Privacy

The organisation responsible for your information — the “data controller” in the language of UK data protection law — is [TBD — legal entity name], of [TBD — registered address], registered as [TBD — company / charity registration number]. Our registration with the Information Commissioner’s Office is [TBD — ICO registration number].

You can reach a human about anything on this page at [TBD — contact email].

If you register interest. Your name, your email address, whether you came as a fundraiser, a donor or a sponsor, and the fact that you ticked the consent box (with the date and the wording you agreed to). We use it to email you back and to tell you when ACE is ready. Nothing else.

If you create a fundraiser account. Your name, your email address and a password. The password is never stored as you typed it — our sign-in provider keeps only a scrambled version it cannot reverse. We also create a short web address for your public page, based on the name you gave us.

If you connect a tracker such as Strava. You are sent to them to log in, and they ask you whether to let ACE read your activities. We never see your password for that service. Once you say yes, we store, for each activity: its name and date, distance, moving and elapsed time, average and top speed, average and maximum heart rate, power, cadence, temperature, the town and country, and a simplified line of the route.

If you link a JustGiving page. The public details of that page and how much it has raised, so the total on your page keeps itself up to date.

Heart rate is health information, and under UK data protection law that is a special category needing your explicit permission. We only ever receive it because you chose to connect your tracker and approved that connection yourself. Disconnecting it stops any new data arriving, and you can ask us to delete what we already hold.

Route data is location information, and we handle it carefully by design:

• Your exact start and finish points are never stored. A ride usually begins at home, so saving precise start coordinates would put a home address in a database that feeds a public page. We do not keep them.
• The route we do keep has the first and last kilometre removed before it is saved — the same protection Strava’s own privacy zones give you. We have to do this ourselves, because the permission you grant us returns the full route regardless of the zones you set on their site.
• What remains is thinned to roughly 300 points — enough to draw the shape of a ride, not enough to retrace your steps.
• For a point-to-point event where the start is a hotel rather than a house, the trimming can be switched off so the route shows end to end. That is a deliberate choice made per event, not the default.

The point of ACE is a page donors can see, so some of this is meant to be public: your fundraiser name, your cause, your totals, your activity figures and the trimmed routes. Your email address, your password and your connection to Strava are never shown to anyone.

We keep the list of companies involved as short as we can. Each of them only handles what it needs to do its job, and none of them are allowed to use your information for their own purposes.

• Supabase — stores the database and manages sign-in.
• Vercel — serves this website.
• Resend — sends the emails we send you.
• Strava — where your activity data comes from, at your request.
• JustGiving — where donations are made and totals are read from.
• Lovable — our development tooling, which can receive technical crash reports while we are building. This is not active on the live site.

We do not sell your information, we do not share it with advertisers, and we do not use it to build advertising profiles.

There are none of the usual ones. No advertising cookies, no analytics, no tracking pixels, no third-party scripts watching what you do. The only thing this site keeps in your browser is what is needed to remember you are signed in. That is why you have not been shown a cookie banner — there is nothing to ask you about.

Your account and its activity history stay for as long as your fundraising page exists, because that is the record donors are looking at. If you registered interest and never went further, we delete your details once it is clear ACE is not for you, or sooner if you ask.

Deleting your sign-in does not automatically wipe a live fundraising page and its donation history — those are deliberately kept separate so a page cannot vanish from under the donors who gave to it. Ask us and we will remove the page too.

Whatever we hold, it is still yours. You can ask us to:

• show you everything we have about you;
• correct anything that is wrong;
• delete it;
• send you a copy in a form you can take elsewhere;
• stop using it in a particular way;
• withdraw a permission you gave earlier — disconnecting your tracker is exactly this, and you can do it without asking us.

Email [TBD — contact email] and we will sort it out. We aim to reply within a few days, and within one month at the outside. If we get it wrong, you are entitled to complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first and gave us a chance to fix it.

ACE is not built for under-16s and we do not knowingly set up accounts for them. If you think a child has signed up, tell us and we will remove it.

When we change how ACE handles your information, we change this page and move the date at the top. If a change genuinely affects you, we will email you rather than hope you noticed.