Strava data

Strava data and purposes

• Account linkage: Strava athlete ID, approved scopes, access/refresh tokens and token expiry. These are server-only authorization records used to identify your connection and access your own data.
• My shoes: activity ID, activity date, run type, distance and gear ID; shoe/gear name and distance. These associate your runs with your shoes and show imported mileage.
• Run import: selected activity name, start time, type, distance, elevation, moving/elapsed time and time/distance/altitude/moving streams, with lap distance/time/elevation as a fallback. Route Intelligence calculates distance/elevation deterministically for your selected run. Raw location coordinates, heart rate, watts, cadence and temperature are not retained or requested as streams.

Strava returns fixed response objects for some endpoints. Watshoo immediately discards fields that the feature does not use. We do not send Strava data, derived profiles or route results to AI/LLM services, advertising audiences or other users.

Permissions and consent

We request read (basic public account access) and activity:read (your activities visible to Everyone or Followers). We do not request write access or access to Only You activities. You approve access on Strava. If a required permission is missing, import stops and Watshoo asks you to authorize again. Existing connections with unknown scopes also require renewed authorization.

Maximum seven-day cache

Activity, shoe, mileage and derived Strava caches expire no later than seven days after retrieval. Expired rows are excluded from reads and removed by scheduled cleanup. Run-import results are short-lived browser state; imported Finder results are not stored as durable runner profiles. Tokens and consent records are kept separately as authorization records until disconnect; they are not an activity archive.

Withdraw consent and delete

Choose Disconnect and delete in My shoes, revoke Watshoo in your Strava connected-app settings, or email privacy@watshoo.com. Watshoo removes the connection, tokens, imported usage, gear links, imported shoes and derived caches. Ratings attached to an imported shoe are also removed; independently added manual shoes remain. Disconnect does not delete your Strava account or activities on Strava.

My shoes provides a dated written receipt for deletion from active Watshoo storage. If revocation fails, we show a pending status and retry; we do not claim completion. Contact privacy@watshoo.com for confirmation covering technical backups and other devices. Requests are handled promptly, with full deletion within 30 days at the latest unless a legal retention obligation applies. Data deleted or made private on Strava is invalidated when its webhook arrives, and must cease to be displayed within 48 hours.

Your Strava connected apps

Providers and Strava usage monitoring

Supabase provides account authentication, the database and server functions. The Watshoo database is configured in Ireland (eu-west-1); function execution and technical support may involve other processing locations. Cloudflare hosts and delivers the website through its global network and processes connection/security metadata. Strava supplies the optional integration and acts as a separate controller. Contact privacy@watshoo.com for the current processor and processing-location list, including support email handling.

Strava may monitor and collect API usage data and use it for internal or external business purposes, including improvements, developer/user support and checking compliance with its agreements.

Access and other rights

You may request access, correction, deletion, restriction or portability and withdraw consent by contacting privacy@watshoo.com. You may complain to the Norwegian Data Protection Authority (Datatilsynet). Strava also provides its own activity export and privacy controls.