We're building a small non-commercial Telegram bot for our running club (~200 members). Each member connects via OAuth (read,activity:read); we verify club membership via /athlete/clubs at connect and daily. New activities are posted to the club's private Telegram group, along with daily/weekly/monthly summaries and a distance leaderboard, all marked "Powered by Strava". No AI, ads, analytics or intermediaries; everything is deleted on disconnect or revoke.
Under the June 2026 API Policy we're unsure about four points:
1. §2.3 says a user's data may be shown only to that user, but §6.1 applies that limit only to apps with an athlete capacity above 9,999. Can a Standard-tier app show members' activities and a leaderboard to the rest of the club's group?
2. §6.2 allows a 7-day cache and otherwise says "you may not store Strava Data". Weekly and monthly summaries need older activities. Is storing activities while the athlete stays connected acceptable, and how do other club/leaderboard apps handle this?
3. The developer account has a subscription. Can athletes with free Strava accounts connect?
4. §4.4 requires Garmin attribution when an app displays information derived from Garmin-sourced data. Does that apply to activities recorded on a Garmin device and synced through Strava, and what form is accepted (e.g. a text line in the post)?
Has anyone received an official answer on these, or passed app review with a similar use case?
