1. INFORMATION WE COLLECT

Personal Information:

• Name, email address, phone number
• Profile photo and personal preferences
• Running history and achievements
• Event participation records
• Reward points and transaction history

Device Information:

• Device type, operating system version
• App usage analytics and crash reports
• Location data (when permission granted)
• Push notification tokens

Coaching (only if you link with a club coach):

• Coach invitations you receive, accept, decline or end, and when
• Workouts your coach schedules for you, the dates, any note from your coach, and whether each one is scheduled, completed, missed or cancelled

Garmin Connect™ (only if you choose to connect it):

• Your Garmin user ID (an anonymous identifier, not your Garmin login) and the permissions you granted MRC
• Access tokens that let us add workouts to your Garmin Connect calendar and receive your activity files, stored encrypted
• Which of your scheduled workouts are on your Garmin calendar
• Activity files for runs recorded on your Garmin device while you are linked with a coach. Other activities (such as rides or swims), runs entered by hand, and runs recorded while no coach is linked with you are not downloaded or stored.
• From those runs: the start time, duration, distance, pace, heart rate, cadence, power, elevation, laps, the GPS route and the name of the Garmin device that recorded it
• We do not receive your Garmin health or wellness data (such as sleep, stress or steps).

2. HOW WE USE YOUR INFORMATION

We use your information to:

• Provide app functionality and services
• Send event notifications and updates
• Process reward points and transactions
• Improve app performance and user experience
• Communicate club news and announcements
• Ensure account security and prevent fraud
• Let a coach you have accepted schedule workouts for you, and send them to your Garmin Connect calendar when you have connected Garmin
• Compare a run with the workout your coach planned, step by step (for example, your pace on each rep against its target), and show the result to that coach
• Show your coach your other runs (ones not tied to a planned workout), so they can follow your overall training

3. INFORMATION SHARING

We do not sell your personal information. We may share data with:

• Service providers (AWS, Strava, Garmin)
• Other club members (name, profile photo only)
• Legal authorities when required by law

Coaches:

• Club coaches can search for members by name to invite them. Nothing else about you is visible to a coach unless you accept their invitation.
• Once you accept, your coach sees your name, the workouts they have scheduled for you and their status, including whether a workout is on your Garmin calendar.
• If you have connected Garmin, your coach also sees the runs described above that were recorded while you were linked with them: the activity data, the step-by-step comparison and a map of the route.
• Your coach never sees your Strava data, your contact details or your Garmin account details.
• You can remove a coach at any time in the app. They can then no longer schedule workouts for you or see your runs. They keep read-only access to the workouts they scheduled while you were linked. If you link with the same coach again later, they can see the runs from the times you were linked with them, but never runs recorded while you weren't.

Garmin:

• When you connect Garmin, we send the workouts your coach schedules (names, steps, targets and dates) to your Garmin Connect account. Garmin handles that data under its own privacy policy.
• Garmin sends us the activity files described above. We use them only for your coaching and never pass them on to anyone else.

4. DATA SECURITY

We implement industry-standard security measures:

• Encrypted data transmission (HTTPS/TLS)
• Secure cloud storage (AWS)
• Regular security audits and updates
• Access controls and authentication
• Garmin access tokens encrypted with a dedicated key (AWS KMS)
• Garmin activity files and activity data encrypted at rest with a dedicated key (AWS KMS)

How long we keep Garmin activity data:

• The original activity file from Garmin is deleted 90 days after we receive it.
• Runs that couldn't be matched to a scheduled workout are deleted after 90 days.
• Everything else we received from Garmin, including the step-by-step comparison and the route, is kept until you disconnect Garmin or delete your account, and is then deleted.

5. AI PROCESSING

• MRC does not use artificial intelligence or machine learning to process your personal information, including data from Garmin, Strava or the MRC app.
• Your data is never used to train AI models.
• The coaching analysis of your runs (for example, how each rep compared with its planned target) is calculated with fixed rules, not AI.
• Club administrators use an AI assistant for general club tasks. It has no access to members' personal information.

6. YOUR RIGHTS

You have the right to:

• Access your personal data
• Correct inaccurate information
• Delete your account and data
• Opt-out of marketing communications
• Control location sharing permissions
• Remove a coach at any time (Settings or the Coaching tab in the app)
• Disconnect Garmin at any time (Settings → Coaching in the app, or by removing MRC from the connected apps in Garmin Connect). When you disconnect, we remove MRC's upcoming workouts from your Garmin calendar, delete our Garmin access tokens and all activity data we received from Garmin, and ask Garmin to end our access.

Deleting your account:

• You can delete your account in the app (Settings → Delete Account). Sign-in stops straight away, and your data is permanently deleted 7 days later. Contact us within those 7 days if you want to cancel.
• We delete your profile, photos, Strava data, notifications, event and race registrations, reward points, survey and feedback responses, coaching data, Garmin connection and Garmin activity data, and we revoke MRC's access to your Strava and Garmin accounts.
• We keep your club membership record, which the club manages separately from the app, and we keep shop orders for accounting with your name and contact details removed.
• Deleting your MRC account doesn't delete data held by third parties such as Strava or Garmin; manage or delete it with them directly.

7. THIRD-PARTY SERVICES

Our app integrates with:

• AWS (cloud infrastructure)
• Strava® (fitness data integration)
• Garmin Connect™ (sending coach-scheduled workouts to your Garmin calendar, and receiving the activity files of your runs while you are linked with a coach)

Each service has its own privacy policy.

Trademarks:

• Strava® and the Strava logo are registered trademarks of Strava, Inc.
• "Mad Rabbit Crew," "MRC," and related logos are trademarks of Mad Rabbit Crew
• We are not affiliated with or endorsed by Strava, Inc.
• Garmin® and Garmin Connect™ are trademarks of Garmin Ltd. or its subsidiaries
• We are not affiliated with or endorsed by Garmin Ltd.
• All trademarks are used with permission or under fair use

8. CONTACT US

For privacy questions or requests:

Email: info@madrabbitcrew.org.au
Website: madrabbitcrew.org.au

By using our services, you consent to this Privacy Policy.