Privacy Policy

Last updated: 31 March 2026

Velorific ("the app", "we", "us") is operated by Adam Elston. This privacy policy explains how we collect, use, store, and protect your data when you use the Velorific application.

1. Data We Collect

Data you provide directly

• Meal logs (food descriptions, calorie and macronutrient values)
• Body weight entries
• Daily nutrition goals and preferences
• Favourite meals

Data from Strava (with your permission)

When you connect your Strava account, we access the following data via the Strava API:

• Activity name
• Activity date
• Calories burned
• Duration (moving time)
• Effort score (relative effort / suffer score)

We request the activity:read_all scope, which gives read-only access to your activities. We do not access your Strava profile, GPS data, routes, segments, photos, social data, or any other athlete's data.

Data from TrainingPeaks (optional)

If you provide a TrainingPeaks iCal URL, we fetch your planned training sessions (title, duration, and type only) to estimate daily training load before your actual workout syncs from Strava.

2. How We Collect Data

• Manual entry: Meals, weight, and goals are entered by you directly in the app.
• Strava OAuth: You explicitly authorise access to your Strava data through Strava's standard OAuth flow. We receive an access token and refresh token to fetch your activities.
• Strava webhook: After you connect, Strava sends us notifications when you complete, update, or delete an activity. We use these to keep your data in sync.
• TrainingPeaks iCal: Your planned sessions are fetched from a private iCal URL you provide.

3. How We Use Your Data

Your data is used solely to provide the core functionality of the app:

• Calculating your daily calorie and macronutrient targets based on your training load
• Displaying your meals, workouts, and progress
• Adjusting your deficit based on weight trends

We do not use your data for advertising, marketing, analytics, profiling, AI/ML model training, or any purpose other than providing the app's features to you.

4. Data Sharing

We do not sell, license, lease, or share your data with any third party. Your data is only visible to you.

The sole exception is when you use the AI-powered food analysis feature: the text description of your meal (not your Strava data or personal information) is sent to the Anthropic API for macronutrient estimation.

5. Data Storage and Retention

• Your data is stored in encrypted form on secured servers.
• Raw Strava activity data is cached for a maximum of 7 days, after which it is automatically purged. Only derived daily summaries (total calories, duration, and training load per day) are retained beyond this period.
• Strava OAuth tokens are stored securely and are deleted when you disconnect Strava or revoke access.
• Data you enter manually (meals, weight, goals) is retained for as long as you use the app, or until you request deletion.

6. Strava API Compliance

Our use of the Strava API is governed by the Strava API Agreement. In accordance with this agreement:

• We only display your own Strava data to you. We never display another user's Strava data.
• We do not use Strava data for AI, machine learning, or model training.
• We do not use Strava data in advertisements.
• We do not modify Strava data before displaying it.
• We respect your Strava privacy settings.
• If you delete an activity on Strava, we remove it from our system automatically via webhook, typically within minutes.
• Strava may collect and use data related to our access to the Strava API for its own business purposes, as described in the Strava Privacy Policy.

7. Withdrawing Consent

You can withdraw your consent for Strava data access at any time by:

• Tapping "Disconnect Strava" in the app's Settings — this revokes access and deletes all Strava data from the app.
• Revoking Velorific's access from your Strava connected apps page — we will receive a webhook notification and automatically delete your Strava data.

8. Requesting Data Deletion

You have the right to request deletion of all your data at any time. To do so:

• Email adam@velorific.com with the subject "Data deletion request."
• We will delete all data associated with your account and confirm deletion by email.

If you disconnect Strava (via the app or via Strava's settings), all Strava-sourced data is deleted automatically.

9. Your Rights (GDPR / UK GDPR)

If you are in the UK or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:

• Access: You can request a copy of the data we hold about you.
• Rectification: You can request correction of inaccurate data.
• Erasure: You can request deletion of your data.
• Restriction: You can request that we restrict processing of your data.
• Portability: You can request your data in a portable format.
• Objection: You can object to processing of your data.

To exercise any of these rights, email adam@velorific.com.

Our lawful basis for processing your data is your explicit consent (provided when you create an account and connect Strava).

10. Data Security

We use commercially reasonable administrative, technical, and organisational measures to protect your data, including:

• Encrypted data transmission (HTTPS)
• Restricted file permissions for stored credentials
• Rolling database backups
• Atomic write operations to prevent data corruption

In the event of a data breach affecting your personal data, we will notify you and Strava within 24 hours of discovery.

11. Children's Privacy

Velorific is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors.

12. Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page will reflect the most recent revision. Continued use of the app after changes constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions or requests:

Adam Elston
Email: adam@velorific.com