Before submitting our app I want to confirm our use case is acceptable.
My App is a private, invite-only fitness challenge for a closed group of friends (~20-30 people). Members connect Strava (~80%) so their own running/cycling/swimming activities are imported, and the app shows a shared group ranking. The rest adds data on their own. This means one member's activity data (distance, elevation, title, plus a "View on Strava" link) is visible to the other members of their private group.
To respect athlete privacy, every member gives explicit, informed in-app consent before connecting Strava, they actively agree that their activities may be displayed to the other members of their group. The app is not public, data is never shared outside the group or with any third party, is never used for AI/ML, and is stored on a server in Germany. Members can disconnect at any time, which deletes their tokens and imported activities.
My question: is this consented, closed-group display of member activity data acceptable under the API Policy, given the explicit per-athlete consent? If not in its current form, what would you need us to change? We'd rather align before submitting than guess.