Privacy Policy

What we collect

• Account details: email address, and the name, gender, age, and weight you provide when registering a rider.
• Event data: which events you're registered for, your club, submitted stage times, and payment status (payment itself is processed by our payment provider — we don't store card details).
• If you connect Strava: your Strava athlete ID, first/last name, and profile photo URL, plus an encrypted OAuth token we use to check your ride history. We request read-only access — we cannot post, modify, or delete anything in your Strava account.

Why we use Strava data

We use your connected Strava account solely to count how many times you rode that week's segment, for the Local Legend competition. Your own effort count is shown only to you — we never publish your name, photo, or effort count to other riders or the public. Public pages only ever show an aggregate number (e.g. "7 efforts to beat to win this week"), never tied to any individual. Organisers can see the full named breakdown internally, to determine and announce winners.

How long we keep it

• Stage times you submit yourself are kept as a permanent competition record.
• Once a stage's weekly window closes, your effort count for it is fixed and kept as a permanent record too, the same way — we stop checking Strava for that week and never update the number again.
• If you disconnect Strava (from your dashboard, or by revoking access on Strava's own site), we delete your Strava tokens, athlete ID, avatar, and all effort counts promptly.

Third parties

We use Supabase to store data, a payment processor to handle entry fees, and Strava's API to read ride data if you connect your account. See Strava's own privacy policy for how they handle your data.

Your rights

You can ask us to access, correct, or delete your data, or disconnect Strava, at any time by emailing TORQeventsNZ@gmail.com. This applies regardless of where you're based, including under the GDPR and UK GDPR.