers.

Integrations:if you connect Strava, Enduric's use of Strava data is governed by the Strava API Agreement and the Strava API Policy in addition to this policy.

Legal: we may disclose data where required by law or to protect the rights, safety, and security of Enduric, our users, or the public.

We may process and store data in countries other than your own. Where we transfer personal data internationally, we use appropriate safeguards (such as the European Commission's Standard Contractual Clauses) to protect it.

We retain personal data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymize it.

Strava data is subject to a shorter, fixed limit: it is cached for no longer than seven (7) days and then permanently deleted. See Section 6 for what this means in practice.

You can disconnect Strava at any time from your profile. This stops new imports, revokes our access to your Strava account, permanently deletes all cached Strava data and pending suggestions, and sends you an email confirming the deletion. You can delete your account from Profile settings. This removes your public profile, cancels upcoming race plans, disconnects integrations, and anonymizes your name on past messages and reviews. Some data may be retained where required by law or for legitimate business purposes.

We use technical and organizational measures to protect personal data, including encrypted transport (HTTPS), hashed passwords, encryption of stored third-party tokens, and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to address vulnerabilities promptly.

Depending on your location, you may have the right to access, correct, delete, or export your personal data, to restrict or object to certain processing, and to withdraw consent. Where the GDPR applies, you also have the right to lodge a complaint with your local data protection authority.

If you are a California resident, you may have rights under the CCPA/CPRA, including the right to know, delete, and opt out of the "sale" or "sharing" of personal information. We do not sell personal information.

To exercise any of these rights, contact us using the details below.

Enduric is not intended for children under 16 (or the minimum age of digital consent in your country). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. Material changes will be reflected on this page with a new "Last updated" date, and where appropriate we will provide additional notice.

For privacy questions or to exercise your rights, contact us at privacy@enduric.co.