Privacy Policy

When you press "Connect with Strava" you authorise RunMirror with two read-only scopes: read and activity:read_all. The second one includes activities you have marked private on Strava, because the reveal is built from your whole history. We never write to Strava. With that authorisation we fetch and store:

• Your athlete profile — Strava ID, first and last name, city, state, country, and the URL of your Strava profile photo (shown back to you in the header).
• Your runs — for every run: name, description, sport type, start time, distance, moving and elapsed time, elevation gain, average speed, average and maximum heart rate, cadence, calories, workout type, starting coordinates, gear, and Strava's PR count. Rides, walks and other sports are not stored.
• Run detail, for runs that have been "enriched" — the route (Strava's summary polyline plus GPS, altitude, distance, time, speed, heart-rate and temperature streams, each reduced to at most 500 points), best-effort splits (5K, 10K, half, marathon), the URL of the run's primary photo (stored, not currently displayed), and per-mile splits for marathons.
• Your gear — shoe names and the distance logged on each.
• Your clubs — the name, location, sport, member count and logo of Strava clubs you belong to. We do not fetch or store any other member's data.
• Access tokens — the OAuth tokens Strava issues so we can sync on your behalf. They are stored server-side and in HTTP-only cookies; they are never exposed to the browser or to anyone else.

You can also upload your own Strava bulk-export CSV. It is shown only to you, like everything else here, but because it is your own copy rather than API data it is kept until you delete it (see Retention below), not purged after 7 days.

• Your persona: the narrative identity document, rituals, dedications (names found in your run titles), milestones, personality traits and yearly summaries.
• Personal records by distance, and the race and long-run analyses (splits, fade, aerobic decoupling).
• Pacing plans for the courses in the Mile Planner, and any race date or fuel cadence you set.
• Weather for each enriched run (temperature, wind, conditions) and a place name for where it started.
• Any custom rituals you define, and confirmations you give.

All of this is computed by fixed, rule-based code running on our own servers. No Strava data, and nothing derived from it, is ever sent to any artificial-intelligence or language-model service.

• Login timestamps and which RunMirror pages you open, so we can tell whether the service is being used. This is a Strava ID and a time; no run content.
• Feedback you leave through the thumbs-up widget or the bug form.
• If you donate: the email address and display name you enter on the Support page, and whether you chose to appear on the supporters wall. Card details go directly to Stripe; we never see them.
• If you share a referral link: which athlete connected through it.

These services process data on our behalf. Each receives only what is listed.

• Supabase (database hosting, USA) — stores everything above.
• Vercel (application hosting, USA) — runs the site. Vercel Analytics and Speed Insights record page URLs and performance timings without cookies and without any Strava content.
• Open-Meteo (weather) — receives the starting coordinates and date of each enriched run to look up historical weather. No name, ID or other identifier is sent.
• BigDataCloud (reverse geocoding) — receives the starting coordinates of each enriched run to look up a city and region. No identifier is sent; results are cached by coordinates rounded to about 100 m so the same spot is not looked up twice.
• Stripe (payments) — only if you choose to donate, and only on Stripe's own pages.

We do not disclose your data to anyone else, except where the law requires it. We can provide a current list of processors to Strava on request, as the Strava API Policy requires.

• Data fetched through the Strava API is kept for at most seven days. A nightly job deletes any run, route, heart-rate stream, split, weather or place-name record that we fetched more than seven days earlier. When you come back after that, RunMirror re-reads your most recent runs from Strava right away and the rest of your run list over the following hours, spread out to respect Strava's rate limits. Strava's API Policy §6.2 requires this window.
• Runs you upload yourself from Strava's bulk export are your own data, not API cache, and are kept until you delete them.
• What RunMirror derives — your persona, personal records, milestones, rituals and race plans — is RunMirror's own output and is kept while your connection is active, so your reveal is there when you come back. It is recomputed on each refresh.
• If you delete a run on Strava, or change it to a non-running sport, Strava notifies us and we remove it and everything derived from it immediately (Strava requires within 48 hours).
• If you disconnect RunMirror in your Strava settings, Strava notifies us and we delete every row about you automatically, at once.
• If you press "Delete my RunMirror data" on the Account page, we revoke our own access on Strava and delete every row about you immediately.
• If Strava ends our API access, we delete all Strava data and everything derived from it within 30 days.
• The coordinate-to-place-name cache contains no identifier, and entries older than seven days are deleted with everything else.

Wherever you live, and specifically under the GDPR and UK GDPR, you can:

• See everything we hold about you — it is what the app shows you, and you can ask us for a copy.
• Correct it — most fields come from Strava, so edit them there and we sync the change.
• Delete it — instantly, from the Account page, or by disconnecting on Strava, or by emailing us.
• Take it with you — Strava’s bulk export gives you all of your original data, free of charge.
• Object to or restrict processing, and withdraw consent at any time by disconnecting.
• Complain to your local data-protection authority.

Our legal basis is your consent, given when you authorise RunMirror on Strava, and our legitimate interest in keeping the service secure and working. Your data is stored in the United States; if you are in the EEA or UK, that is an international transfer, made on the basis of your explicit consent when you connect.