Privacy

Cookies and browser storage

When you choose a language, Watshoo stores that choice in the watshoo_locale cookie for up to one year. Browser storage also keeps local profile preferences and temporary app state, such as the selected shoe match, on that device.

You can remove cookies and locally stored data through your browser’s site-data settings. This resets local preferences and may sign you out. Clearing browser data does not delete your Watshoo account or data saved on the server; see the deletion instructions below.

Optional community sizing

If you enable sharing in My Sizes and save, your manually entered, first-hand model, EU size, shoe variant, width and fit reports may contribute to size suggestions for other signed-in runners. Sharing is off by default. Other runners receive size suggestions and aggregate counts, including small groups, without your name, email or account ID. We compare saved reports directly; we do not create a separate copy or use Strava data. Turn sharing off and save, remove a report, or request account deletion to remove its contribution from subsequent lookups. Suggestions already viewed may remain on another device until refreshed. You can receive suggestions without contributing.

Controller and account data

Magnus Akselsen, Norway, operates Watshoo as an individual. Contact: privacy@watshoo.com. We process your account ID and email to provide sign-in and support, and the runner profile, sizing, preferences, shoe ownership and reviews you choose to save to provide those features. Account processing is necessary to deliver the service you request; the optional Strava integration is based on consent.

Manual account/profile data is retained while needed to provide your account, until you delete it or request account deletion. Guest preferences may remain in your browser until cleared. Limited technical logs support security and reliability. Merchant and affiliate sites apply their own privacy terms after you follow a purchase link.

Strava data and purposes

• Account linkage: Strava athlete ID, approved scopes, access/refresh tokens and token expiry. These are server-only authorization records used to identify your connection and access your own data.
• My shoes: activity ID, activity date, run type, distance and gear ID; shoe/gear name and distance. These associate your runs with your shoes and show imported mileage.
• Run import: selected activity name, start time, type, distance, elevation, moving/elapsed time and time/distance/altitude/moving streams, with lap distance/time/elevation as a fallback. Route Intelligence calculates distance/elevation deterministically for your selected run. Raw location coordinates, heart rate, watts, cadence and temperature are not retained or requested as streams.

Strava returns fixed response objects for some endpoints. Watshoo immediately discards fields that the feature does not use. We do not send Strava data, derived profiles or route results to AI/LLM services, advertising audiences or other users.

Permissions and consent

We request read (basic public account access) and activity:read (your activities visible to Everyone or Followers). We do not request write access or access to Only You activities. You approve access on Strava. If a required permission is missing, import stops and Watshoo asks you to authorize again. Existing connections with unknown scopes also require renewed authorization.

Maximum seven-day cache

Activity, shoe, mileage and derived Strava caches expire no later than seven days after retrieval. Expired rows are excluded from reads and removed by scheduled cleanup. Run-import results are short-lived browser state; imported Finder results are not stored as durable runner profiles. Tokens and consent records are kept separately as authorization records until disconnect; they are not an activity archive.

Withdraw consent and delete

Choose Disconnect and delete in My shoes, revoke Watshoo in your Strava connected-app settings, or email privacy@watshoo.com. Watshoo removes the connection, tokens, imported usage, gear links, imported shoes and derived caches. Ratings attached to an imported shoe are also removed; independently added manual shoes remain. Disconnect does not delete your Strava account or activities on Strava.

My shoes provides a dated written receipt for deletion from active Watshoo storage. If revocation fails, we show a pending status and retry; we do not claim completion. Contact privacy@watshoo.com for confirmation covering technical backups and other devices. Requests are handled promptly, with full deletion within 30 days at the latest unless a legal retention obligation applies. Data deleted or made private on Strava is invalidated when its webhook arrives, and must cease to be displayed within 48 hours.

Your Strava connected apps

Providers and Strava usage monitoring

Supabase provides account authentication, the database and server functions. The Watshoo database is configured in Ireland (eu-west-1); function execution and technical support may involve other processing locations. Cloudflare hosts and delivers the website through its global network and processes connection/security metadata. Strava supplies the optional integration and acts as a separate controller. Contact privacy@watshoo.com for the current processor and processing-location list, including support email handling.

Strava may monitor and collect API usage data and use it for internal or external business purposes, including improvements, developer/user support and checking compliance with its agreements.

Access and other rights

You may request access, correction, deletion, restriction or portability and withdraw consent by contacting privacy@watshoo.com. You may complain to the Norwegian Data Protection Authority (Datatilsynet). Strava also provides its own activity export and privacy controls.