1. ABOUT THIS PRIVACY POLICY
SQUADRUN respects the privacy of athletes, coaches, customers and visitors who use our services.
This Privacy Policy explains how SQUADRUN collects, uses, stores, protects, shares and deletes personal information when you use SQUADRUN services, including:
• the squad.run website
• TEAM SQUADRUN
• SQUADRUN coaching services
• SQUADRUN Performance Lab where applicable
• athlete accounts and training programmes
• connected services and integrations
• future SQUADRUN mobile applications
• other SQUADRUN digital services that link to this Privacy Policy
In this policy, “SQUADRUN”, “we”, “us” and “our” refer to SQUADRUN Ltd.
SQUADRUN is based in New Zealand and handles personal information in accordance with the New Zealand Privacy Act 2020 and other privacy and data protection laws that apply to our users or services.
Where the European General Data Protection Regulation (GDPR), UK GDPR or another applicable privacy law provides additional rights, we will apply those rights where required.
2. INFORMATION WE COLLECT
The information we collect depends on the SQUADRUN services you use.
Account and identity information may include:
• name
• email address
• contact details
• profile photograph
• account identifiers
• password credentials stored in protected form
• account and subscription status
• account preferences
Training and performance information may include:
• planned training sessions
• completed training sessions
• training history
• race performances
• personal bests and season bests
• event entries
• training availability
• running experience
• pace
• distance
• duration
• heart rate
• power
• perceived effort
• training feedback
• training-completion information
• information you choose to provide for coaching or programme purposes
Where relevant to services you choose to use, we may collect health, injury and readiness information, including:
• injury location and symptoms
• pain or training response
• rehabilitation information
• health or physiological information relevant to training
• training readiness information
• menstrual or reproductive-health information where voluntarily provided through relevant features
We recognise that health and physiological information may be particularly sensitive. We limit its collection and use to purposes for which it is required and apply appropriate access controls.
Billing and transaction information may include information necessary to administer subscriptions, purchases, invoices and payments.
Where payment-card information is processed directly by a payment provider, SQUADRUN does not need to retain the full payment-card information held by that provider.
Communications and support information may include information you provide when you:
• contact SQUADRUN
• submit a support request
• communicate with a coach
• respond to an email
• provide feedback
• otherwise communicate with us
Technical and security information may include:
• IP address
• device type
• browser type
• operating-system information
• authentication events
• login records
• timestamps
• security events
• application diagnostics
• server logs
• information reasonably required to detect misuse or protect the service
3. WHERE INFORMATION COMES FROM
Most personal information is provided directly by you when you create an account, use SQUADRUN, communicate with us or provide information to your coach.
Some information is generated through your use of SQUADRUN, such as:
• session-completion records
• programme activity
• account events
• training calculations
• training-history records
• system and security events
Where you expressly connect a third-party service, we may receive information from that service in accordance with the permissions you grant.
SQUADRUN Performance Lab may also use lawfully obtained race and event information, including publicly available event results and performance information.
Where personal information is collected from another source rather than directly from you, we will provide notice where required by applicable privacy law.
We do not obtain private information from a third-party service merely because you have an account with that service. A connection requiring access to private information must be authorised by you.
4. WHY WE USE PERSONAL INFORMATION
We use personal information to provide and administer SQUADRUN services.
This may include:
• creating and maintaining accounts
• delivering training programmes
• providing coaching services
• displaying training history
• providing training calculations and predictions
• managing event and programme information
• administering subscriptions and payments
• providing customer support
• communicating with users
• maintaining security
• preventing misuse or fraud
• diagnosing technical problems
• maintaining and improving service reliability
• complying with legal obligations
Where appropriate, SQUADRUN may use non-Strava information for:
• training calculations
• programme logic
• statistical modelling
• race prediction
• performance modelling
• athlete engagement indicators
• programme-completion analysis
• service development
• features forming part of SQUADRUN or Performance Lab
These calculations are intended to assist athletes and coaches. They are not intended to make legal or similarly significant decisions about individuals.
