Privacy policy

hybrid.club is a free, invite-only club for everyday athletes who train running and strength, with its own app. This policy covers this website, the hybrid.club app for iPhone and Apple Watch, and the hybrid.club watch face for Garmin watches.

hybrid.club is run by Affilink Ltd, Bridge House, Riverside North, Bewdley, DY12 1AB. They are the data controller for your personal data: they decide how it's used and are responsible for it. When this policy says we or us, it means them.

Members can join from anywhere, and every member gets the same protection: the standard set by the UK GDPR and the Data Protection Act 2018, and by the EU GDPR, which are among the strictest privacy laws there are. If the law where you live gives you more, you get that too.

For anything in this policy, including a copy of your data, email hello@hybrid.club.

Only what the club needs to work. Here's all of it.

When you apply on this website

• Your first name, email address, town or city and Instagram handle, and what you train for if you tell us. We read every application ourselves, and use these to decide on it and to let you in when your wave opens.
• How you found us: the site you came from, the page you first landed on, any campaign tags in the link, and the last join button you pressed. It shows us which posts and pages bring people in.
• If we give you a free month of RYVOLVE, our partner training app, we note which code went to your email so nobody gets two. You redeem it with Apple, in the App Store.

When you use the race finder

• The place you search for, with the date: a town, or the first half of a postcode (B1, never B1 1AA). If you use your location, we log only the nearest postcode district, or that you were outside the UK. It shows us where people are looking for races, and it doesn't identify you.
• If you send us a race, its details and your name and email, so we can check it before it goes on the finder and contact you about it if we need to.

When you browse this website

• This website doesn't use cookies.
• Your browser keeps a few small notes on your device: where you first arrived from, the last join button you pressed, your light or dark setting, whether you've applied, and whether you closed the join bar. The first two come to us with your application, if you apply. The rest never leave your browser, and clearing your browser's data for this site removes them all.
• We count page views with Vercel Web Analytics, which doesn't use cookies or keep your IP address. More on that below.

When you use the app

Your account

Your email address and how you sign in. If you sign in with Apple, also the name and email Apple shares with us (which can be a private relay address) and the ID Apple gives your account for our app. We add your wave, member number and the date you joined, your founding number if you have one, and who invited you, if someone did. When you join, the app asks your date of birth to check you're 18 or over: we keep only that you are, and when you told us, never the date itself.

Your profile

Your name, photo, town, gym, what you train, your division, how long you've trained hybrid and your bio. Also your time zone, so your club week and your notifications run on your time.

Your training

The sessions you post or save: type, title, notes, time, duration, splits, sets and weights, distance, pace, how hard it felt, photos, and which app or device recorded it.

Runs you record

Your GPS route, distance, pace, splits and elevation, and steps and cadence from your phone's motion sensor, which show a run was on foot. Heart rate, when a watch records it and you've said yes to it. The app only uses your location on the run screen and while you're recording a run (including with your phone locked), never at any other time.

Races

The races you enter, with your division, day and start time; the results you post; and any race you add to the calendar.

Club activity

Your comments, reactions and mentions, who you follow, the luck you wish other racers, the challenges you join, your place on the weekly board, your points, tier, patches and PBs, the invites you send (with the name you type for who each one is for), people you block, posts you hide, and reports you make.

Settings

Your notification and privacy choices, and any run goal you set.

Your phone

A push notification token, the app version and your time zone, so notifications reach you.

Safety and fair play

Reports about things you've posted, any warnings or suspensions, and the results of the automatic checks on your runs. We also keep a trust level for each member, which decides whether their runs need checking by hand.

Sign-in protection

When you ask for a sign-in code, we store it scrambled (hashed), never the code itself, for 15 minutes. Your IP address is used briefly to limit how often anyone can ask for codes or try invite codes, then deleted.

Garmin and Apple Health have sections of their own: Garmin and Apple Health and Apple Watch. If you email us, we keep the conversation.

The UK and EU GDPR ask us to have a lawful basis for everything we do with your data. These are ours, and they're the same for every member.

