Last updated 29 August 2026. Rivalo is a small, non-commercial app built by First Wongsrila, Amsterdam.
When you connect Strava we store: your Strava athlete ID, name, profile photo and city; and for each run in roughly the last 28 weeks and onwards: activity ID, name, sport type, start time, moving time, distance, elevation gain and average heart rate. We do not import GPS tracks, routes, photos or any non-running activities.
We compute a weekly Form score from your own activity history, resolve your fixture against another member, and show division tables. Your name, photo and Form score are visible to the other members of your division. Your raw activities are visible only to you.
We never post to Strava, never write to your Strava account, never sell or share your data with third parties, and never use it for advertising. Data from Strava is not combined with other fitness services.
Data controller: First Wongsrila, Amsterdam, the Netherlands — jiraphong.wongsrila@gmail.com. Legal basis under the GDPR is your consent, given when you press Connect with Strava and approve the requested scopes. You can withdraw it at any time (see "Your control").
Data is stored in a Postgres database (Neon) hosted through Vercel. Access tokens are stored server-side only and are used solely to fetch your activities.
Activities are kept while your account is connected, because your Form is computed from your own history. Runs you edit or delete on Strava are updated or removed here within 48 hours (Strava notifies us instantly). Everything is deleted when you disconnect.
Withdraw consent and delete everything: Settings → Strava → Disconnect & delete my data. This revokes Rivalo on Strava and immediately, permanently deletes your imported activities and profile data; you get an on-screen confirmation. Revoking Rivalo at strava.com/settings/apps triggers the same deletion. Or email jiraphong.wongsrila@gmail.com and we delete and confirm within 7 days.
You also have the right to access, correct or export your data, and to complain to the Dutch Autoriteit Persoonsgegevens. Email us for any of these.
Strava data is used under the Strava API Agreement. Strava's own privacy policy applies to your Strava account.