We may also process information where necessary to:
• comply with a legal obligation
• establish, exercise or defend legal rights
• maintain financial and tax records
• prevent fraud or misuse
• protect the safety and security of users and systems
Where consent is the appropriate legal basis for processing, you may withdraw that consent, subject to any processing or retention that remains lawful for another reason.
5. HEALTH AND SENSITIVE INFORMATION
SQUADRUN may process health-related or similarly sensitive information when an athlete voluntarily uses features requiring it, including injury-management, rehabilitation or readiness features.
We use this information only for purposes reasonably connected with the service for which it was provided.
Access is limited to the athlete and authorised SQUADRUN personnel or assigned coaching personnel where access is necessary to deliver the relevant service.
SQUADRUN does not sell health information.
SQUADRUN does not use sensitive health information for third-party advertising.
Where applicable law requires explicit consent for processing health or other special-category information, we rely on explicit consent or another lawful basis permitted by law.
6. COACHES AND AUTHORISED SQUADRUN PERSONNEL
Some personal and training information may be accessible to your assigned coach or authorised SQUADRUN personnel where that access is necessary to provide:
• coaching
• programme administration
• athlete support
• account administration
• injury-management services
• safety-related services
• technical support
Access is role-based and should be limited to information required for that person’s function.
This general provision does not override restrictions applying to data obtained through third-party services such as Strava.
Strava information obtained through the TEAM SQUADRUN Strava integration is subject to the additional restrictions described in this policy and is not displayed to SQUADRUN coaches, administrators, other athletes or other users.
7. STRAVA INTEGRATION
Connecting Strava to TEAM SQUADRUN is optional.
TEAM SQUADRUN uses Strava for a narrowly defined athlete-controlled session-completion feature.
After you expressly authorise TEAM SQUADRUN to access your Strava account, TEAM SQUADRUN may retrieve your own recent Strava running activities from the previous seven days.
You may then choose one of your own recent Strava activities and manually associate it with a prescribed TEAM SQUADRUN running session.
You choose which activity, if any, is linked.
7.1 What Strava information may be processed
Depending on the information made available by Strava and required for the feature, a temporary activity record may include:
• activity name
• activity identifier
• activity date
• activity start time
• distance
• moving time
• pace
• heart rate where available
• information required to identify and display the activity
• a Strava activity link where required for the feature
7.2 Who can see Strava information
Strava data obtained from your Strava account is displayed only to you, the authenticated athlete who authorised access.
It is not displayed through TEAM SQUADRUN to:
• your SQUADRUN coach
• SQUADRUN administrators
• other athletes
• other TEAM SQUADRUN users
SQUADRUN does not use this integration to provide your Strava activity data to another user.
7.3 Strava data is not used for AI, analytics or advertising
Strava data and data derived from Strava data are not used by SQUADRUN for:
• artificial intelligence
• machine learning
• training an AI model
• evaluating an AI model
• AI prompts or AI context
• athlete profiling
• analytics
• benchmarking
• rankings
• aggregated datasets
• product-development analysis
• advertising
• marketing
• resale
Strava data is not combined with other customer data for those purposes.
7.4 Strava data retention
Strava activity information is maintained only as transient data within Strava’s permitted cache period.
Strava activity data is not retained in that cache for more than seven days.
TEAM SQUADRUN does not use the Strava integration to create a permanent archive or searchable historical database of Strava activities.
Stored Strava activity snapshots are removed after the permitted cache period.
If you revoke TEAM SQUADRUN’s Strava authorisation, disconnect Strava, delete your Strava account, or validly request deletion of Strava information, SQUADRUN will remove relevant Strava data and authentication credentials as required by Strava’s API requirements and applicable law.
You may request confirmation that deletion has been completed.
7.5 Strava API usage information
Strava may monitor and collect information concerning SQUADRUN’s access to and use of the Strava API.
Strava may use API usage information for its own business purposes, including:
• operating and improving its API and services
• developer support
• user support
• security
• monitoring compliance with its API terms
Information processed directly by Strava is governed by Strava’s own privacy policy and terms.
8. SQUADRUN PERFORMANCE LAB AND RACE-RESULT INFORMATION
Where SQUADRUN Performance Lab forms part of the service you use, it may process:
• race performances
• event results
• course information
• performance indices
• sporting-performance information
• historical results
• statistical performance information
Some historical race-result information may have been published by event organisers, timing providers or other lawful public sources.
