Privacy Policy — swiftr.

01Who we are

Swiftr (“Swiftr”, “we”, “us”) operates the Swiftr app, the website at swiftr.run and related competitions and campaigns. We are the data controller for the personal data described in this policy.

This policy explains what we collect, why, who we share it with and what rights you have. It applies to everyone who uses Swiftr — app users, waitlist signups, campaign entrants and partners. It took effect on 30 August 2026.

For anything privacy-related, including a request to exercise your rights, email team@swiftr.run.

02What we collect

Information you give us

Account and contact details — name, email address, phone number, password or sign-in identifier, profile photo, city and country.
Profile and preference details — age or age range, how often you run, how competitive you are, club membership, and similar answers you give during signup.
Competition and campaign entries — the races, clubs, draws and giveaways you enter, and any proof you submit (for example a photo of you in your kit, or a screenshot of a run).
Content you post — club names and crests, race names, messages and anything else you submit.
Purchase and payment data — when you buy SWIFTR. PTS we record what you bought, when, the amount, the currency, and a transaction reference. Your card or bank details go directly to our payment provider or to Apple or Google; we never receive or store your full card number, and we typically see only the card type, last four digits and billing country.
PTS activity — your balance, purchases, stakes, winnings and voucher redemptions.
Prize and delivery details — the information we need to get a prize or voucher to you.
Support and correspondence — what you send us by email, DM or in-app.

Information from Strava

When you connect Strava, we receive — with your authorisation and only within the scopes you approve:

Your Strava athlete profile: athlete ID, name, profile photo, location, and club memberships.
Your activity data: activity type, date and time, distance, moving and elapsed time, pace and speed, elevation, splits, and — where you share it — heart rate and other sensor data.
Route and location data for your activities, including GPS traces, start and end points.
Access and refresh tokens that let us sync your activities.

We only use Strava data to run Swiftr. You can disconnect at any time — see Your Strava connection.

Information we collect automatically

Device and technical data — IP address, device and browser type, operating system, app version, language and time zone.
Approximate location derived from your IP address (typically city-level), used for local leaderboards, nearby events and fraud prevention.
Usage data — pages and screens viewed, features used, and timestamps.
Referral and attribution tags — for example the ?via= tag in a creator’s link, and QR or print campaign codes, so we can see which channel brought you to us.

We do not deliberately collect special category data (such as health data). Some running data — pace, distance, heart rate — can reveal information about your fitness, so we treat it with care and use it only for the purposes below.

03How we use it, and our legal basis

Run the Service — create your account, sync your runs, score races, rank clubs, calculate your Swiftr Rating, run matchmaking and show leaderboards. Basis: performance of our contract with you.
Run competitions and deliver prizes — verify entries, select and notify winners, issue and fulfil vouchers. Basis: performance of our contract; legitimate interests in running fair promotions.
Process purchases — take payment for PTS, credit your balance, settle stakes, issue refunds and keep transaction records. Basis: performance of our contract; legal obligation for tax and accounting records.
Keep competition honest, and spending safe — detect and investigate spoofed activity, duplicate accounts, collusion, payment fraud and chargeback abuse, and operate spending limits and self-exclusion where you ask for them or where we have concerns. Basis: legitimate interests in protecting fair play, prizes and our users; legal obligation for fraud prevention.
Support and communicate with you — answer questions, send service messages about races, results, prizes and account changes. Basis: contract and legitimate interests.
Improve and secure the product — analytics, debugging, measuring which channels work, and protecting the Service. Basis: legitimate interests.
Marketing — launch news, campaign invitations and offers, by email or SMS. Basis: consent, or our legitimate interest in marketing to existing users about similar features. You can opt out at any time.
Meet legal obligations — records, tax, and responding to lawful requests. Basis: legal obligation.

We do not sell your personal data, and we do not use it for automated decisions producing legal effects. Ratings and matchmaking are automated but affect only your experience within the Service.

04Who we share it with

We share personal data only where we need to, and always under appropriate contracts.

Strava — to authenticate your connection and sync activities, under your Strava authorisation.
Service providers who run our infrastructure — website and API hosting, database hosting, image and file storage, email delivery, SMS delivery, error monitoring and analytics. They process data on our instructions only.
Payment providers and app stores — our payment processor, and Apple or Google for purchases made inside the app. They handle your payment details as independent controllers under their own privacy policies, and they share transaction confirmations, fraud signals and refund decisions back with us.
Our internal team tools — while Swiftr is in early access, activity on the Service is routed to a private team workspace (Discord) so that a small team can see problems as they happen. That includes account events such as a signup, a race or a competition entry, and it also includes the text of messages you send in a race room or to a friend, shortened to a preview. Only our team can see that workspace, and it is never used for advertising or shared onwards. We say so here rather than describing it only as “operational alerts”, because a private message is exactly the kind of thing you would want to be told about. This routing will be narrowed as the Service leaves early access.
An AI provider — if you upload a screenshot of a run to prove it, that image is sent to Anthropic to read the figures off it. It is used for that one purpose, and it is not used to train anyone’s models.
Prize and voucher partners — the minimum needed to issue and deliver a prize you have won.
Other users and the public — your display name, profile photo, city, country, club, Swiftr Rating and race results are visible inside the Service, and winners may be named in results and announcements. Your email, phone number and precise route data are never shown to other users.
Creators and partners — only aggregated, non-identifying performance figures (for example how many people opened a link), never your personal details.
Professional advisers, authorities and successors — where required by law, to establish or defend legal claims, or in connection with a merger, acquisition or restructuring.

