Turf
Privacy Policy
Effective July 29, 2026 · Applies to the Turf mobile app and turfxrun.com
The short version: TURF turns your runs into territory. To do that, we store the account
info and activities you share from Strava, the territory and game records built from them, and your
subscription status if you go Pro. Your territory, name, and results are visible to other players —
that's the game. We don't run ads, we don't use advertising trackers, and we never sell your data.
What we collect
- Strava account & activities. When you connect Strava, we receive your athlete ID,
name, and profile photo, plus the activities you've authorized: GPS route, distance, time, date, pace
and split data (including personal bests). New runs arrive automatically via Strava's webhook until you
disconnect. We store the access tokens Strava issues so the connection keeps working.
- Location. Your run routes come from the activities above. With your permission, the
app also uses your device's live location to center the map, and to power race-day features while a
race is active. Live position is processed in real time to run those features and is not used to build
a separate movement history outside your recorded runs.
- Game data we create. Territory shapes and street segments derived from your routes,
claim history, crew membership, race registrations and results, referral/invite connections, coins, and
cosmetic preferences like turf colors.
- Payments. Pro subscriptions are processed by Stripe. Card details go directly to
Stripe and never touch our servers; we keep your subscription status and a Stripe customer reference,
and Stripe may share your name, email, and billing region with us.
- Technical basics. A session cookie to keep you signed in, IP addresses in server
logs for security and rate limiting, and on-device caches so the app loads fast.
How we use it
To run the game: turning runs into territory, resolving who owns what, ranking races, operating crews
and referrals, managing subscriptions, keeping the service secure, and fixing problems. That's it — no
advertising profiles, no data sales, no third-party ad trackers.
What other players can see
TURF is played on a shared world map. Other players can see your display name, profile photo, claimed
territory, crew, race results, and turf styling. Territory outlines are derived from where you actually
run, so claim with that in mind — if a route is private in Strava, it never reaches us.
Services we rely on
- Strava — the source
of your account and activity data, under the permissions you grant.
- Stripe — payment processing
for Pro subscriptions.
- CARTO — serves the map tiles you see; your device requests tiles directly, which
shares your IP address and map viewport with them.
- OpenStreetMap services (Nominatim, OSRM) — our servers send route and territory
coordinates (never your name or account) to label cities and match routes to streets.
- Replit — hosting infrastructure where the service and its database run (United
States).
Retention & deletion
We keep your data while your account is active. Disconnect TURF anytime in your
Strava settings — we stop receiving new
activities immediately. To delete your account and stored data (including territory and activity records),
email us and we'll take care of it.
Your choices
You can ask us for a copy of your data, ask us to correct it, or ask us to delete it — just email. If
you're in a region with formal privacy rights (like the EU/UK), these requests are honored under those
laws.
Children
TURF isn't directed at children under 13, and connecting requires a Strava account, which has its own
minimum-age requirements.
Changes
If this policy changes, we'll update this page and the effective date above.
Contact
Questions or requests: support@turfxrun.com
TURF · turfxrun.com