Your data, explained.

Last updated · 22 August 2026

Who we are

Scute is a running app that pairs you with a new running partner each week based on your pace, distance, and location. This policy covers the Scute mobile app and the scute.run website. When we say "we" or "us," we mean the Scute team.

What we collect

Account information

When you create an account, we collect your email address, first name, and city. Your password is stored as a one-way hash — we never store or see your actual password.

Strava data

If you connect your Strava account, we access your run activities (distance, pace, time, and GPS start coordinates) through Strava's API using OAuth. We use this to build your runner profile and match you with compatible partners. We only read run activities — we do not post to your Strava account or access non-running activities.

Location

You choose a run start zone on a map (a center point and radius). This is used to match you with nearby runners. We do not request device GPS permission or track your location in the background.

Photos

You may upload profile photos for verification purposes. Photos are stored in a private cloud storage bucket and are only visible to the Scute team and your running matches.

Messages

When you're matched with a running partner, you can chat within the app. Message content is stored on our servers and visible only to you, your match, and the Scute team (for safety/moderation).

Push notifications

If you allow notifications, we store your device push token to send you match updates. You can disable notifications at any time in your device settings.

Waitlist

If you joined the waitlist before the app launched, we collected only your email address and approximate city (derived from your IP, not GPS).

How we use your data

• Matching: Your pace, distance, start zone, and city are used to pair you with compatible running partners.
• Communication: Your email is used for password resets and important account notifications.
• Safety: Profile photos help verify that accounts are real people.
• Notifications: Push tokens deliver match and chat updates.

We do not sell, rent, or share your personal data with third parties for advertising. We do not use your data for ad targeting or profiling.

Third-party services

We use the following services to operate Scute:

• Amazon Web Services (AWS) — database hosting, photo storage, transactional email (SES)
• Strava API — run activity data (only when you connect your account)
• Expo / EAS — push notification delivery
• Mapbox — map tiles and route generation

Each service processes data on our behalf under their own privacy policies. We do not share your personal data beyond what is necessary for these services to function.

Data retention

We keep your data for as long as your account is active. If you delete your account, all of your data — profile, photos, Strava data, matches, messages, and notification tokens — is permanently deleted from our systems.

Your choices

• Delete your account: You can permanently delete your account and all associated data from the Profile screen in the app, or by emailing us.
• Disconnect Strava: You can disconnect Strava at any time from the Profile screen. This removes your OAuth tokens and stops future syncs.
• Pause matching: You can turn off matching from the Profile screen to stop being paired without deleting your account.
• Notifications: Disable push notifications in your device settings at any time.

Security

Passwords are hashed with bcrypt. All communication between the app and our servers uses HTTPS. Photos are stored in a private S3 bucket with presigned, time-limited access URLs. Strava OAuth tokens are stored encrypted at rest in our database.

Children

Scute is not intended for anyone under the age of 13. We do not knowingly collect data from children. If you believe a child has created an account, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the app. The "last updated" date at the top of this page reflects the most recent revision.

Contact

Questions about your data? Email us at hello@scute.run.