Performance Lab may use appropriate performance information to calculate:
• race predictions
• course-normalised performance measures
• performance estimates
• comparative statistical models
• event-specific prediction models
We take reasonable steps to ensure personal information used for these purposes is relevant to the service and handled consistently with applicable privacy law.
Public availability of information does not remove our responsibility to handle personal information appropriately.
If you believe race-result or identity information associated with you is inaccurate or should not be held by SQUADRUN, you may contact us to request review, correction or deletion where applicable.
9. EMAIL AND COMMUNICATIONS
We may send service communications necessary to operate your account, including:
• authentication messages
• security notices
• account information
• programme communications
• injury-management communications
• payment and billing communications
• account-expiry information
• support communications
Where SQUADRUN offers optional email categories, marketing or promotional communications, you may manage those preferences through available account controls or unsubscribe mechanisms.
Some essential account, security, legal or transactional communications cannot be disabled while the relevant account or service remains active.
We may retain a minimal suppression record after an unsubscribe request where necessary to ensure that we continue to honour that preference.
10. COOKIES, LOCAL STORAGE AND SIMILAR TECHNOLOGIES
Our websites and applications may use cookies, browser storage and similar technologies required for:
• authentication
• session management
• security
• preferences
• application operation
Servers may generate technical logs necessary for:
• security
• reliability
• diagnostics
• performance
• abuse prevention
Where optional analytics or similar technologies are used, we will handle them in accordance with applicable consent requirements.
11. MOBILE APPLICATIONS
SQUADRUN may provide TEAM SQUADRUN through mobile applications distributed through platforms including the Apple App Store and Google Play.
The mobile applications use the same SQUADRUN account and privacy principles described in this policy.
Depending on the features available in a particular version of the application, the app may process limited device and application information necessary to operate, secure and support the service.
This may include:
• device type
• operating-system version
• application version
• authentication and session information
• push-notification tokens
• crash and diagnostic information
• security and fraud-prevention information
• application interactions required for operation, support or diagnostics
SQUADRUN will not collect device information merely because the operating system makes it available.
Collection will be limited to information reasonably required for a feature, security, support or another purpose described in this policy.
12. MOBILE DEVICE PERMISSIONS
Where a mobile feature requires access to a permission-controlled device capability, TEAM SQUADRUN will request the relevant permission through the operating system where required.
Such capabilities may include:
• notifications
• photographs
• camera
• location
• health and fitness information
• other protected device resources
A permission will only be requested where it is reasonably necessary for a feature that uses it.
Denying an optional device permission will not prevent you from using unrelated parts of TEAM SQUADRUN, although the particular feature requiring that permission may not operate.
SQUADRUN does not use mobile-device permissions or information obtained through them for unrelated advertising or resale.
13. PUSH NOTIFICATIONS
If you enable push notifications, SQUADRUN may store a device-specific push-notification token and information required to deliver notifications to your device.
Notification permissions can be changed through your device settings and, where available, through TEAM SQUADRUN communication preferences.
Disabling push notifications does not prevent essential information from being delivered through other available account channels where necessary.
14. MOBILE SERVICE PROVIDERS AND SOFTWARE COMPONENTS
TEAM SQUADRUN mobile applications may use third-party software components or service providers for functions such as:
• authentication
• application infrastructure
• push notifications
• crash reporting
• payments
• security
• technical diagnostics
SQUADRUN is responsible for assessing the privacy implications of software components we choose to integrate.
Where a third-party provider processes personal information on SQUADRUN’s behalf, we expect that provider to protect that information appropriately and use it only as necessary to provide the relevant service.
We will disclose applicable mobile-app data collection and use through privacy information required by distribution platforms such as the Apple App Store and Google Play.
15. CONNECTED HEALTH AND FITNESS SERVICES
TEAM SQUADRUN may in future offer optional integrations with health or fitness services made available by device manufacturers or platform providers.
Examples may include Apple Health, Android Health Connect or comparable services.
