Privacy policy

When you connect Strava we read, with the scopes read,activity:read_all: your Strava athlete ID, your name and your city; and for each run (Run, Trail Run, Virtual Run only) its activity ID, name, start time, moving time, distance, elevation gain and average heart rate.

We do not import GPS tracks, routes, photos, comments, kudos, segments or any non-running activity, and we never ask for write access — Rivalo cannot post to or change anything on your Strava account.

Runs are deleted after 7 days. Strava's API Policy allows an app to hold Strava data as a cache for seven days, and a nightly job enforces exactly that. Nothing you did more than 7 days ago exists here as Strava data.

What we keep beyond that is not your Strava data but our own arithmetic, computed once when a run arrives: minutes and training load per week for 26 weeks, and one rolling median pace per sport. Those numbers carry no activity ID, name, date, distance, duration or heart rate — a run is identified internally only by a keyed hash, so an edit or deletion on Strava can still be applied. They exist because Form compares this week to your own 26-week baseline, and they are deleted the moment you disconnect.

Runs you edit or delete on Strava are updated or removed here within 48 hours — normally within a minute, over Strava's webhook.

Your runs are visible only to you. The other nine runners in your division see your name and your weekly Form score, and nothing else: no distances, paces, times, run names, heart rates or maps. You agree to that specifically, on the connect screen, before we contact Strava at all — it is a separate tick, and the app does not work without it because the whole point is a fixture against someone.

We do not display anyone else's Strava data to you either. Your opponent's Form is a number Rivalo computed, not data we took from their Strava account and handed to you.

No admin, including the author, can browse your runs, your baseline or your Form. There is no impersonation tool and no per-athlete admin view.

We never post to Strava. We never sell, licence, rent or share your data with third parties. We never use it for advertising or targeting. We never use it — or anything derived from it — to train, fine-tune, ground, evaluate or operate any AI or machine-learning system. We do not combine it with data from other fitness services. We run no analytics or profiling on it beyond computing your own Form.

Data controller: First Wongsrila, Amsterdam, the Netherlands — jiraphong.wongsrila@gmail.com. Legal basis under the GDPR is your consent, given on the connect screen and again on Strava's own authorisation screen. You can withdraw it at any time (see "Your control"). If what we collect ever changes, we ask you again before it takes effect.

A Postgres database (Neon) hosted through Vercel, in the EU. Access tokens are stored server-side only and are used solely to fetch your runs. Our processors are Vercel (hosting) and Neon (database); no one else receives your data.

Strava may collect and use data about how Rivalo uses the Strava API.

See everything we hold: Settings → Your data → Download my data, any time.

Withdraw consent and delete everything: Settings → Danger zone → Disconnect & delete my data. This revokes Rivalo on Strava and immediately, permanently deletes your cached runs, your weekly loads and pace medians, your Form and week-result history, and your profile. You get a written confirmation on screen which you can download. Revoking Rivalo at strava.com/settings/apps triggers exactly the same deletion. Or email us and we delete and confirm within 7 days.

What survives a deletion is the league record — the points, wins and results of fixtures that were already played — with your entry anonymised to "Former runner", so other people's finished seasons keep their shape. Those are Rivalo's own match outcomes, not your Strava data.

You also have the right to access, correct, export or restrict processing of your data, and to complain to the Dutch Autoriteit Persoonsgegevens. Email us for any of these.

Your full Strava history always remains yours on Strava, including through Strava's own bulk export.

Strava data is used under the Strava API Agreement and API Policy. Strava's own privacy policy applies to your Strava account and controls in the event of any conflict with this one. Rivalo is not affiliated with, endorsed or sponsored by Strava.

Rivalo is not directed to children under 16 and we do not knowingly collect their data.