Running the club for you

Your account, profile, feed, runs, races, points, patches, the notifications you've switched on, and Garmin if you connect it. It's the service you joined for.Lawful basis: contract

Your application

Reviewing it, and emailing you about it, including when your wave opens.Lawful basis: steps you asked us to take before you join (contract)

Safety and fair points

Reports, moderation, the filter that holds back suspicious posts, the checks on runs, and limits on sign-in attempts. Members need to be able to trust the club and its points.Lawful basis: legitimate interests

Improving the website

Seeing where applicants come from, which join buttons work, what people search for in the race finder, and how many people visit each page. We keep this to the minimum.Lawful basis: legitimate interests

Club news

Emails to applicants and members about the club. Unsubscribe whenever you like.Lawful basis: legitimate interests

Heart rate

Heart rate is health data, which the law protects more strictly in the UK, the EU and many other places. So we only keep it if you say yes. The app asks the first time a heart rate would reach us: when you post or save a session recorded on your watch, or connect Garmin or Apple Health. Until you say yes, we don't keep it at all. Change your mind whenever you like with Heart rate in Settings, Privacy and safety: turn it off and we delete every heart rate we hold, from all your sessions and posts. You can also hide it on a single post as you post it.Lawful basis: your explicit consent

The law

Anything the law requires of us, such as keeping or handing over information when we're legally obliged to.Lawful basis: legal obligation

Other members

• Your profile: name, photo, town, gym, what you train, division, how long you've trained hybrid, bio, wave, founding number if you have one, training stats, tier, patches and PBs, and your next race if you choose to show it.
• Your posts and the sessions behind them, with their comments and reactions. Runs show your route with the start and finish hidden, unless you change that in Route privacy. On those runs, other members see your distance to the nearest half kilometre; you see the exact figures.
• Your heart rate on sessions, if you've said yes to it and don't hide it on that post, and your town on posts, unless you turn on Hide my town.
• Which days you trained this week, how many sessions you did and your gold ring, on the weekly board. Never your times. Turn off Show me on the weekly board to leave it.
• Your best sims on the sims leaderboard, the races you've entered on each race's page (with your start time only if you choose to share it), your results in race roundups, and your streak in challenges you join.
• Who you follow is private, but the person you follow is told.

Only you

Your email address, sessions you save with Only me, your full routes, race start times you haven't shared, your points, your notifications, your settings, people you block, posts you hide, and Garmin workouts you haven't posted.

The club's admins

The admins are Samuel, our founder, and anyone he asks to help run the club. To run the club, check runs for points and deal with reports, they can also see your email address, your private sessions and full routes, your points and the checks on your runs, and reports and moderation history. What they do to members and posts is logged.

Nobody outside the club

There are no public profiles and no public feed: you have to be a signed-in member to see anything posted in the app. Members can still pass on what they see, with a screenshot for example, so post what you're happy for the club to see. If you share a session as an image, say to Instagram, it goes wherever you send it.

We use a few companies to run hybrid.club, and they handle your data for us to provide their service. We only use companies that protect your data at least as well as this policy does. We don't sell your data, and we don't pass it to anyone else unless the law requires it or someone's safety is at risk.

Companies that run hybrid.club for us

Google Cloud (Firebase)

Runs the app: sign-in (Firebase Authentication), the database (Cloud Firestore), storage for photos and routes (Cloud Storage) and our server code (Cloud Functions). The database, storage and server code are in London (europe-west2). Everything the app stores is held here, Garmin data included.

Google Sheets

Holds applications, races people send us, race finder searches and the RYVOLVE codes we give out.

Resend

Sends our emails, from hello@mail.hybrid.club: sign-in codes, application emails and club news. It sees your email address and what's in each email, and holds our mailing list of applicants (first name and email).

Expo

Delivers push notifications to your iPhone, through Apple's push service, and delivers app updates. It sees your phone's push token and the text of each notification (for example, that someone commented on your post), and your IP address and app version when the app checks for an update.

Vercel

Hosts this website and runs its forms. Vercel Web Analytics counts page views without cookies: for each one it records the page, the site you came from, your rough location (country and city) and your device and browser. It recognises a visit by a code made from your request, which is thrown away after 24 hours, and it doesn't keep your IP address.

Services you choose, or that your phone or browser contacts

Apple

If you sign in with Apple, Apple confirms who you are and shares your name and email, or a private relay address, with us. Deleting your account also ends that sign-in with Apple. Notifications reach your iPhone through Apple's push service. While the app is being tested, it comes through Apple's TestFlight, which can share crash reports and any feedback you send with us. For Apple Health and Apple Watch, see below.

