Privacy Policy for Skamper

Skamper (accessible via www.skamper.com and our iOS and Android apps) is owned and operated by Skamper Limited, a company registered in Scotland with company number SC742632. Registered Office: 5/12 Donaldson Crescent, Edinburgh, United Kingdom, EH12 5FB.

For the purposes of UK and EU data protection law, Skamper Limited is the data controller.

When you use Skamper we may collect the following personal information:

• Your name, email address, gender and date of birth.
• Account credentials (a securely hashed password — we never see your password in plain text).
• Ratings, written reviews and any images you submit about a course (your first name will appear publicly alongside any approved review).
• Technical information such as IP address, device type and access logs, collected by our hosting providers for security and abuse prevention.
• Route downloads, so we can show you your activity in your account.
• Referral information: if you sign up after following another member's baton (invite) link, we store the code from that link and record which member introduced you. We do this to award their Relay Strides and to detect abuse of the competition. A member who introduces you is only ever shown aggregate numbers — how many people joined via their baton and how many Relay Strides they have earned. They are never shown your name, email address, profile or activity.

We use this information to provide target times for your runs, calculate your Skamper Grade on completion of each run, display your results in the leaderboards, and to improve the service.

Skamper is not specifically directed at children, and we do not knowingly collect personal information from children in breach of applicable data protection laws.

We process your personal information on the following legal bases:

• Contract: where processing is necessary to provide the Skamper service and your account.
• Legitimate interests: to maintain security, prevent abuse, improve the service and moderate reviews.
• Consent: where we rely on your consent, for example for optional communications or non-essential cookies.
• Legal obligations: where we are required to comply with applicable laws.

When you submit a review of a course while signed in, your first name and review text are shown publicly once approved by our team. Your email address and surname are not shown publicly and are only visible to Skamper administrators. You can request deletion of a review at any time by contacting us, or by deleting your account.

When you're signed in we log which pages you visit on Skamper so we can understand how the site is used, investigate problems, and improve the service. We only record the page path (not query strings) along with the time of the visit. This information is visible only to Skamper administrators, is never shown to other users, and is automatically deleted after 90 days. We rely on our legitimate interests as the legal basis for this processing.

Skamper lets you connect your Garmin Connect and/or Strava account. Connecting is entirely optional, is done through each provider's official authorisation screen, and you choose which permissions to grant. We never see or store your Garmin or Strava password.

What we receive. With your permission we receive activity data from those services, which may include: activity name, type, date and time, distance, duration, elapsed and moving time, elevation, average and split pace, and the GPS track of the activity, together with your provider account identifier and basic profile details (such as first name and profile photo) used to identify the connection. For Garmin we may also send courses to your device at your request.

How we use it. We use this data solely to operate features you have asked for: matching your activities to Skamper courses, calculating your Skamper Grade and target times, showing your runs and personal statistics in your account, awarding Strides and badges, populating course leaderboards, and sending you notifications about matched activities. We do not use activity data for advertising and we do not sell it.

How it is disclosed. Data obtained via the Garmin Connect API or the Strava API is never shared with, processed by, or otherwise made available to any third-party, including external artificial intelligence or data processing services. It is never used to train machine learning or artificial intelligence models.

Where an activity is matched to a Skamper course, your display name, time and resulting grade for that course may appear publicly on that course's leaderboard and in your public profile, but only if you have chosen to be shown on leaderboards in your profile settings. You can turn this off at any time from Profile → Leaderboards. Detailed activity data (full GPS tracks, splits and raw provider data) is not shown to other users. We disclose activity data to our hosting and database provider only to the extent needed to run the service, and where required by law.

Retention and disconnecting. You can disconnect Garmin or Strava at any time from Settings → Connections, or from within Garmin or Strava themselves. Disconnecting stops any further data being received. Runs already imported remain in your Skamper account until you delete them or delete your account, at which point the associated activity data is deleted. If you revoke access in Strava, we delete the stored connection and its tokens.

Your use of Garmin and Strava also remains subject to their own privacy policies and terms.

We do not share your personal data with any external AI provider or third-party AI service. No account details, email addresses, names, activity data, GPS tracks or any other information about you is sent to an AI service, and nothing about you is ever used to train an AI or machine learning model.

Connected-service data is excluded. Data obtained through the Strava API or the Garmin Connect API — including your activities, GPS tracks, splits, times, provider profile details and any other information received from those services — is never shared with, processed by, or otherwise made available to any third-party, including any external artificial intelligence or data processing service, and is never used to train any AI or machine learning model. This data is processed only within Skamper and by our hosting and database provider.

We do not sell your personal information. We only share personal information with trusted service providers that help us operate Skamper, or where required by law. We may share information with service providers who help us operate Skamper — such as our hosting and database provider and our authentication provider — but only to the extent necessary for them to provide their services. They are required to keep your information confidential and may not use it for any other purpose. Some of our service providers may process personal information outside the United Kingdom. Where this occurs, we take appropriate safeguards to ensure your information remains protected in accordance with applicable data protection laws.

We take the security of your personal information seriously and use industry-standard measures (TLS encryption in transit, encryption at rest, hashed passwords, scoped database access policies) to protect it from unauthorised access, disclosure and alteration. However, no transmission over the internet can be guaranteed to be completely secure, so we cannot guarantee absolute security.

We only keep your personal information for as long as necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law. When we no longer have a legitimate reason to process it we will either delete or anonymise it.

You can delete your account at any time from the account menu in the top-right of the website. Deleting your account removes your profile and login credentials, and deletes any public reviews you have submitted so your name and email are no longer associated with them.

Under UK GDPR you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your personal information ("right to be forgotten").
• Object to or restrict certain processing.
• Request a copy of your data in a portable format.
• Lodge a complaint with the UK Information Commissioner's Office ("ICO") if you believe your personal information has been handled unlawfully (ico.org.uk).

To exercise any of these rights please contact admin@skamper.com.

Skamper uses strictly necessary browser storage (such as localStorage) to keep you signed in. The browser storage we use is necessary for the website to function and does not require consent under applicable cookie regulations. We do not currently use advertising or third-party analytics cookies. If this changes we will update this policy and, where required, ask for your consent.

Referral (baton) cookie. When you follow another member's baton link we set a short-lived first-party cookie (30 days) holding only the baton code, so the link still works after you sign in with Google or Strava. It contains no personal data and is not used for advertising.

If you use the Skamper app on iOS or Android, we use Firebase Cloud Messaging, a service provided by Google, to deliver push notifications to your device. This involves sharing a device token — a unique identifier for your device — with Google. You can disable notifications at any time in your device settings.

If you tick the WellChild interest box on our WellChild campaign page, or during sign-up, we store your name, your email address, the date and time you ticked it and the exact wording you were shown. We share your name and email address with WellChild so they can contact you about their work and their running events, including the London Marathon. WellChild then handles your details under their own privacy policy.

The box is unticked by default. You can withdraw your consent at any time by unticking it on the WellChild campaign page, or by emailing us — we will stop sharing your details from that point and ask WellChild to remove them.

We may update this Privacy Policy from time to time. Any changes will be posted on this page, and we encourage you to review this Privacy Policy regularly. Your continued use of Skamper after any changes signifies your acceptance of the changes.

For privacy-related enquiries or to exercise your data protection rights, please contact admin@skamper.com.