Privacy Policy

This Privacy Policy explains how Surrey Cycling Club Limited ("we", "us") processes personal data when you use our training analytics platform ("the Platform"). The Platform is available to Surrey Cycling Club members.

1. Data controller and Strava

Surrey Cycling Club Limited is the data controller for personal data you provide directly to us.

Where personal data is supplied via Strava, we and Strava may act as joint controllers for that data, in line with Strava's terms and UK GDPR. Strava authenticates your login; we do not store your Strava password.

Contact: [email protected] (include "Personal Data Request" in the subject line for faster handling).

Support for this Platform is provided by Surrey Cycling Club Limited, not by Strava. For Strava account, billing, or Strava app issues, contact Strava support. For help with this Platform, see our Support page or email us.

2. Read-only Strava access

We request read-only Strava permissions to download activities and profile fields. We do not write to, edit, or delete anything on your Strava account. We store and analyse copies on our Platform only.

3. Information we collect

• From Strava (with your consent via OAuth): name, profile image, athlete ID, activities, power, heart rate, distance, elevation, and related metrics. Health-related fields (for example heart rate, weight, or age from Strava) are only processed if Strava shares them under your Strava settings.
• From you on the Platform:
  • Email address: used for account identification and future email notifications about your training (for example weekly summaries or goal milestones). We do not share your email with third parties.
  • Year of birth: used to calculate age-adjusted training metrics such as heart rate zones.
  • Height and weight: used to calculate power to weight ratios, estimated metrics, and body-related training analysis.
  • Sex: used for physiological calculations where male and female reference ranges differ.
  • Goals and training preferences: used to personalise your dashboard, coaching, and training recommendations.
• Platform data you create: goals and notes linked to your profile.
• Technical data: session cookies, sync logs, IP address in server logs, and diagnostics needed to secure and operate the service.
• Website usage (Plausible): anonymised page views, referrer, and outbound link clicks collected by our self-hosted Plausible analytics. Plausible does not use cookies and does not store analytics data in your browser.

We do not collect special category data directly from you beyond health-related metrics received from Strava where you have allowed Strava to share them.

4. How we use your data

• Provide performance analysis, dashboards, and goals.
• Estimate metrics such as eFTP, training load, and heart rate context using our own analytics on our infrastructure.
• Improve the Platform and develop new analysis features.
• Respond to support requests and secure the service.

Legal bases include performance of our service to you, legitimate interests in improving the Platform, and consent where required (for example Strava OAuth).

5. Strava data and artificial intelligence

We do not send Strava activity or profile data to artificial intelligence services, large language model providers, or machine learning model developers.

We do not use Strava data to train, fine-tune, evaluate, or operate any artificial intelligence or machine learning system. This follows Strava's API Agreement and API Policy (effective June 2026), which restrict use of Strava data in connection with AI applications.

Analytics on the Platform (including eFTP, training load, and club comparisons) are produced by our own software from the copy of your data we store after sync. They are not generated by third-party AI services.

6. Who can access your data

Your detailed activity data and profile information on the Platform are private. Only the following can access them, and only as described here.

No other members. Other club members cannot see your detailed activity data or profile information on the Platform.

Surrey Cycling Club Limited: Authorised staff and contractors may access databases and infrastructure only to operate, secure, and improve the Platform. Access is limited to what is needed to keep the Platform running and your data safe.

Third-party processors: Hosting providers and Strava process data under contract and their terms. We do not sell personal data and we do not use processors that apply Strava data for artificial intelligence purposes.

Website analytics: We run a self-hosted Plausible Analytics installation on infrastructure we control. It receives anonymised page view events only (for example page URL, referrer, and browser type). Plausible is cookieless and does not profile you across other websites.

7. Club comparisons

You may appear in aggregated club rankings (for example monthly riding or power) as a position or rank, not with your full activity details exposed to others. Club leaderboard visibility is off by default. You can opt in or out from your Profile at any time.

8. International transfers

Data is primarily processed in the UK. Some processors may process data outside the UK. Where required, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

9. Retention, erasure, and your rights

From your Profile you may:

• Wipe data: delete synced activities and training data we hold while keeping your account.
• Wipe & disconnect: delete your Platform data and revoke this app's Strava access.

Automatic deletion on club removal

If you leave Surrey Cycling Club or are removed from the club on Strava, the Platform will automatically and immediately:

• Deauthorise this app's connection to your Strava account.
• Delete all synced activities, training analytics, goals, coaching data, and profile information.
• Remove your member record from the Platform entirely.

There is no grace period. This happens as soon as the Platform detects you are no longer a club member. If you rejoin the club on Strava, you may sign in again and start fresh, but previously stored data cannot be recovered.

We retain data while your account is active and as needed for legal, security, or operational purposes. When no longer needed, we delete or anonymise it securely.

Under UK GDPR you may have rights to access, rectify, erase, restrict, object, and data portability. Contact [email protected]. You may complain to the Information Commissioner's Office (ICO).

10. Cookies and website analytics

We use essential session cookies to keep you signed in and to complete Strava OAuth. These are required for the Platform to work.

We use a self-hosted Plausible Analytics installation to understand how the Platform is used (for example which pages are visited and when outbound links are clicked). Plausible is privacy-friendly analytics: it does not install or store analytics cookies on your device and it does not use cross-site tracking.

We do not use advertising cookies or third-party marketing trackers on the Platform.

11. Security

We use access controls, encryption in transit, and secured hosting. No service is completely secure; protect your Strava credentials and report suspected misuse.

12. Accuracy disclaimer

Analytics estimates and calculations may be wrong or incomplete. Do not rely on them as medical or professional advice. Report concerns to [email protected].

13. Changes

We may update this Privacy Policy. The "Last updated" date will change when we do. Please review this page regularly.

14. Contact

[email protected]