Privacy Policy

1. Introduction

Allegro ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding that information. Allegro is operated from Seattle, Washington, United States, and is intended for users in the United States. By using Allegro you agree to the practices described here.

2. Information We Collect

We collect information you provide directly:

• Account information — email address, full name, username, profile photo, date of birth (for age verification), and city
• Profile details — bio, privacy settings (public or private account), coach or athlete designation, and any club memberships you join
• Activity data — GPS files (GPX/FIT/TCX), activity name, type, distance, duration, pace, elevation, and start time
• Personal records — race events, times, locations, and dates you choose to log, including custom personal records
• Goals — titles, descriptions, and target dates you set for yourself
• Social content — comments, likes, group run details, run invites, RSVP responses, and direct messages with other users
• Parental consent records — if you are under 18, your parent or guardian's name and email, retained as proof of consent

We receive information from third-party services when you choose to connect them:

• Google Sign-In — your email address, full name, and profile photo, used to create or sign in to your Allegro account
• Apple Sign-In — your email address (or relay address) and full name, used to create or sign in to your Allegro account
• Strava — your Strava activities (GPS data, distance, duration, pace, elevation), profile, and OAuth tokens, imported to populate your Allegro activity history

We also collect limited technical information automatically, such as your IP address, browser type, and authentication session cookies, to operate and secure the service.

3. How We Use Your Information

• To provide, maintain, and improve Allegro
• To create your account and authenticate you, including via Google Sign-In or Apple Sign-In
• To display your activities and profile to other users in accordance with your privacy settings
• To enable social features such as following, liking, commenting, direct messaging, and group runs
• To send you transactional and notification emails about activity on your account (new follower, first message, run invite, run RSVP), which you can disable in settings
• To verify your age and obtain parental consent where required
• To respond to your support requests
• To detect and prevent fraud, abuse, or violations of our Terms of Service

We do not use your information for advertising. We do not sell or rent your personal information. We do not use information received from Google Sign-In or Apple Sign-In for any purpose other than authenticating you and populating your Allegro profile, and we do not share that information with third parties except as described in Section 7.

4. Privacy Settings and Sharing

You control who can see your content:

• Public account — your activities and profile are visible to anyone on Allegro
• Private account — only approved followers can see your activities; follow requests require your approval
• Goals — individual goals can be set public or private regardless of your account type
• Personal records — shared to your followers' feed only when you explicitly choose to share them
• Direct messages — visible only to the participants in the conversation

Changing your account to private does not retroactively hide content that was previously shared publicly.

5. GPS and Location Data

GPS activity data is uniquely sensitive: routes can reveal your home, workplace, training patterns, and daily movements. Treat your activity privacy settings accordingly. We do not sell, share, or use GPS data for advertising, and we do not track your real-time location — we only store the GPS data you choose to upload from completed activities.

If you make activities public, the GPS routes are visible to other users; consider using Strava-style privacy zones (cropping the start or end of a route) before sharing if you wish to obscure sensitive locations. This feature may not yet be available on Allegro; in the meantime, you can choose not to upload activities that begin or end at sensitive locations.

6. Data Storage and Security

Your data is stored securely using Supabase, which provides encrypted storage and row-level security. GPS files and profile photos are stored in Supabase Storage. Sensitive profile fields (such as date of birth and email address) are isolated in a private table with stricter access controls than the publicly readable profile data. Data is hosted in the United States.

We use industry-standard security measures, but no system is 100% secure — please use a strong, unique password and keep your credentials private.

7. Service Providers and Third Parties

We do not sell, rent, or share your personal information with third parties for marketing purposes. We use the following service providers to operate Allegro:

• Supabase — database, authentication, and file storage
• Vercel — web hosting and infrastructure
• Resend — transactional and notification email delivery
• Google — Google Sign-In authentication (only if you choose to use it)
• Apple — Apple Sign-In authentication (only if you choose to use it)
• Strava — activity import (only if you choose to connect your Strava account)

These providers process your data only as necessary to deliver the service and are bound by their own privacy policies. Connecting Google, Apple, or Strava is optional; you can disconnect them at any time in your account settings or directly through the provider.

We may disclose your information if required by law, subpoena, court order, or other valid legal process, or to protect the rights, safety, or property of Allegro, our users, or the public.

8. Cookies and Sessions

Allegro uses cookies solely to maintain your login session. We do not use advertising cookies or third-party tracking cookies. You can clear cookies in your browser settings, which will log you out of Allegro.

9. Data Retention

We retain your data for as long as your account is active. When you delete your account or specific content:

• The content is removed from public view immediately
• It is purged from our active systems within 30 days
• It may remain in encrypted backups for up to 90 days before those backups are rotated out
• We may retain limited records (such as parental consent records, or information needed for fraud prevention or legal compliance) longer where required by law

10. Your Rights

You have the right to:

• Access — view and download the data associated with your account
• Correct — update inaccurate information in your profile settings
• Delete — delete individual activities, records, or your entire account; deleted data is removed from public view immediately and purged within the retention windows described in Section 9
• Export — request a copy of your data by emailing us
• Disconnect — revoke a connected Google, Apple, or Strava account at any time, in Allegro's settings or directly with the provider
• Object — contact us if you have concerns about how we process your data

California residents have additional rights under the CCPA, including the right to know what personal information we collect and to request deletion. To exercise any of these rights, email contact@allegro.run.

11. Children's Privacy

Allegro is not directed at children under 13, and we do not knowingly collect personal information from children under 13. Users between 13 and 17 must confirm that a parent or guardian has reviewed and agreed to our Terms and this Policy. If you believe a child under 13 has created an account, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the site or sending an email to your registered address. Continued use of Allegro after changes take effect constitutes acceptance of the updated policy.

13. Contact

Questions or requests regarding your privacy? Email us at contact@allegro.run.