Garmin

Only if you connect your Garmin account. See Garmin.

Google Fonts

This website loads its main typeface from Google Fonts, so your browser asks Google for it, which shows Google your IP address.

postcodes.io

If you search the race finder by postcode or use your location, your browser asks postcodes.io where that is. With your location, it sends a point rounded to about 1 km, never your exact position.

OpenFreeMap

Race finder maps load from OpenFreeMap, so your browser asks OpenFreeMap's servers for them.

Where your data goes

The app's data is kept in London. If you live outside the UK, using the club means your data comes to the UK. The EU recognises the UK as protecting personal data properly (an adequacy decision), so data can come here from the European Economic Area without anything extra.

Some of these companies are based in the United States or handle data there. When your data goes there, it's protected by the safeguards UK and EU law require: the UK-US data bridge and the EU-US Data Privacy Framework, or approved data protection contracts.

Connecting Garmin is up to you. You do it in the app, under Settings, Connected apps, and Garmin asks you to approve it.

What we get

Each workout that reaches your Garmin Connect account after you connect (and, if Garmin allows it, from the week before): its type and name, start time, duration, distance, pace, heart rate (if you've said yes to it), calories, elevation, steps and cadence, the name of the device, and for workouts with GPS, the route and Garmin's detailed samples, without their heart rate. We also keep what Garmin gives us to stay connected: the keys that let it send us your workouts, your Garmin user ID, the permissions you granted and the names of your Garmin devices.

What we do with it

• Nothing is posted for you. Each workout waits in the app under New post, From Garmin, where only you can see it, until you post it, save it to your log or dismiss it.
• We use the samples to check runs for points, the same way we check every run.
• A workout you post becomes a normal post. The club sees it like any other, with your route trimmed by your Route privacy setting, and it names the Garmin device that recorded it.
• No analytics and no AI touch your Garmin data, and it's never used to train AI.

Who handles it

We keep and process Garmin data only in Google Cloud (Firebase), in our database and file storage in London. Nobody else gets it from us, with one exception: once you post a workout, a notification about it, such as a PB, reaches members' phones through Expo and Apple's push service.

How long we keep it

Workouts you don't post are deleted after 30 days. Garmin's samples are deleted as soon as you post the workout, or after those 30 days.

See it, get a copy, delete it

• See it: workouts you haven't posted are under New post, From Garmin, and the ones you've posted are with your other posts. Settings, Connected apps shows your connection and devices.
• Get a copy: email hello@hybrid.club and we'll send your Garmin data with the rest of your data.
• Delete it: dismiss a workout to hide it, or delete a post and its session goes with it. To disconnect, go to Settings, Connected apps: we tell Garmin to stop sending us your data, and delete the connection, every workout you haven't posted and all of Garmin's samples. Removing hybrid.club from your Garmin account in Garmin Connect does the same. Posts you've already shared stay until you delete them, and we keep a note of which Garmin workouts you've posted, so the same one can't be posted twice. Deleting your hybrid.club account deletes all of it, that note included.

The hybrid.club watch face

Our watch face for Garmin watches shows your sessions this week, your gold ring, your season points and tier, your next race and your founding number. You link it by typing the code it shows into the app, and it works without connecting Garmin Connect. It asks us for those stats every 30 minutes, through the Garmin Connect app on your phone, and we note when each linked watch last checked in. Unlink it in the app and it stops getting them straight away.

The Apple Watch app

It records runs and strength sessions with Apple's workout tools: time, distance, pace, splits, GPS route, heart rate, steps, cadence, elevation and calories. It saves each workout to Apple Health and sends it to the app on your iPhone. The watch app never talks to our servers.

Nothing it records reaches us until you post the session, or save it to your log, on your iPhone. Then we get what that session needs, like its time, distance, splits, route and steps, and its average heart rate if you've said yes to heart rate and don't hide it on that post. Calories stay on your devices.

Apple Health

If you connect Apple Health, the app reads your recent workouts on your phone, with their time, distance, route, steps and heart rate, to offer them to you as drafts. iOS asks which of these you'll share, and you can change that any time in the Health app. Nothing from Apple Health leaves your phone until you post a workout or save it to your log, and its heart rate only if you've said yes to heart rate.

We never use Apple Health data, or any health and fitness data, for advertising or marketing. We never sell it, and we only share it as this policy describes.

