Privacy Policy

1. Introduction

Bharat Marathon Club ("we", "our", or "us") provides a platform for runners to track their progress in the 8 major Indian marathons. This Privacy Policy explains how we collect, use, and protect your information when you use our website.

2. Information We Collect

We do not require you to create a separate account. Instead, we use your Strava account to authenticate you. When you connect via Strava, we access the following:

• Profile Information: Your name, profile photo, Strava athlete ID and the gender supplied by your Strava profile. We use these to display your dashboard, apply the appropriate time thresholds and place published results in the relevant leaderboard category.
• Activity Data: We read your activity history (specifically runs) to identify marathon-distance efforts (≥41km). We access metadata such as distance, moving time, elapsed time, start date, and approximate start location (latitude/longitude) to match runs with official race cities.

3. How We Use Your Data

We use your data solely for the following purposes:

• Challenge Tracking: To statistically verify if you have completed any of the 8 Tier-1 marathons on their official dates.
• Scoring & Certification: To compute your "Bharat Marathon Club" score (best time in each city plus a bonus for additional completed race editions, capped at 32 points) and generate a downloadable certificate of your achievements.

We do NOT: Sell your data, display advertisements, or share your personal information with third parties. We do not create public leaderboards without your explicit consent.

Public leaderboard

Browsing the leaderboard does not publish your own results. If you choose to join, your display name, profile photo, score, completed cities, completion counts, Strava profile category, and qualifying race dates/times become public. Profiles with a Male or Female category also appear in that category’s leaderboard; unspecified profiles appear in Overall only. Other marathon attempts and their activity names stay private to your signed-in account. Public runner details do not include GPS coordinates or links to private Strava activities.

4. Data Storage and Security

Storage: We persist marathon-distance attempts, including repeat finishes and runs outside challenge scoring, so your saved history remains available between visits. Stored fields include activity ID, name, recorded distance when available, elapsed time, local date, matched city/event, and eligibility outcome. We also store per-city bests, completion counts, scoring summaries, scan progress, and background job metadata. Other shorter activities may be read during a scan but are not retained as marathon attempts.

Security: Strava access and refresh tokens are stored on the server. Your browser receives a signed identity cookie with an expiry, marked httpOnly, SameSite=Lax, and Secure in production. The cookie contains no Strava bearer tokens; it is signed, not encrypted.

5. Your Rights and Control

You have full control over your data:

• Revoke Access: You can disconnect our app at any time by going to your Strava Settings > My Apps and clicking "Revoke Access" for Bharat Marathon Club.
• Data Deletion: Logging out clears your browser session; it does not delete saved results or revoke server-side Strava access. Revoking the app in Strava schedules removal of your credentials, saved marathon attempts, summaries, and public leaderboard entry when the notification is processed. You can also contact us to request deletion.

6. Contact Us

If you have any questions about this Privacy Policy, or to request data deletion, please contact us at: