Velotale Privacy Policy

Last updated: 28 July 2026

Velotale is an iOS app that builds a personal cycling ride history from Apple Fitness (HealthKit), your photo library, and — if you connect it — your Strava account. This policy explains what data the app handles, where it is stored, and your rights under the EU General Data Protection Regulation (GDPR) and UK GDPR.

Who is responsible

Data controller: Velotale (independent developer).
Contact: contact@velotale.app

The short version

Your rides, routes, health metrics, and photos are processed and stored only on your iPhone. Velotale has no user accounts and operates no server-side database of your rides. We do not sell, share, or analyze your personal data, and we do not use it for advertising or AI training.

Data processed on your device only

• Apple Health (HealthKit): outdoor cycling workouts — dates, duration, distance, energy, heart rate, power, elevation, and workout routes. Read with your permission; never leaves your device. HealthKit data is not shared with any third party and is not used for advertising.
• Photos: with your permission, the app matches photos taken during rides to display on ride cards. Matching runs on device; photos never leave your device.
• Strava: if you connect Strava, the app fetches your cycling activities (dates, metrics, routes, and activity photos) via the official Strava API and stores them on your device. Strava responses are cached on device for at most 7 days and refreshed from Strava after that; activities deleted on Strava are removed from the app. Strava data is displayed only to you, is never uploaded to our servers, and is never used for analytics or AI.
• Location: ride route coordinates are reverse-geocoded on device (via Apple's geocoding service) to label rides with place names.

Data our server processes

• Strava sign-in: our server (hosted in the EU) exchanges Strava's authorization codes for access tokens so that the app never holds Strava's client secret. Tokens are passed through to your device and are not stored on the server.
• Feedback messages: if you use "Send Feedback", your message and a random installation identifier are stored on our server so we can reply. No name or email is required.
• Service diagnostics: the server keeps brief technical logs (timestamps and request outcomes only — no IP addresses, no account identifiers, no activity data).

Strava-specific terms

• Velotale uses the Strava API but is not endorsed or certified by Strava. Strava may process API usage data in accordance with the Strava Privacy Policy.
• You can withdraw consent at any time by disconnecting Strava in Settings → Data Sources. Disconnecting immediately and permanently deletes all Strava data and data derived from it from your device, and the app confirms when deletion is complete.
• If you revoke Velotale's access from strava.com, all Strava data is deleted the next time the app runs — cached Strava data expires automatically after 7 days regardless, and 30 days is the guaranteed upper bound.
• You can also request deletion by emailing contact@velotale.app; we will confirm in writing once completed.

Legal bases

We process data with your consent (HealthKit, Photos, and Strava permissions you grant and can revoke at any time) and, for the minimal server functions above, on the basis of our legitimate interest in operating and securing the service (Art. 6(1)(f) GDPR).

Retention

• On-device data stays until you delete rides, disconnect a source, or uninstall the app.
• Strava API responses cached on device expire after 7 days and are re-fetched.
• Feedback messages are kept for as long as needed to handle your request; email us to have them deleted.

Sharing

We do not sell or share personal data with third parties. The only parties that process data are Apple (HealthKit, Photos, geocoding — on device), Strava (when you connect it, under Strava's own policy), and our EU hosting provider (DigitalOcean) for the minimal server functions above.

Your rights

Under GDPR/UK GDPR you have the right to access, rectify, erase, restrict, object to processing of, and port your personal data, and to lodge a complaint with your supervisory authority. Because ride data lives on your device, most of these rights can be exercised directly in the app; for anything else contact contact@velotale.app.

Children

Velotale is not directed at children under 16.

Changes

We will post any changes to this policy on this page and update the date above.