Privacy policy
Last updated
Rozwo is an independent training dashboard built on the Strava API. This page describes exactly what it reads, what it keeps, and who else sees it. It is written against the application’s actual behaviour rather than from a template.
Who is responsible
Rozwo is a personal project operated by Pierre-Loan Janczak, who is the data controller for the purposes of the GDPR. For any question about this policy, or to request erasure, write to [email protected].
What you authorise
Signing in uses Strava’s OAuth 2.0 flow. You authorise on Strava’s own site — Rozwo never sees your Strava password — and grant three scopes:
| Scope | What it allows |
|---|---|
read |
Read your public profile |
activity:read_all |
Read your activities, including those marked private |
profile:read_all |
Read your full profile, including private fields |
You can revoke this authorisation at any time from your Strava settings, or by disconnecting inside Rozwo, which revokes it for you.
What is stored
Strava tokens. Your Strava access and refresh tokens are held server-side in a Redis (Valkey) session with a 24-hour expiry. They are never sent to your browser and never leave the backend.
Your session. A signed session token valid for 15 minutes, plus a refresh token. Neither contains anything beyond your Strava athlete id.
Your activities. For each synced activity: title, date, distance, moving and elapsed time, elevation gain, sport type, average and maximum speed, and — when Strava provides them — cadence, temperature, power, kilojoules, calories, average and maximum heart rate, Strava’s suffer score and your perceived exertion. Per-kilometre splits are stored alongside.
Computed metrics. 7-day and 28-day training load, weekly volumes, acute:chronic ratio, fatigue ratio and 7-day average heart rate, recomputed on each sync.
What you type in. Your athlete passport (practice level, primary and secondary sports, years practising, weekly hours, birth year, and optionally height, resting and maximum heart rate, weekly sessions, annual volume, main objective, injuries, current limitations and free-text notes), your goal races, your per-activity debriefs (perceived exertion and comment) and your ratings of the coaching advice.
Coaching advice. The recommendation, its reasoning, its risk level and its three-day outline, kept so the dashboard can show your history.
Why it is processed
The GDPR requires a legal basis for every processing. There are two here.
Performing the service you asked for (art. 6(1)(b)). Reading your Strava activities, computing your training load, generating coaching advice and keeping what you type in are Rozwo. Connecting your Strava account is the request; none of it happens before you do.
A legitimate interest in keeping the service working (art. 6(1)(f)). Error reports let a bug be found and fixed, and basic protection against abuse keeps the service available. This is limited to what that requires, and you may object to it at any time by writing to [email protected].
There is no advertising, no marketing profiling and no sale of data — which is also why you are not asked to accept cookies: the only browser storage used is what keeps you signed in.
What is sent to the AI provider
Coaching advice is generated by a large language model hosted by Groq, a provider located in the United States. Each request contains exactly this, and nothing else:
- 7-day load (distance, duration, number of activities),
- 28-day load (distance, duration, number of activities),
- weekly volumes,
- fatigue ratio,
- 7-day average heart rate,
- acute:chronic ratio.
The payload carries no identifier: not your athlete id, not your name, not your email address. Your Strava tokens, your activity titles, your GPS traces and the free-text fields of your athlete passport are not part of it either.
Other processors
- Render hosts the application and its PostgreSQL database.
- Sentry receives error reports only — no session recording and no performance tracing — on its European region. An error report can incidentally contain a technical identifier such as your athlete id.
- Strava is the source of the activity data, governed by Strava’s own privacy policy.
Your data is not sold, and it is not used to train any model.
Where your data goes
Two of the providers that hold your data are in the United States: Render, which hosts the application and its database, and Groq, which generates the coaching advice. Your data therefore leaves the European Union.
Those transfers rest on the standard contractual clauses adopted by the European Commission, which form part of the data processing agreement entered into with each — Render’s and Groq’s. Both are published, so you do not have to take my word for it.
Sentry stays in the European Union. The project is on Sentry’s EU region, so error reports are ingested and kept there rather than crossing the Atlantic.
Strava is a different case: that is your own account, governed by Strava’s privacy policy and by the authorisation you granted.
How long it is kept
Session tokens expire after 24 hours of inactivity.
Your activities, metrics, coaching advice and everything you typed in are kept for as long as you use Rozwo, then for 24 months after the last activity synced to your account. Past that the account is treated as dormant and everything attached to it is deleted.
You do not have to wait for that. Disconnecting inside Rozwo revokes the Strava token, ends your session and stops any further sync — but it does not, on its own, delete the rows already stored. To have them erased straight away, write to [email protected] from the address associated with your Strava account, or mention your Strava athlete id; the data is removed and you get confirmation.
Your rights
Under the GDPR you may request access to your data, its correction, its erasure, a portable copy, or object to its processing. One email to [email protected] covers all of them. You may also lodge a complaint with your national supervisory authority — in France, the CNIL.
Cookies
Rozwo sets no advertising or analytics cookies. The only browser storage used is what keeps you signed in.
Changes
Any material change to this policy is reflected in the “last updated” date above, so it is worth glancing at that date from time to time.