Privacy Policy
Effective October 10, 2026. Plain language, no lawyer voice. If something here is unclear, ask us and we will fix the wording.
1. Who we are
Strut is operated by GeoSource LLC, the data controller for everything described here. This policy covers joinstrut.com and any page on it.
Reach us through the contact form. It is the only contact route we publish.
2. What we collect
When you join the waitlist
- As a walker: your first name, email address, the city or neighbourhood you typed, and the options you tapped (where you would wear a shirt, whether you would walk with friends).
- As a business: your business name, your name, your email address, the options you tapped, and the budget range you picked.
When you send us a message
- Your name, email address, and what you wrote.
Automatically, either way
- The
?src=value on the link you arrived from, so we know which post or flyer sent you. - A one-way SHA-256 hash of your IP address, to catch spam. We do not store your IP address itself and we cannot recover it from the hash.
- Ordinary web server logs, which our host keeps for a short period.
- If, and only if, you accept analytics cookies: the data listed in section 5 under Google Analytics. See the Cookie Policy.
3. What we deliberately do not collect
- Location. None. Not now. When the app launches, location is recorded only while you have started a walk yourself, never in the background and never when the app is closed. That is a product rule, not a preference, and this policy is rewritten before it begins.
- No passwords from you, because there are no public accounts.
- No payment details, because nothing is for sale.
- No advertising trackers, no marketing pixels, no data brokers, no social media tracking.
4. Why we use it, and our legal basis
| Why | Legal basis (UK/EU GDPR) |
|---|---|
| Email you when Strut opens near you | Consent, given when you join the waitlist. Withdraw it any time. |
| Count signups by city so we know where to launch first | Legitimate interests: deciding where to operate a business. |
| Reply to a message you sent us | Legitimate interests: answering someone who contacted us. |
| Block spam and abuse (the hashed IP) | Legitimate interests: keeping the service working. |
| Analytics | Consent, and only consent. Nothing loads until you accept. |
5. Who else touches your data
These are our processors. They act on our instructions under contractual confidentiality and data-protection obligations. Adding one means amending this list the same day.
| Who | What they do | What they see | Where |
|---|---|---|---|
| DigitalOcean | Hosts the server and the database this site runs on. | Everything the site stores, at rest. Today that is the waitlist and contact messages. | United States |
| GoDaddy | Registers the domain and answers DNS lookups for it. | The fact that a lookup happened. No form data ever reaches it. | United States |
| Mailgun (Sinch) | Delivers our reply when you send us a message through the contact form. | Your email address and the contents of the email itself. | United States |
| Google (Google Analytics 4) | Counts visits so we know which cities to launch in first. Loads ONLY after you accept analytics cookies. | A random visitor id, pages viewed, approximate city-level location, device and browser. Never your name or email. | United States |
| Google Fonts | Serves the typeface this site is set in. | Your IP address and browser, as with any file your browser requests. | United States |
We do not sell your personal data, and we do not share it for anyone else's marketing. Advertisers on Strut will never receive your email address.
6. International transfers
Our processors are in the United States. If you are in the UK, the EU or another region with transfer restrictions, your data reaches the US under the standard contractual clauses those providers publish, or under an adequacy decision where one applies.
7. How long we keep it
Waitlist signups: until you ask us to delete it, or until we decide not to launch in your area, whichever comes first. Contact messages: kept while we deal with them and for a reasonable period after, so we have a record of what was said. Server logs: a short rolling window set by our host.
8. Your rights
You can ask us to:
- tell you what we hold about you, and give you a copy;
- correct it if it is wrong;
- delete it;
- restrict or object to how we use it;
- withdraw consent, including for analytics and for the waitlist email.
If you are in the US, depending on your state you also have the right to know, delete, and correct, to opt out of sale or sharing (we do neither), and not to be treated differently for exercising any of these.
9. How to exercise them
Use the contact form and tell us what you want. Send it from the address you signed up with, or tell us which address to look for, so we are not handing your details to somebody else. We will respond within 30 days. You do not have to give a reason, and we will not try to talk you out of it.
If you think we have handled your data badly, you can complain to your data protection authority. In the UK that is the ICO; in the EU, your national authority.
10. Children
This site is not for anyone under 16, and we do not knowingly collect their details. If you believe a child has joined the waitlist, tell us and we will delete the record.
11. Security
The site is served over HTTPS, admin access requires a password and an explicit permission flag, and your IP is hashed rather than stored. We hold no certifications and we are not going to pretend otherwise: no method of transmission or storage is perfectly secure.
12. Changes
If we change this policy we update the effective date at the top. A change that materially affects you, such as the app beginning to collect location, gets an email to everyone on the waitlist before it takes effect.