Data and Privacy Notes
Race Trace Explorer connects to Strava only after the athlete approves access through Strava OAuth. This page describes the prototype data handling rules that should become the basis for a lawyer-reviewed privacy policy before client launch.
Data Collected
We request the Strava scopes `read` and `activity:read_all`. The app may read activity names, IDs, dates, sport types, distance, moving time, speed, elevation, visibility, route summary, route streams, and activities marked Only You when the athlete grants that access.
Collection Method
Data is collected through Strava's official API after OAuth authorization. The Strava client secret stays on the server and is never exposed in the browser.
Use
Strava activity data is used only to let the authenticated athlete select and analyze their own race trace. The app should not disclose one athlete's Strava data to another user.
Restricted Uses
Strava activity data should not be used for AI or ML training, fine-tuning, grounding, evaluation, embeddings, product analytics, aggregated insights, advertising, resale, or unrelated third-party disclosure.
Storage
This local prototype stores the Strava session in an encrypted HTTP-only cookie. Before production, any server-side storage should be limited to what the product needs, protected appropriately, and deleted when it is no longer needed.
Withdrawal and Deletion
Athletes can disconnect from the app, which revokes Strava access and clears the local session. Athletes can also revoke access from their Strava account settings. Production support must provide a clear deletion request path and written confirmation when deletion is complete.
Support Contact
Add your support email before launch so athletes can request help, data access, or deletion. For example: support@example.com.