Your data, the short version.

We collect the minimum we need to match you with training partners, and we never sell it. Here's what we do and don't do, plainly.

Who we are

Passu is a service provided by Field Guide Ltd, a company registered in England and Wales (company number 17124510, VAT 516 9777 45). We are the data controller for the personal data collected through passu.run.

Contact: hello@passu.run

Registered office: Silverstream House, 45 Fitzroy Street, 4th Floor, London W1T 6EB

What we collect

When you join the waitlist (email signup)

• Your email address
• Your postcode
• The sports you train in
• Timestamp of signup, referrer, and user agent (for spam prevention and analytics)

If you connect Strava

• Strava athlete ID
• Your first name, last name, city, and country as provided by Strava
• Read-only access to your Strava activity summary (sport type, pace, weekly volume, training frequency) to power matching

We do not read your private activities, post to your Strava feed, or modify any of your Strava data.

Why we collect it

All of it serves one purpose: matching you with compatible training partners near you. Specifically:

• Email: so we can let you know when Passu launches in your area and send service updates
• Postcode: to find partners nearby (we use broad radius, not precise location)
• Sports: to match you with people training in the same disciplines
• Strava data: to verify your training patterns and match you by pace and volume, not self-reported claims

Our legal basis

Under UK GDPR, we process your data under:

• Consent: when you sign up to the waitlist, connect Strava, or subscribe to emails, you consent to the processing described on this page. You can withdraw consent at any time.
• Legitimate interest: for spam prevention, fraud detection, and service improvement, where this does not override your fundamental rights.

Who we share with

We use a small number of processors to run the service. Each has a data processing agreement with us:

• Cloudflare Pages (static hosting and CDN for passu.run and app.passu.run)
• Railway (Postgres database and API hosting, EU region)
• Cloudflare R2 (S3-compatible object storage for photos)
• Resend (transactional email delivery)
• PostHog EU (product analytics, EU region)
• Sentry (error monitoring)
• Stream Chat (in-app chat between matched users)
• Strava (only when you connect your Strava account)

We do not sell your data. We do not share it with advertisers. We do not share it with other Passu users until you're matched and you've both opted to connect.

How long we keep it

We keep waitlist data until you request deletion, or until the app launches and you either activate your account or decline to. Unactivated waitlist records are deleted 12 months after signup if not claimed.

If you request account deletion, we remove your record within 7 days and confirm when it's done. We may retain minimal records (email address plus deletion timestamp) for up to 6 years where legally required (fraud prevention, accounting).

Your rights

Under UK GDPR you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your data ("right to erasure")
• Restrict or object to processing
• Data portability (receive a copy of your data in a portable format)
• Withdraw consent at any time
• Complain to the Information Commissioner's Office at ico.org.uk

To exercise any of these rights, email hello@passu.run. We respond within 30 days, usually much faster.

How to disconnect or delete

Disconnect Strava: go to strava.com/settings/apps, find Passu, click Revoke Access. Your Strava token is immediately invalidated.

Unsubscribe from emails: click the unsubscribe link at the bottom of any email we send, or email hello@passu.run.

Delete your account: email hello@passu.run with "Delete my account" in the subject, from the address you signed up with.

Cookies and analytics

Our own analytics run server-side with no tracking cookies. We don't use Google Analytics.

Ad measurement: we use the Meta Pixel and TikTok Pixel to measure whether our ads work. These load when you visit the site and may set ad-platform cookies. You can block them with your browser's tracking protection or an ad blocker, and you can manage personalised advertising in your Meta ad preferences and TikTok settings. See Meta's privacy policy and TikTok's privacy policy for how they handle pixel data.

Beyond that: server logs only (standard request metadata, deleted after 30 days).

Children

Passu is not for anyone under 16. We don't knowingly collect data from anyone under 16. If you believe a minor has signed up, email hello@passu.run and we'll remove the record.

Changes to this policy

We'll update this page when our practices change. Material changes will be communicated by email to active waitlist members at least 14 days before they take effect.