Where such an integration is offered:
• participation will be optional
• the athlete will expressly authorise access
• SQUADRUN will request only information reasonably required for the selected feature
• applicable device or platform permissions will be respected
• health and fitness information obtained through the integration will not be sold
• health and fitness information obtained through the integration will not be used for third-party advertising
Any additional privacy and data-use restrictions imposed by Apple, Google or another platform provider will apply in addition to this Privacy Policy.
16. WHEN WE SHARE INFORMATION
SQUADRUN does not sell personal information.
We may disclose limited information to service providers that help us operate SQUADRUN.
These may include providers of:
• hosting
• cloud infrastructure
• email delivery
• authentication
• payment processing
• data backup
• application infrastructure
• security
• technical support
Those providers are expected to use information only as necessary to provide their services to SQUADRUN and to protect it appropriately.
We may also disclose information where:
• you instruct or authorise us to do so
• disclosure is necessary to provide a service you requested
• disclosure is required or permitted by law
• disclosure is necessary to protect legal rights, safety or security
If SQUADRUN is reorganised, merged, acquired or transfers part of its business, relevant information may form part of that transaction subject to applicable privacy obligations.
Any special restrictions applying to data obtained from third-party integrations continue to apply regardless of these general provisions.
17. OVERSEAS PROCESSING AND STORAGE
SQUADRUN is based in New Zealand but may use technology and service providers that process or store information in other countries.
Where personal information is disclosed or processed overseas, we take reasonable steps to ensure it is protected appropriately and that cross-border disclosure complies with applicable privacy law.
For users protected by the GDPR or UK GDPR, we will use an appropriate lawful transfer mechanism where one is required.
18. SECURITY
SQUADRUN uses reasonable administrative, organisational and technical safeguards appropriate to the information we hold.
These may include:
• encrypted communications
• password hashing
• authentication protections
• multi-factor authentication where applicable
• role-based permissions
• access controls
• technical logging
• application-security controls
• backups
• security monitoring
• restrictions on administrative access
No internet or computer system can be guaranteed to be completely secure.
We review security controls in proportion to the sensitivity of information and the risks associated with our services.
If a privacy breach occurs that has caused or is likely to cause serious harm, we will notify affected individuals and the relevant privacy regulator where required by law.
19. HOW LONG WE KEEP INFORMATION
SQUADRUN does not keep personal information longer than is reasonably required for the purpose for which it may lawfully be used.
Different records have different retention requirements.
Strava activity data
Transient cache only.
Strava activity data is retained for no more than seven days and may be deleted earlier where required.
Strava OAuth credentials
Retained while the Strava connection remains authorised.
Credentials are removed when access is revoked or the integration is disconnected where required.
Active TEAM SQUADRUN account and training information
Retained while reasonably required to provide the active account, programme, coaching or training-history service.
Closed or inactive account information
Retained only for a reasonable period where required for matters such as:
• account reactivation
• support
• disputes
• security
• fraud prevention
• legal obligations
Information is subsequently deleted or irreversibly de-identified when no longer required.
Injury, health and readiness information
Retained only while reasonably required for the relevant training, coaching, injury-management or account purpose, subject to any lawful retention requirement.
Support correspondence
Retained for a reasonable period necessary to:
• resolve enquiries
• maintain relevant service records
• manage complaints or disputes
• protect legal rights
Security and technical logs
Retained for a limited period appropriate to:
• security
• diagnostics
• fraud prevention
• abuse prevention
• system reliability
Marketing preferences
Retained while required to provide communications.
Where you opt out, a minimal suppression record may be retained so that SQUADRUN can continue to honour your preference.
Financial, invoice and tax records
Generally retained for at least seven tax years where required by New Zealand tax law.
Backups
Information deleted from active systems may remain temporarily in secure backups until those backups are removed through normal backup rotation and recovery processes.
Backups are not intended to be used as active sources of deleted personal information.
Information may be restored from a backup only where required for legitimate recovery or security purposes.
Public race and event information
May be retained while reasonably required for lawful historical, sporting or Performance Lab purposes, subject to applicable rights relating to accuracy, correction, deletion and privacy.
20. ACCESS, CORRECTION AND DELETION
You may ask SQUADRUN whether we hold personal information about you and request access to that information.
