Privacy Policy

Last updated: Draft — placeholder

This Privacy Policy is placeholder content and will be replaced with final legal text. It explains what personal data we collect, how we use it, and the rights you have over it.

1. Data we collect

Account information — name, email address, username, password (hashed), role, and profile details such as city and country.
Donation records — donation amounts, associated campaigns and NGOs, donor name and email (guest donations included), and optional messages.
Strava activity data — when you connect Strava, we access your athlete profile and activity data to display and track campaign progress.

2. How we use your data

To create and manage your account and campaigns.
To record donations and keep campaign progress up to date.
To send transactional emails such as verification and receipts.
To display athletic activity connected to your campaigns.
To keep the platform secure and prevent abuse.

3. Your GDPR rights

If you are in the EU/EEA, you have the right to access, export, correct, and delete your personal data, and to restrict or object to certain processing. You can exercise these rights from your account settings or by contacting us. We will respond within the timeframes required by law.

4. Data retention

We retain personal data only as long as necessary to provide the service and meet legal, accounting, and reporting obligations. Donation records may be retained longer where required by financial regulations. When data is no longer needed, it is deleted or anonymized.

5. Third-party processors

We share data with trusted processors only as needed to run the service:

Stripe — payment processing (reserved for upcoming donation payments).
Resend — transactional email delivery.
Strava — athletic activity data when you connect your Strava account.

See our Cookie Policy for details on cookies and tracking.