Privacy Policy

Last updated: 23 August 2026

Strid3 ("we", "us", "our") is a social fitness coordination app that helps you organise activities with friends. This Privacy Policy explains what information we collect, how we use it, and your rights over it.

We have written this policy in plain language because we believe privacy policies should be readable by the people they protect. If anything is unclear, contact us at privacy@strid3.ai.

1. What We Collect

1.1 Information you give us

When you create an account:

• Email address — used to sign in and send you notifications
• Display name — shown to people you invite to a MOVE
• Profile photo — optional, shown on your match card

When you set up your profile (TAILOR):

• Weekly availability — the days and times you are free to move
• Activity preferences — the activities you enjoy (e.g. running, walking, gym)
• Vibe preferences — how you like to move (e.g. social, blow off steam)
• Social preferences — what you like to do after a MOVE (e.g. coffee, drinks)
• Movement style — whether you prefer in-person, remote, or either
• Timezone — used to show times correctly and find overlapping availability with friends

When you create a MOVE:

• Activity type, date, time, duration
• Meeting point (optional)
• Notes, description, what to bring (optional)
• Whether the MOVE is in-person or remote

When you respond to a MOVE invitation:

• Your name (required to confirm attendance)
• Your response (yes, no, or suggested alternative time)
• Email address (optional — provided if you want email reminders)

1.2 Information we collect automatically

When you use Strid3 we collect:

• Usage data — which features you use and when
• Device timezone — detected from your browser to display times correctly

We do NOT collect:

• Precise or approximate location — we use timezone only, never GPS
• Health or fitness data — we do not connect to Apple Health, Google Fit, or any fitness tracker
• Contacts — we never access your address book
• Financial information — we do not process payments

1.3 Information from third parties

We use the following third-party services which may collect data as described in their own privacy policies:

• Supabase — database and authentication (Frankfurt, EU). supabase.com/privacy
• Vercel — web hosting (global CDN). vercel.com/legal/privacy-policy
• Resend — transactional email delivery. resend.com/legal/privacy-policy
• PostHog — product analytics (EU region, anonymised). posthog.com/privacy
• Sentry — error monitoring (anonymised). sentry.io/privacy

2. How We Use Your Information

2.1 To provide the service

• Match you with friends who share your availability and activity preferences
• Create and manage MOVEs (fitness activities) you organise
• Show your confirmed attendees and track responses
• Send reminder emails 30 minutes before a MOVE starts
• Send calendar invites (.ics) when you confirm attendance
• Notify you when someone confirms, declines, or suggests a new time for your MOVE

2.2 To improve the service

• Understand which features are used most (via anonymised analytics)
• Fix bugs and errors (via anonymised error reports)
• Develop new features based on how people use the app

2.3 What we do NOT do

• We do not sell your data to third parties
• We do not use your data to serve you advertisements
• We do not share your data with fitness brands, gyms, or sponsors
• We do not use your data for automated decision-making that affects you
• We do not build profiles for the purpose of selling to data brokers

3. Who Can See Your Information

3.1 Other Strid3 users

When you use Strid3, other users can see:

• Your display name and profile photo — shown on match cards and MOVE invitations
• Your availability slots and activity preferences — shown to users you are matched with
• Your response to a MOVE — visible to the person who organised it

Other users cannot see:

• Your email address
• Your full availability history
• MOVEs you organised that did not involve them

3.2 MOVE invitees (non-registered users)

When you send a MOVE invitation, the person who receives it sees:

• Activity type, date, time, location or remote details
• Your first name (as organiser)

They do not need a Strid3 account to respond. They do not see your profile or availability.

3.3 Our team

Strid3 staff may access your data to provide support, fix bugs, or investigate abuse. Access is limited to what is necessary for the task.

3.4 Legal requirements

We may disclose your data if required by law, regulation, or a valid legal process. We will notify you if we receive such a request unless we are legally prohibited from doing so.

4. Data Storage and Security

Your data is stored in the European Union (Frankfurt, Germany) on Supabase infrastructure.

We protect your data using:

• Encryption in transit (HTTPS/TLS for all connections)
• Encryption at rest (Supabase default encryption)
• Row-level security — database policies that ensure users can only access their own data
• Authentication via Supabase Auth — passwords are hashed and never stored in plain text

No method of transmission or storage is 100% secure. If we become aware of a security breach that affects your data, we will notify you within 72 hours as required by GDPR.

5. Data Retention

We keep your data for as long as your account is active. When you delete your account:

• Your profile, preferences, and availability are deleted immediately
• MOVEs you organised are anonymised — the activity data is retained but your name is removed
• Responses you submitted as an attendee are deleted
• Backups may retain your data for up to 30 days after deletion

If you have not used Strid3 for 24 months and have not responded to our inactivity notice, we will delete your account automatically.

6. Your Rights

6.1 Rights under GDPR (UK and EU users)

• Right to access — request a copy of the data we hold about you
• Right to rectification — ask us to correct inaccurate data
• Right to erasure — ask us to delete your data ("right to be forgotten")
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, email privacy@strid3.ai. We will respond within 30 days.

6.2 Rights under CCPA (California users)

California residents have the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale of personal information. We do not sell personal information.

6.3 How to delete your account

You can delete your account at any time from the profile settings screen in the app, or by emailing privacy@strid3.ai. Account deletion is permanent and cannot be undone.

7. Cookies and Local Storage

Strid3 uses browser local storage (not cookies) to remember your preferences across sessions, including:

• Whether you have dismissed certain prompts (e.g. the timezone update banner)
• Session state while you are using the app

We do not use advertising cookies or third-party tracking cookies. Our analytics (PostHog) are configured to anonymise data and respect Do Not Track browser settings.

8. Children's Privacy

Strid3 is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact privacy@strid3.ai and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or by a prominent notice in the app at least 30 days before the changes take effect.

The date at the top of this page shows when the policy was last updated. Continued use of Strid3 after the effective date constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or how we handle your data:

• Email: privacy@strid3.ai
• Website: www.strid3.ai

If you are in the UK or EU and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EU, contact your national supervisory authority.

Strid3 — Never move alone.