The 0600 Run Club
Privacy notice
Last updated 8 October 2026
Who we are
The 0600 Run Club is a running club based in Liverpool. The club is responsible (the "controller") for the personal information held in this app. If you have a question about your information, or want to use any of your rights below, contact Daz8000@gmail.com.
What we keep, and why
Your account
Name, email address, member number, role and join date - so you can sign in and we know who our members are.
Your profile
Optional tagline, location, phone number and photo or pixel avatar - so other members know who's who.
Emergency contact
The name, phone number and relationship of someone to call if something happens to you on a run. Please let them know you've given us their details.
The club waiver
That you accepted it, and when.
Your running
Runs you log (date, distance, time, shoes, notes), runs you say you're going to, races and results, badges, trophies, training plans and the routes you add.
Photos
Photos you upload to the gallery, races, notices, the trophy room and your own solo runs. Ask us and we'll take any photo of you down.
Strava (only if you connect it)
Your Strava name and the runs Strava sends us, so you can log them in a tap. The distances from Strava are only ever shown to you. Disconnecting removes the link and anything waiting to be logged.
Qualifications
First aid, run leading, coaching or DBS qualifications you add, with dates and any certificate - so we know who can help keep runs safe.
Accident reports
If you're hurt or unwell at a club run or event, a run leader records what happened, any first aid and what happened next. This includes health information.
Guest check-ins
If you check in at a club run as a guest (by scanning the QR code), your name, email, phone, emergency contact and when you accepted the waiver - so we know who was there and how to help in an emergency.
Feedback and ideas
Feedback you send (if you send it anonymously, your name isn't stored with it at all), fundraising ideas and votes.
Sign-in
Short-lived sign-in codes and links (they expire within 20 minutes) and a cookie that keeps you signed in. If you turn on Face ID or fingerprint sign-in, we keep a passkey's public key and the device name - your face or fingerprint never leaves your phone.
Error reports
If something in the app goes wrong for you, a note of the error, the page you were on and your member ID - so it can be fixed. These stay in the app; they aren't sent to any outside service.
Our lawful basis
Legitimate interests - running the club and this app for our members: your account, profile, runs, photos, feedback, qualifications and keeping in touch. We only use the information for club purposes.
Consent - connecting Strava. You can disconnect at any time in My runs.
Vital interests - using your emergency contact if you're hurt or taken ill.
Accident reports contain health information, which the law treats as special category data. We keep it to look after the people involved, to learn from incidents, and in case of an insurance or legal claim (UK GDPR Article 9(2)(f)), and as a not-for-profit members' body (Article 9(2)(d)).
Who can see it
Other members see your name, photo, profile, club runs, badges, races and photos - the things that make it a club. Your email address is only visible to admins. Your phone number and emergency contact are only for admins and run leaders, in case you're hurt or unwell: leaders can see them for the members going on a run from the day before it until a few hours after, and they appear on any accident report.
Qualification certificates are only seen by you, run leaders and admins. Members going on a run can see the name of any first aider who's going too.
Accident reports are only seen by admins and the run leader who wrote the report.
Guests' check-in details are seen by run leaders and admins.
We never sell your information or use it for advertising.
Photos, posts and reports
Keep what you post friendly and about running: no offensive, sexual or violent content, no bullying, and nothing that shares someone's private details or a photo they wouldn't want posted.
Race-day cheers - voice messages for a clubmate's race - are only heard by the runner they're for (from race morning) and the person who recorded them. Either of them can delete one at any time; they go when the race or either account is deleted.
Anyone can report a photo, medal or member with the Report link under it. Admins are told straight away and can hide or delete the content, or suspend the account of whoever posted it. A suspended member can't sign in until the committee reactivates them. Reports, and who made them, are only seen by admins.
You can also block a member (next to Report, or on their profile). Neither of you then sees the other's photos, medals, profile, reactions or cheers, and the committee is told. Unblock them any time in Settings.
Services we use
Vercel
Hosts the app.
Neon
Our database, hosted in London.
Cloudflare
Stores photos and files.
Resend
Sends sign-in emails, and run reminders (which you can turn off in Settings).
Google Firebase and your browser's push service
Deliver notifications, if you turn them on. We keep a token for each device, deleted when you turn notifications off.
Strava
Only if you connect your account.
OpenStreetMap and FOSSGIS
Map images, and finding paths when you draw a route (the points you tap are sent to them).
Open-Meteo and postcodes.io
Weather forecasts and finding venues on the map. They're sent places, not personal information.
Some of these companies are based in the USA. Where information goes outside the UK it's protected by the UK's approved safeguards (the UK-US data bridge or standard contract clauses).
How long we keep it
Your account and running history
While you're a member. You can delete your account at any time in Settings. We also review and remove accounts that haven't been used for two years.
Guest check-ins
3 years (in case of an insurance or injury claim), then deleted automatically. If you join the club, they become part of your account.
Accident reports
3 years after the report is closed (long enough for an insurance or injury claim), then deleted automatically.
Qualifications
While you're a member. You can delete your own at any time in Profile → Qualifications.
Strava runs waiting to be logged
Until you log or dismiss them, or disconnect Strava.
Feedback
Until it's been dealt with.
Error reports
30 days after the error last happened, then deleted automatically.
Backups
A copy of the club's data is taken each week and kept in our private storage for about ten weeks, in case anything is lost. Deleting your account removes you from new backups straight away; older copies age out within ten weeks.
Your rights
You can:
- get a copy of your information - use Download my data in Settings, or ask us;
- correct it - most of it you can edit yourself in Settings;
- delete your account yourself in Settings (see deleting your account), or ask us to delete or stop using any of it;
- withdraw consent, for example by disconnecting Strava.
We'll reply within a month. If you're unhappy with how we've handled your information you can complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113.
Keeping it safe
There are no passwords to leak - you sign in with a code sent to your email. Everything travels encrypted, Strava keys are encrypted when stored, and what each person can see depends on their role. If something did go wrong, we'd tell the people affected and, where the law requires it, the ICO within 72 hours.
Changes
If we change this notice we'll update the date at the top and let members know on the notice board.