05Your Strava connection

Connecting Strava is your choice, and you stay in control of it.

You can disconnect Swiftr at any time from your Strava account settings or from within the Swiftr app. We then stop receiving new activity data and delete the access tokens we hold.
Data we already received stays with us only as long as we need it to keep past results and standings accurate — see How long we keep it — and you can ask us to delete it.
Strava is a separate controller of your Strava account data. What Strava does with it is governed by Strava’s own privacy policy, not this one.

06Cookies and similar technologies

We keep this light. Our sites and app use cookies and local storage that are strictly necessary to work — keeping you signed in, remembering campaign progress, and security — plus measurement that tells us how many people visited and which link brought them.

We do not run third-party advertising or cross-site tracking cookies. Where the law requires consent for non-essential cookies, we ask for it first, and you can change your mind at any time. You can also block or delete cookies in your browser, though parts of the Service may stop working.

The video on our site

Our site includes a video hosted by YouTube. Nothing is loaded from YouTube until you press play — until then you only see a still image served by us. If you press play, YouTube receives your IP address and device information and may set cookies on your device, under Google’s privacy policy. We use YouTube’s no-cookie player to keep that to a minimum. If you’d rather not, simply don’t press play.

07International transfers

We are based in the United Kingdom. Some of our providers are outside the UK and the EEA — including in the United States.

Where we transfer personal data outside the UK, we rely on an adequacy decision, or on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, together with additional safeguards where needed. You can ask us for details of the safeguards we use.

08How long we keep it

Closing your account deletes it immediately. There is no waiting period and no archived copy kept in case you come back — when you press the button in Settings, the erasing described below happens there and then.

Account and profile data — deleted when you close your account. That includes your name, photo, city, country, email address and phone number.
Activity data from Strava — deleted when you close your account: every run we hold, your totals, your best efforts and your weekly distances.
Strava tokens — deleted when you disconnect or close your account.
Races you have run — kept, with your name removed. A race has two runners in it, and deleting yours would rewrite the other person’s results, record and history of something that genuinely happened. What is left is a result with no name, photo or profile attached to your side of it. The same is true of a club week that has already been scored, and of anything you posted in a race room.
Campaign entries and proof photos — for the duration of the campaign plus up to 12 months, to handle prize queries and disputes.
Your PTS balance and its history — deleted when you close your account. PTS cannot currently be bought and have no cash value, so there is no purchase behind them and nothing we are required to keep.
Purchase and prize records — where you have paid us real money or been paid a prize, 6 years from the end of the relevant tax year, because tax and accounting law requires it. Those records survive closing your account. Nothing on Swiftr is currently sold, so for almost everybody this holds nothing at all.
Spending-limit and self-exclusion records — for the length of the limit or exclusion, plus a minimal record afterwards so it can’t be bypassed by opening a new account.
Marketing contact details — until you unsubscribe, plus a minimal suppression record so we don’t contact you again.
Fraud and abuse records — as long as needed to stop a banned user returning.

After that we delete the data or irreversibly anonymise it for statistics.

09How we protect it

We use encryption in transit, access controls, and a least-privilege approach so only the people who need data can reach it. Strava tokens are stored so they can only be used by our servers. No system is completely secure, so we can’t guarantee absolute security — but if a breach affects your rights, we’ll notify you and the regulator as the law requires.

10Your rights

You do not have to ask us to delete your account — you can do it yourself. Open Settings in the app, scroll to Account, and press Delete account. It takes two taps, it happens immediately, and it needs no email to us and no waiting. What that erases and the one thing it leaves behind are set out in How long we keep it above.

Beyond that, under UK and EU data protection law you can ask us to:

Access a copy of the personal data we hold about you.
Correct data that is wrong or incomplete.
Delete your data, where we no longer need it.
Restrict or object to our processing, including profiling based on legitimate interests.
Port your data to another service in a machine-readable format.
Withdraw consent at any time, where we rely on consent — this doesn’t affect processing before you withdrew it.
Opt out of marketing — use the unsubscribe link, reply STOP to an SMS, or email us.

Email team@swiftr.run to exercise any of these. We’ll respond within one month, and we may need to verify who you are first. Exercising your rights is free.

If you’re unhappy with how we’ve handled your data you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority in the EU. We’d appreciate the chance to put it right first.

11Children

Swiftr is not for children. You must be at least 16 to use the Service, and at least 18 to enter competitions with prizes. If we learn we have collected data from someone under 16, we’ll delete it. If you believe a child has given us their data, tell us at team@swiftr.run.

12Third-party links and services

The Service links to third parties — Strava, our social channels, and partner brands whose vouchers you can claim. We’re not responsible for their privacy practices, and we’d encourage you to read their policies before sharing data with them.

13Changes to this policy

We’ll update this policy as Swiftr develops — particularly as the Strava integration and prize features go live. The current version always lives at swiftr.run/privacy with the date it took effect at the top. If a change is significant, we’ll tell you in the app or by email before it takes effect.

14Contact us

Questions, requests or complaints about privacy — email team@swiftr.run and we’ll come back to you.