Privacy Policy
Last updated: 4 June 2026
FrontRunner is a running-challenge and leaderboard web app. You connect a fitness source (or log runs manually), join challenges, and compete on leaderboards with people you choose to share with. This policy explains what data we collect, why, and the control you have.
Who we are
FrontRunner is operated by Tom Sullivan (United Kingdom), the data controller for the purposes of UK GDPR and the Data Protection Act 2018. Contact: tom.sullivan@frontrunner.club.
What we collect
- Account details - your name and email, to sign you in and send challenge notifications you opt into.
- Activity data - when you connect a source (e.g. Garmin) via secure OAuth, we receive a summary of each completed activity: type, start time, distance, duration, average pace and elevation. We never see your source password.
- Manual entries / uploads - runs you log or files you upload (GPX/TCX/CSV).
- Challenge data - which challenges you join, your results, and badges/awards earned.
- Minimal technical data - a session cookie to keep you signed in. No advertising or cross-site tracking.
What we do NOT collect
We do not collect health metrics beyond activity summaries (no continuous heart rate, sleep, or body composition), no payment information, and we never sell your data or use it to train AI models.
How we use it & legal basis
We use your data solely to run the service - leaderboards, personal stats, achievements and awards. Under UK GDPR we process activity data on the basis of your consent, given when you connect a source or log a run; you can withdraw it any time.
Who can see your data
Your name and the metric relevant to a challenge are visible to other members of challenges you have chosen to join. Your data is never shown to anyone outside those challenges, and precise start/finish locations are not displayed publicly.
Service providers
We use Supabase (database & authentication) and Vercel (hosting) to operate the app, and the source you connect (e.g. Garmin) as the origin of your activity data. They process data only on our instructions. Some may store data outside the UK under appropriate safeguards (UK IDTA / Standard Contractual Clauses).
Retention & your rights
We keep your data while your account is active; past challenge results may be retained for records. You can request access, correction, deletion, restriction or portability, and complain to the ICO (ico.org.uk). To delete your account or disconnect a source, use the in-app settings or email us.
Children
FrontRunner is not directed at children under 16 and we do not knowingly collect their data.
Contact
Questions about this policy or our data practices: tom.sullivan@frontrunner.club.