Privacy

Who we are

Fatboy Run Club is a Bristol-based running club. This website is run by the club, which makes the club the data controller — the ones answerable for everything below. For anything privacy-related, email fatboyrunclubofficial@gmail.com.

The sign-up form

If you fill in the sign-up form, we collect your name, email address, home city, an optional Strava profile link, and what you're interested in. That's stored with Netlify (our hosting provider) and used for one thing: the occasional club update. We don't sell it, share it, or add you to anything else. We keep it until you ask us not to, and then we delete it. The legal basis is your consent, which is a formal way of saying you typed your address into a box and can untype it whenever you like.

The merch waitlist on the Shop page is the same arrangement with less of it: an email address, stored with Netlify, used once to tell you a print run has landed, and deleted when you ask. The legal basis is again your consent.

Connecting your Strava

None of this happens unless you choose it. Connecting is a deliberate press on our Connect page, which sends you to Strava's own authorisation screen — agreeing there is what connects your account to ours. Don't press it and we receive nothing about you from Strava at all. The legal basis is your consent, and withdrawing it takes about as long as giving it did: see Disconnecting.

When you do authorise it, we keep one record for you. It holds your Strava athlete ID, your first name, an encrypted token that lets us read your runs, your running total, how many qualifying runs that took, a marker for the last activity we counted, and the relevant dates. That's the lot. We cannot post to Strava, change anything, or see your email address or your password. We ask only for access to your visible activities — anything you have marked private on Strava is excluded, stays private, never reaches us, and doesn't count.

Authorised club administrators can see your first name, Strava athlete ID, connection date, last successful sync and whether your initial count completed in a password-protected internal operations page. We use that access only to keep the connection working and answer access or deletion requests. The page never exposes your token, individual activities, routes, titles, times, distances or personal run count.

Nothing with your name on it gets published. The Feed and Run to the Moon pages show one number made out of everybody: the total kilometres, how many runs went into them, how many runners are connected, and the date we're on course to arrive. No names, no initials, no run titles, no individual runs. Your own contribution is shown to you, on your own confirmation page, and nowhere else. Strava's rules require this, and on this occasion we'd have done it anyway.

We look for new runs every four hours and add the qualifying ones to your total. We don't keep the runs themselves — Strava caps any cached activity data at seven days, and we've no use for it beyond the sum. When you first connect we count your qualifying runs back to 7 February 2026, when the moon mission began.

Before September 2026 these pages drew on Strava's club activity feed, which Strava has since retired. That old aggregate was not independently auditable, so it is no longer included. The total is now rebuilt only from runners who deliberately connect, starting from the mission date. Nothing from the old arrangement is kept with a name attached to it.

Disconnecting

Go to Strava and pick Settings → My Apps → Fatboy Run Club → Revoke. Our access ends there and then — it happens at Strava's end, so we don't have to do anything for it to take effect and we couldn't stop it if we wanted to.

Within four hours our sync notices you've gone and deletes your record — athlete ID, name, token, total, all of it. That takes your kilometres back out of the moon total, so the number on that page can go down. It's the honest cost of letting people leave properly, and we'd sooner have a smaller total than one propped up by people who've gone.

If you'd rather not wait, or you want it gone today, email fatboyrunclubofficial@gmail.com and we'll clear the record by hand. Either way it's done within 30 days at the very outside, and usually the same week.

Analytics and cookies

We use Cloudflare Web Analytics, which is cookieless and doesn't track you across the web — it just tells us roughly how many people visit. We don't set cookies ourselves. One members' page does keep something in your browser: a pub crawl there remembers which pubs you've ticked off, in your browser's own local storage, so it survives a reload. That isn't a cookie, it never leaves your device, it never reaches us, and clearing your browser data wipes it. The maps — on the Spots page and on that members' page — are built with Leaflet, which loads from unpkg, and draw their tiles from OpenStreetMap. The typeface comes from Google Fonts on every page. All of it — like any web request — shows those providers your IP address.

Who else is involved

The complete list of who touches any of this: Netlify hosts the site and stores the sign-up entries and the Strava records; Cloudflare counts the visitors; Strava is where the run data comes from, and your own agreement with them applies there as well as this page; Google Fonts serves the typeface on every page; unpkg serves the map software on the two pages that have a map; OpenStreetMap serves the map tiles. Those last three never see more than your IP address and which page you were on, which is the unavoidable toll for loading anything from anywhere. Nobody buys anything from us, on account of us not selling it.

They're international companies, so your data may be processed outside the UK. We rely on the transfer safeguards each of them has in place for that. If you want the specifics for any one of them, ask and we'll point you at their documentation.

Your rights

Under UK data protection law you can ask us what we hold about you, ask us to correct it, ask us to delete it, or object to what we're doing with it. Where we rely on your consent — the sign-up list and the Strava connection — you can withdraw it at any time, and getting out is no harder than getting in was. Email fatboyrunclubofficial@gmail.com and it'll be done without fuss, and in any event within one month.

If you think we've handled your data badly, you can complain to the ICO — but we'd rather you told us first.

Last updated 4 October 2026. If this policy changes, the changes appear on this page.