🔒 Privacy Policy

Last updated: June 17, 2026

This Privacy Policy describes how Team UCC 2026 collects, uses, and protects information obtained from participants through the Strava API. We are committed to protecting your privacy.

1. Who we are

Team UCC 2026 is an internal fitness event organized by Team UCC for its employees. This application is used exclusively to track participant activities and display leaderboard rankings.

2. What data we collect

• Your Strava athlete ID, first name, and last name
• Activity details: name, type, date, distance, duration, elevation gain
• Performance metrics: average speed, max speed, average cadence
• Health metrics: average heart rate, max heart rate, calories burned
• Step count (derived from cadence data)

We do not collect your GPS route, photos, gear information, or any data not directly related to activity performance.

3. How we use your data

• Displaying your activities on the internal event leaderboard
• Calculating rankings based on distance, pace, steps, and elevation
• Verifying activity authenticity to ensure fair competition
• Generating aggregate event statistics

We do not sell, share, or distribute your data to any third parties outside of Team UCC.

4. Data storage and security

Your data is stored securely in a password-protected database (Supabase, hosted on AWS) with Row Level Security (RLS) enabled. Your Strava access token is stored securely and never exposed publicly.

5. Data retention

Activity data will be retained for a maximum of 90 days after the event concludes, then permanently deleted. You may request deletion at any time by contacting the event organizer.

6. Your rights

• Disconnect your Strava account at any time via strava.com/settings/apps
• Request a copy of the data we hold about you
• Request deletion of your data before the automatic deletion period

7. Strava data usage

Our use of Strava data complies with Strava's API Agreement. We only request the minimum scopes necessary: read and activity:read.

8. Deauthorization and data deletion

If you remove this application from your Strava account at strava.com/settings/apps, we will immediately and automatically delete all of your Strava activity data and access tokens from our systems. This is handled automatically via Strava's webhook system — no manual request is needed on your part.

Specifically, upon deauthorization we delete:

• All your activity data (distance, pace, heart rate, steps, etc.)
• Your Strava access token and refresh token
• All derived metrics calculated from your activities

We retain only your company registration information (name, team, shift) which is company HR data provided by Team UCC, not Strava data.

9. Cookies

This application uses browser session storage only to maintain your admin login session. We do not use tracking cookies or third-party analytics.

10. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date.