Privacy Policy

What we collect

• From Strava: your first and last name as set on your Strava profile, your bikes (name, inferred type like road or gravel, and total distance ridden), and the distance and date of each ride — used to draw your mileage trendline.
• What you enter yourself: maintenance types you track, when you performed them, and any notes you add. Also a few bike details Strava doesn't provide (e.g. whether a bike is set up tubeless), which you answer during setup.
• Your settings: whether you prefer miles or kilometres, the order your bikes are listed in, and your time zone. The time zone is the one thing here Pedalog fills in for you — it's read from your browser the first time you sign in, because "which day did this happen on" has no answer without it. It's never re-read after that, and you can change it yourself under Account.

What we don't collect

• No email address, profile photo, or Strava username/handle.
• No GPS routes, maps, or coordinates — none of the location data Strava attaches to a ride. Your time zone is stored (listed above), and nothing finer-grained than that: no places, no positions, nothing about where a ride went.
• No Strava activity IDs and no activity-type categorization — only the plain distance and date of each ride are kept.
• No payment information — Pedalog doesn't sell anything.
• No analytics or tracking. The only cookies are the ones needed to sign you in and keep you signed in securely — nothing for tracking or analytics.

How it's used

Solely to show your own dashboard: your bikes, their mileage, and whether any tracked maintenance is due. Your Strava data only refreshes when you open the app or tap "Sync" — never while you're not using it.

Who else sees it

Strava, as the source of your ride and gear data — see Strava's own privacy policy for how they handle it. Beyond that, your data only touches the infrastructure providers that host Pedalog and its database, which store and process it purely on Pedalog's behalf and don't use it for anything of their own. Nobody else sees it, and it's never sold or shared.

How it's protected

Traffic between your browser and Pedalog is encrypted, as is the connection between Pedalog and its database. The keys that let Pedalog read your Strava data on your behalf are encrypted before they're stored, using a key kept outside the database entirely — so a copy of the database on its own doesn't give anyone access to your Strava account. There are no analytics and no third-party scripts, and browsers are told to refuse any script that isn't Pedalog's own.

Worth being straight about the limits: this is a personal project run by one person, not an audited system, and no service can promise it will never be breached. The strongest control is the one you hold — revoking Pedalog's access from Strava deletes your account here, and you can do it at any time without asking anyone.

How long it's kept, and deletion

Your data is kept while your account is active. If you revoke Pedalog's access from your Strava settings, your account and everything in it — bikes, rides, maintenance history — is deleted the next time Pedalog tries to sync and finds the connection revoked. Accounts that go untouched for a long stretch (a year or more) are also subject to deletion as a routine safety net, independent of whether Strava access was formally revoked.

Your choices

Delete your account anytime from Account → Delete account once you're signed in — it deletes everything and revokes Pedalog's Strava access in one step. Revoking access from Strava's connected apps settings works too: it deletes your Pedalog account automatically the next time Pedalog attempts a sync. Single bikes can go without the account: archive one from its own page, then delete it under Account → Archived bikes, which removes that bike along with its ride and maintenance history. You can sign out at any time without affecting your data. If you've signed in on a device you no longer have — or think someone else has a copy of your session — Account → Sign out everywhere ends every Pedalog session on every device, including the one you're using. Nothing is deleted by it: sign in with Strava again and everything is where you left it. There's no separate support channel for anything else yet.

Changes

If this policy changes, the date at the top of this page will change with it.