Applications

While we're letting people in from the waiting list, so we can invite you when your wave opens, and while you're a member if you join. Ask us and we'll delete yours sooner.

Our mailing list

Until you unsubscribe or ask us to delete your application. If you unsubscribe, we keep your address marked as unsubscribed, so we don't email you again by mistake.

Race finder searches

Kept as statistics. They don't identify anyone.

Races you send us

Kept as the record of where a race came from. Ask us and we'll take your name and email off yours.

Your account

While you're a member. Delete your account and it's erased, usually within minutes. If you've been removed from the club, email us and we'll delete it for you.

Heart rate

Only while you've said yes to it. Turn it off and we delete it from everything straight away.

Garmin workouts

30 days, if you don't post them.

Sign-in codes

15 minutes, or until you use the code.

IP addresses

The ones used to limit sign-in attempts are deleted automatically, usually within a day. Google Cloud and Vercel also keep routine server logs, which include IP addresses, for a limited time to keep things running and secure.

Push tokens

Until you sign out, the token stops working, or you delete your account.

It erases your profile, posts, sessions, comments, reactions, race entries and results, points, patches, PBs, photos, routes, Garmin data, notifications, settings and sign-in. It also ends Sign in with Apple for our app and tells Garmin. We delete your application from our applications sheet and take you off our mailing list too.

A few things stay:

• Reports stay as the club's safety record, for as long as we need them to keep the club safe: reports you made, without your name, and reports about things you posted, with a copy of what was reported.
• Your email address stays on our list of admitted members, marked as deleted, so your account can't be reopened without us.
• Invites you sent keep working, but no longer show your name.
• A record that an account was deleted, and when, without your name or email.
• Notifications other members have already had, in the app or on their phones, can still show your name.

In the app

• Delete your account: Settings, Delete account. It erases your data, Garmin included.
• Who sees your sessions: Settings, Privacy and safety. Choose Members or Only me.
• Route privacy: Settings, Privacy and safety, Route privacy. Hide the start and finish (on unless you turn it off), choose how much to hide (200 m, 500 m or 1 km), or hide maps completely. A change applies to your past runs too.
• Heart rate, Hide my town and Show me on the weekly board: Settings, Privacy and safety. Turning Heart rate off deletes every heart rate we hold.
• Notifications: Settings, Notifications. Switch each kind off, pause them all or set quiet hours.
• Garmin: disconnect any time in Settings, Connected apps. Workouts you haven't posted are deleted.
• Block, hide and report: from any post, comment or profile.
• Your profile: edit it whenever you like.

By email

Wherever you live, you can ask us to:

• send you a copy of your data, in a common format you can take elsewhere
• tell you who we've shared your data with
• correct anything that's wrong
• delete your data, including your application if you never joined
• stop or limit what we do with your data where we rely on legitimate interests
• take back your yes to heart rate, which deletes every heart rate we hold (or turn it off in the app)

Email hello@hybrid.club from the address on your account, so we know it's you. We'll reply within a month.

If you're unhappy with how we've handled your data, tell us and we'll try to put it right. You can also complain to the data protection regulator where you live. In the UK, that's the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. In the European Economic Area, it's your country's data protection authority: the European Data Protection Board lists them at edpb.europa.eu.

If you live in the United States

We don't sell your personal data or use it for targeted advertising, and we keep your heart rate only with your yes. If the law where you live gives you other privacy rights, email us and we'll honour them.

hybrid.club is for adults: you must be 18 or over to apply or join. When you join, the app asks your date of birth before anything else. If it shows you're under 18, we close the account and delete its data straight away, keeping only a note that an account was closed for that reason, without your name or email. We don't knowingly collect data from anyone under 18, and if we find we have, we delete it. If you think someone under 18 has applied or joined, email hello@hybrid.club.

Everything travels over encrypted connections, and Google Cloud encrypts what it stores. Our database rules let each member see only what this page says they can, sign-in codes are stored scrambled, and what admins do to members and posts is logged.

If we change this policy, we'll update this page and the date at the top. If a change affects what we do with your data, we'll tell members in the app or by email before it takes effect.

Email hello@hybrid.club, or write to Affilink Ltd, Bridge House, Riverside North, Bewdley, DY12 1AB.

Our terms of use cover using the club, and how members treat each other is in the club rules.