Strava API compliance

Every runner authenticates through Strava OAuth. The pre-authorization screen explains what is accessed, how it is collected, what other participants see, and how consent can be withdrawn. Challenge enrollment is a separate explicit choice.

A Strava connection does not enroll a runner indefinitely. Each challenge has its own participation record, runners must opt in again for each new month, and they can leave one challenge without disconnecting Strava.

My account shows each runner their chosen nickname, current verified challenge count, connection status, refresh availability, and deletion control.

The shared leaderboard is a club-created monthly Challenge Points system—not a Strava activity or segment leaderboard. Each row contains only a participant-chosen nickname, a composite point total, and rank. The total may combine challenge participation, confidential SARL membership verification, club-event attendance, volunteer recognition, other admin-awarded bonuses, and a contribution calculated from the runner’s own authorized Strava activity. Per-runner bonus sources are not published, so another participant cannot reliably reconstruct a loop count or other activity metric from the total. The site never shares Strava profile fields, activity names, dates, distances, times, pace, routes, photos, segment efforts, or raw loop counts. Because the June 2026 terms define derived and aggregated outputs broadly, we disclose this design for Strava’s review rather than claiming the composite score is automatically exempt.

Activity and segment-effort responses are processed only to calculate the current challenge. Raw activities, routes, effort records, photos, titles, locations, and device data are not retained. The aggregate cache is refreshed daily and never intentionally displayed beyond seven days without revalidation.

Activity updates or deletions immediately hide the affected cached row until it is revalidated. Deauthorization and self-removal delete the runner, tokens, and challenge snapshot and provide written confirmation.

OAuth state and account sessions are signed, tokens are encrypted at rest, cookies are HttpOnly and SameSite, secrets are stored outside source code, and write actions require the runner’s authenticated session.

Automatic refresh is daily and runner-requested refresh is limited to once every six hours. The app must remain within the athlete capacity and rate limits assigned by Strava.

Strava data is not sold, transferred, advertised against, indexed, exported, used for unrelated analytics, or used in AI or machine-learning systems. The site does not reproduce a Strava feed or expose an API proxy.

The app is independently branded, does not claim Strava endorsement, links runners back to Strava, and provides support through the Road Lizards club contact page.