Privacy policy
The short version
- Kapacity has read-only access to your Strava activities. It never posts, edits or deletes anything on Strava.
- We never keep Strava data for more than 7 days. Your activity list is re-read from Strava when you visit, and a scheduled job deletes anything older.
- If you disconnect, we delete your account and everything we hold for you within 48 hours — in practice, immediately.
- We do not connect to wearables or collect health data from any other source, we do not sell or share your data, and we never use Strava data to train AI or machine-learning models.
What Kapacity accesses
When you choose "Connect with Strava", Strava asks you to grant Kapacity the activity:read_all permission. It lets us read your activities, including ones you've marked "Only You", so we can compare them for you. We request no other permission and no write access.
What we store, and for how long
| Data | Why | How long |
|---|---|---|
| Your Strava athlete ID | To recognise your account. | Until you disconnect. |
| Strava access tokens, encrypted (AES-256-GCM) | To read your activities on your behalf. | Until you disconnect or revoke access in Strava. |
| Your settings and choices: units, displayed sport, the distance you're training for, saved comparisons (the distance or range you picked, never a list of activities), and your plan | To remember how you use Kapacity. | Until you disconnect. |
| Activity summaries from Strava: name, sport, date and time, distance, moving and elapsed time, elevation gain, average and maximum speed, heart rate, power, cadence and energy (kJ) where recorded, race flag, and private flag | To find and compare activities at a distance. | Refreshed after 5 days; deleted no later than 7 days after we read it. |
| Activity detail, only for activities you select in a comparison: splits, best efforts, segment efforts, and time series of distance, altitude, speed, grade, heart rate and power | To draw splits, power curves and climb comparisons. | Refreshed after 5 days; deleted no later than 7 days after we read it. |
We do not store your name, email address, profile photo, followers, gear, photos, maps or GPS coordinates. Heart rate appears above only because you recorded it in your Strava activities; we use it solely to show it back to you, and it is deleted within 7 days like all other Strava data.
Our hosting provider keeps standard server logs (IP address, time and requested address) for 7 days for security and reliability. Our application never writes your Strava tokens, activity names or measurements to its logs; it may log activity ID numbers when troubleshooting Strava notifications.
How we use it
- Only to show you comparisons of your own activities. Your Strava data is never shown to anyone else.
- We don't sell, rent or share your data, show advertising, or build profiles of you.
- We don't use Strava data — or anything derived from it — to train or improve artificial-intelligence or machine-learning models, and we don't give it to anyone who would.
- "Download image" creates a picture of a comparison in your own browser. We don't store it, host it or post it anywhere; where it goes is up to you.
- "Download spreadsheet" (Kapacity Pro) creates an Excel file of a comparison when you ask for it and sends it only to you. We don't keep a copy; once saved, the file is on your device and yours to manage.
Who else is involved
- Strava, the source of your activity data, under your Strava account's own terms and privacy settings.
- Render, which hosts our servers and database.
- Netfirms, which hosts our email. If you write to support@kapacity.tech, your message and email address are stored there so we can answer you.
- Paddle, if you buy Kapacity Pro. It acts as the merchant of record and handles your payment details; we never receive your card number.
Cookies
We use one strictly necessary cookie to keep you signed in (30 days), and a short-lived cookie during "Connect with Strava" to protect the sign-in (10 minutes). If you choose Skip on the dashboard tour, a cookie hides it until you close your browser. Your browser also remembers whether the mile-by-mile grid shows heart rate and elevation; that setting stays in your browser and is never sent to us. No analytics, advertising or tracking cookies.
Disconnecting and deletion
You can disconnect at any time from Settings → Disconnect Strava and delete my data, or by revoking Kapacity in your Strava settings under "My Apps". Either way, we delete your tokens, your account, your settings and every cached piece of Strava data within 48 hours. In practice this happens immediately; a scheduled job retries automatically if anything fails. Activities you delete on Strava are removed from Kapacity when Strava notifies us, and in any case within 7 days.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, or to object to or restrict how we use it. Because we keep so little, disconnecting deletes almost everything at once. For any request, or a complaint, contact us at support@kapacity.tech. You may also complain to your local data-protection authority.
Security
All traffic uses HTTPS. Strava tokens are encrypted at rest, and access to production systems is restricted.
Children
Kapacity is not directed at children under 16, and we don't knowingly hold their data.
Changes
If we change this policy, we'll update the date above and, for significant changes, tell you in the app before they take effect.
Strava
Kapacity uses the Strava API but is not developed, sponsored or endorsed by Strava.