Privacy Policy

Last updated: 24 October 2026 · Draft for review

DuelMeet ("we", "us") is a running game: teams of runners are paired every Monday, their real runs move a live odds bar all week, and a simulated race on Sunday decides the winner. This policy explains what we collect, why, who sees it, and how to delete it. We wrote it to be read, not skimmed past.

The short version: we keep only what the game needs. We never sell your data, never show ads, and never share the data we receive from Apple Health, Garmin, Strava or COROS with anyone. You can delete your account, and everything tied to it, from inside the app.

Who we are

DuelMeet is run by Mark French (DuelMeet LLC, being formed), Oregon, USA. Contact: privacy@duelmeet.app.

What we collect

Your account

• Your email address, or the private relay address Apple gives us if you use Sign in with Apple.
• A sign-in identifier from Apple when you use Sign in with Apple, or from Google when you use Sign in with Google (with your name and email address on your Google account).

Your runner profile (you enter these)

• The name shown on your team sheet.
• Your age group (for example 30–34) and sex, used only to grade your Speed rating fairly against runners like you. You can choose "Prefer not to say".
• That you confirmed you are 18 or older.

Your runs (from the services you connect, with your permission)

You can connect any of Apple Health, Garmin Connect, Strava and COROS. For each run we store only: the date and start time, distance, duration, average pace, elevation gain, the effort type (for example easy or tempo), a yes/no flag for whether the run had heart-rate data, and the watch or app it came from (for example "Forerunner 965" or "Garmin Connect"), which those services require us to credit. We use the start time only to recognise the same run when two services send it, so it counts once. We do not store GPS tracks or routes, heart-rate values, sleep, or any other health data. Runs can't be typed in by hand, and workouts you typed into Apple Health or Garmin Connect by hand are refused.

Apple Health (iPhone). With your permission we read your running workouts, their distance, and whether heart rate was recorded during them. We read heart rate only to answer that yes/no question: heart-rate values never leave your phone. We never write to Apple Health, never use Health data for advertising or marketing, and never store it in iCloud.

Strava. Strava's rules let us show your Strava runs only to you. Until Strava confirms otherwise, runs that reach us only from Strava appear in your own run list but don't count toward ratings, odds or races your team and rivals see, and we delete them after 7 days, as Strava requires. Runs that also arrive from another service you connected count as usual.

COROS. When available, we receive your runs from the last 3 months and every new run.

What the game works out

• Your five ratings (Speed, Endurance, Base, Consistency, Form) and Overall, your level and XP, badges, race results and team standings.

Teams and chat

• The teams you create or join, invite codes, and team identity (name, crest, colours).
• Messages you send in team chat, the pre-written messages you send in rival chat, and any reports or blocks you make.

Technical information

• If you turn on notifications, a push token so we can send them.
• If the app crashes or hits an error, a short error report: the error message, the app version and whether you use iPhone or Android. Reports are linked to your account so we can fix your problem, and are kept for 90 days.

We do not use advertising trackers, and we don't track you across other apps or websites.

Why we use it

• To run the game: ratings, weekly pairing, live odds, the Sunday race, levels and leagues.
• To show your team and your rivals what the game needs them to see (below).
• To keep the game fair and safe: spotting impossible runs, handling reports.
• To keep the app working: fixing crashes, sending the notifications you asked for.

Who can see what

• Your teammates see your name, level, ratings, Varsity or JV status, and your team chat messages.
• This week's rival team sees your name, ratings and level on the matchup and race screens, and the rival-chat messages you send.
• Nobody else in the app can see your profile, runs or ratings. Your individual runs are visible only to you.

Who we share it with

We never sell your data. We use a few service providers to run DuelMeet, only for that purpose:

• Supabase (database, sign-in and servers, hosted in the USA).
• Expo (app updates and push notifications).
• Apple (Sign in with Apple, notifications on iPhone).
• Google (Sign in with Google, if you choose it).
• Apple Health, Garmin, Strava and COROS, the services you choose to connect: we receive your runs from them (including past runs where the service allows it: 12 months from Apple Health, a week from Strava, 3 months from COROS, and from Garmin only on plans that include history). We send them nothing except the requests needed to receive your runs and, when you disconnect, the notice that you did.

We never pass data from these services to third parties, and no artificial intelligence or machine-learning service processes it. Runs are credited to their source (for example "Data: Garmin Forerunner 965" or "Apple Health · via Garmin Connect") wherever they appear in the app.

We may disclose information if the law requires it.

How long we keep it

We keep your data while you have an account. When you delete your account, we delete your account, profile, runs, ratings and messages. Past race results keep your team's score, but your name is replaced with "Former runner". Error reports are deleted after 90 days.

Your choices and rights

• Delete your account at any time: Team tab → Delete account. This is permanent.
• Disconnect any connected service at any time (Settings → Connections); this deletes the runs we received from it, except runs another service you still have connected also sent. Disconnecting DuelMeet inside Garmin Connect or Strava does the same.
• Notifications can be turned off in your phone's settings.
• Ask us for a copy of your data, to correct it, or anything else about your privacy: privacy@duelmeet.app. Depending on where you live (for example California or the EU/UK), you may have further rights, and we'll honour them.

Adults only

DuelMeet is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you believe someone under 18 has an account, tell us and we'll delete it.

Security

Your data is protected with encryption in transit, access rules on every database table (each player can only reach their own data and what the game shows them), and server-only secrets for the services you connect: their access tokens are encrypted and no player, including you, can read them.

Changes

If we change this policy in a meaningful way, we'll tell you in the app before the change takes effect.