You may ask us to correct information you believe is:
• inaccurate
• incomplete
• misleading
You may also request deletion of personal information.
We will comply where required by applicable law or where there is no continuing lawful reason for the information to be retained.
We may need to confirm your identity before acting on an access, correction, portability or deletion request.
For information obtained through Strava, the additional deletion obligations described in the Strava section of this policy apply.
Under New Zealand privacy law, access and correction requests are handled within applicable statutory timeframes.
21. CLOSING AND DELETING YOUR ACCOUNT
You may request permanent deletion of your TEAM SQUADRUN account and eligible associated personal information.
TEAM SQUADRUN provides or may provide an account-deletion option within the account or profile area.
Where TEAM SQUADRUN is distributed as a mobile application, an account-deletion pathway will be readily accessible from within the application where required by the relevant application platform.
SQUADRUN will also maintain an appropriate web-based pathway for account-deletion requests where required so that users do not need continued access to a mobile application to request deletion.
Account deletion is different from:
• signing out
• disabling notifications
• cancelling a subscription
• disconnecting a third-party integration
• temporarily ceasing to use the service
When an account-deletion request is completed, SQUADRUN will delete or irreversibly de-identify eligible personal information associated with the account except where information must lawfully be retained.
Reasons information may need to be retained include:
• financial record keeping
• tax obligations
• security
• fraud prevention
• dispute resolution
• exercise or defence of legal rights
• another legal obligation
If information is retained after account deletion, it will not continue to be used for ordinary account or training purposes unless a lawful basis exists.
Third-party connections associated with the account will be revoked or removed where required.
Where a service provider processes relevant personal information on SQUADRUN’s behalf, SQUADRUN will request deletion by that provider where required.
We will inform you where deletion cannot be completed immediately or where particular information must lawfully be retained.
22. RIGHTS FOR EEA AND UK USERS
Where the GDPR or UK GDPR applies to our processing of your personal information, you may have rights including:
• access
• rectification
• erasure
• restriction of processing
• data portability
• objection to certain processing
• withdrawal of consent
Depending on the processing involved, our lawful basis may include:
• performance of our contract with you
• your consent
• compliance with a legal obligation
• legitimate interests in operating, protecting and supporting SQUADRUN
Where special-category information such as health data is processed, we will rely on an additional lawful condition required by applicable law.
You may also have the right to lodge a complaint with the applicable data-protection supervisory authority.
SQUADRUN does not use automated processing to make decisions that produce legal effects or similarly significant effects on individuals without appropriate safeguards.
23. CHILDREN AND YOUNGER ATHLETES
SQUADRUN may require the involvement or consent of a parent or legal guardian where appropriate because of:
• an athlete’s age
• the nature of information being collected
• the service being provided
• applicable law
We take additional care when collecting or handling personal information about children and young people.
Features intended for younger athletes will be designed with appropriate privacy and access controls.
24. THIRD-PARTY LINKS AND SERVICES
SQUADRUN services may contain links to or integrations with third-party services.
Those services operate under their own privacy policies and terms.
Authorising a third-party integration may permit information to pass between SQUADRUN and that service only in accordance with the permissions involved.
You should review the privacy information supplied by a third-party service before authorising access.
25. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy as:
• SQUADRUN develops
• new features are introduced
• mobile applications are released
• third-party integrations change
• our data practices change
• laws or regulatory requirements change
• application-platform requirements change
The current version will be published on squad.run and will show the date it was last updated.
Where a material change affects how we use previously collected information or requires fresh consent, we will provide appropriate notice and obtain consent where required.
26. CONTACT AND PRIVACY OFFICER
Questions, privacy requests, correction requests, deletion requests and complaints can be sent to:
Attn Kerry
SQUADRUN
9 Petes Way
Lynmore
Rotorua 3076
New Zealand
Email:
[email protected]
Please contact us using the email address associated with your SQUADRUN account where possible so that we can identify and verify the correct account.
If you believe SQUADRUN has not resolved a privacy concern, you may also contact the Office of the Privacy Commissioner New Zealand or another applicable privacy regulator.
Last updated: 14 September 2026