Legal

Privacy Policy

Last updated: March 2026

This Privacy Policy describes how Strappo (“we”, “us”, “our”) collects, uses, and shares information when you use the Strappo app and related services. It applies to all users, including those in the European Economic Area (EEA) and United Kingdom.

Information We Collect

We collect information you provide directly, including:

  • Account details (name, email via Apple Sign In)
  • Rider profile (weight, FTP, preferred units)
  • Ride data recorded during sessions (power, heart rate, cadence, GPS route, duration)
  • Strava OAuth tokens and activity data, when you choose to connect your Strava account

We also collect device identifiers and diagnostic information to maintain and improve the app.

Strava Data

If you connect your Strava account, we access your Strava activity history solely to import your past routes into Strappo for use in indoor training sessions. Strava data is:

  • Only displayed to you — never shared with other users or third parties
  • Used only to provide features you have explicitly requested (route import, Strava upload)
  • Not used for advertising, sold to third parties, or used to train AI or machine learning models
  • Removed from our systems within 48 hours if you request deletion of your account or disconnect Strava

You can disconnect Strava at any time from within the app or by contacting us at hello@getstrappo.com. Strava’s own Privacy Policy governs data held by Strava.

How We Use Your Data

We use your data to:

  • Provide the core app features: route building, trainer resistance control, AI ride coaching, ghost playback
  • Sync completed rides to Strava (only when you initiate this)
  • Improve the accuracy and performance of the app
  • Respond to your support requests

We do not sell your personal data or ride history. We do not use your data for targeted advertising.

We process your data on the following legal bases:

  • Contract: processing necessary to provide the service you’ve subscribed to
  • Consent: connecting Strava, Apple Health, or other optional integrations
  • Legitimate interests: security, fraud prevention, and improving the app

Third-Party Services

Strappo uses the following third-party services, each governed by their own privacy policy:

  • Strava (optional) — activity import and upload
  • Apple HealthKit (optional) — workout data sync
  • Google Cloud Storage — secure storage of ride files
  • Google Cloud — backend infrastructure

Data Retention

We retain your data for as long as your account is active. Strava API response data is not cached beyond 7 days. If you delete your account, all associated data — including Strava-sourced routes and ride history — is permanently deleted within 48 hours.

Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your account and associated data
  • Port your ride data in a machine-readable format (GPX export)
  • Withdraw consent for optional integrations (Strava, Apple Health) at any time
  • Object to or restrict certain processing

To exercise any of these rights, contact us at hello@getstrappo.com. We will respond within 30 days. For deletion requests involving Strava data, we will act within 48 hours.

Security

We use industry-standard encryption and access controls to protect your data. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

Children

Strappo is not directed at children under 13. We do not knowingly collect personal data from children.

Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via the app or email. Continued use of Strappo after changes constitutes acceptance of the updated policy.

Contact

Questions about this policy or your data: hello@getstrappo.com