Your privacy
Notice version: 2026-09-21. Pilot preparation notice; operator contact and lawful-basis review must be completed before real-user registration opens.
Shaping Up helps adults join walks and runs. Cognito holds your email address and credentials. We store an internal account ID, an adult declaration, your chosen display name and walking/running preferences, activity participation and privacy choices. We do not need your date of birth, home address, health history or continuous location.
Your profile is private by default. If you choose community visibility, signed-in adults can see your display name on activities you join. Organiser names and public meeting points are visible to participants. Search coordinates are used for the current search and are not saved as a history.
Optional activity reminders are off unless you choose them. You can withdraw that choice in your account. Acknowledging this notice is separate from giving consent.
You can edit your profile, download account data, block another user, report a concern or delete your account. Deletion removes the profile and participation records immediately and queues identity-provider deletion. Reports and necessary audit records may remain restricted for reviewed safeguarding or legal purposes. The service is not monitored continuously; use emergency services for immediate danger.
Optional session photos
Photo prototype supplement: 2026-10-14. Synthetic testing only; do not upload real participant photographs yet. The final policy and support contact require review before real photos are accepted.
Sharing a photo is optional. You must have said that you attended, confirm that every identifiable adult agreed to public publication, confirm that no under-18 appears (including bystanders), and have permission to share the image. These declarations and organiser review do not independently verify consent or age.
Your processed image is private to you and the current approved organiser until approved. Approved images can be viewed and saved by anyone, even without an account. We do not publish your account identifier with the photo, but the image itself may identify people or reveal private information. Location and camera metadata are removed; this cannot remove private details visible in the picture.
We store a resized JPEG rather than your original file, together with the minimum upload, declaration and review records. Pending images expire seven days after upload; approved images expire ninety days after upload. You can withdraw a photo and download your available processed image from your account. Changing attendance to “I didn’t make it”, account deletion or loss of eligibility hides affected photos and queues file erasure.
Someone pictured can request removal through the link beside the public photo without signing up, supplying a name or providing identity documents. We hide any available image before attempting erasure. If erasure fails, restricted tracking information remains until removal can be verified. Minimal records are removed thirty days after verified erasure. Copies already saved by others cannot be recalled.
The prototype limits removal requests to control abuse. A reviewed alternative support route, provider retention and backup arrangements must be published before real photographs are accepted. Photo declarations do not replace the separate privacy notice or optional reminder choice.
Operational retention: web sessions expire after seven days or 24 hours of inactivity; expired sessions are removed by maintenance. Security and account audit records have a one-year retention deadline. Safety case retention requires a human decision. Backup expiry, provider retention, access-request contact and complaint details must be approved and published before the pilot.