Privacy Policy

Who we are

Inclusive Running Club is a volunteer-built tool for managing running sessions for athletes with intellectual and developmental disabilities. It helps coaches log runs, track progress, and celebrate achievements.

For questions about your data, contact us at privacy@kitarun.com.

What we collect and why

Coaches and admins

• Email address (for login)
• Name
• Strava connection (OAuth tokens and activity data, only when you choose to connect)
• Push notification subscription (only when you enable notifications)

Caregivers

• Email address (for login)
• Name
• Cheers messages you send

Athletes

• Name and date of birth
• Photo (if uploaded by a coach)
• Running sessions (distance, duration, route, feel rating)
• Coaching cues and coach notes
• Communication notes and medical notes
• Emergency contact
• Mood check-ins
• Favourite runs, avatar choice, theme colour, and goal choice
• Messages to coaches
• PIN (stored as a one-way hash — we cannot read it)

What we do not collect

We do not collect location data from athletes' devices. GPS data comes only from coaches' Strava activities.

We do not use tracking cookies, advertising pixels, or analytics that identify individual users. If we add analytics in the future, we will update this policy first.

Where your data is stored

• Supabase — database and file storage, Singapore region
• Vercel — hosting, with edge servers
• Resend — email delivery

All connections use HTTPS encryption.

Who can see what

Coaches and admins

Can see all athlete data, including sessions, cues, notes, medical info, and mood trends.

Caregivers

Can only see their linked athlete's sessions, milestones, goal progress, and public information. They cannot see medical notes, coaching cues, or coach-only notes.

Athletes (via PIN-protected page)

See their own runs, milestones, cheers, goal progress, and mood history. They never see medical notes, coaching cues, or coach notes.

Public milestone and story pages

When sharing is enabled, these pages show only the athlete's first name, milestones, and coach-selected story updates. They never show medical info, notes, cues, feel ratings, or disability details.

Strava integration

When a coach connects Strava, we receive activity data (distance, duration, title, GPS polyline, heart rate) via Strava's API. We store OAuth tokens securely.

Coaches can disconnect Strava at any time from their account page. We only access activities after the coach connects. We do not read historical data.

Cookies

We use essential cookies only:

• Supabase authentication cookies (keep you logged in, HttpOnly, Secure, 1-year expiry)
• Athlete session cookie (PIN authentication, HttpOnly, Secure, 24-hour expiry)

We do not use advertising or tracking cookies.

Data sharing

We do not sell data. We do not share data with advertisers. Data is shared only with the service providers listed above (Supabase, Vercel, Resend, Strava) to operate the app.

Data retention and deletion

Data is kept as long as the club uses the app. If an athlete leaves the club, an admin can deactivate their profile.

To request full deletion of your data, contact privacy@kitarun.com. We will respond within 30 days.

Children and young athletes

Some athletes may be under 18. We collect data about athletes only through authorised coaches and admins, never directly from minors.

Caregivers can disable public sharing for their linked athlete at any time.

Changes to this policy

We will update this page when the policy changes. The date at the top shows when it was last updated.

Contact

For questions about your data, email privacy@kitarun.com.