VelocityStack

Privacy Policy

Last updated:

This Privacy Policy explains what personal data VelocityStack ("we", "us", "the Service", at velocity-stack.app) collects, why, who sees it, and what rights you have. Please also read our Terms of Service.

Draft notice: this text describes how the Service works today. It is a draft prepared for the operator and is not legal advice; it should be reviewed before being relied on.

1. Who is responsible

The controller of your personal data is Jan Kolář, an individual based in the Czech Republic, who operates VelocityStack. Contact for all privacy questions and requests: koli440@gmail.com.

2. Data we collect

Account data

  • Your email address and a password (stored only as a hash by our authentication provider, never in readable form).
  • Your name or nickname. If you sign in with Google we receive your Google name and email address, and nothing else is used (see section 8). We do not copy your Google profile photo.
  • Optional profile details you add: a profile photo you upload yourself, home velodrome, default gearing, crank length, ride type and display preferences.

Training data

  • Activity files you upload (FIT files) and rides imported from Strava, Intervals.icu, Wahoo or Garmin, with the metrics we derive from them: power, speed, cadence, heart rate and other sensor streams, distance, time, curves, training load and similar telemetry.
  • Location data: activities may contain GPS coordinates and routes. They are shown on maps in the app. You can set a privacy zone around your home so that other riders see the route masked inside that zone.
  • Health-related data: heart rate and other physiological measurements, weight, FTP and other threshold values (for example lactate thresholds) and the power zones derived from them.
  • Gear, templates and run results, personal bests, aero tests, planned workouts, calendar notes and races, comments, photos you attach to rides, and the feedback or bug reports you send us.

Relationship and activity data

  • Who you follow and who follows you, blocks, coaching invitations and relationships, and in-app notifications about them.

Technical data

  • Your session (see section 11), basic server logs kept by our hosting and database providers (such as IP address, browser type and time of request), and a record of the edits a coach makes to your settings.

We do not collect payment data. The "Buy me a coffee" button is a link to an external service.

3. Why we use your data and on what legal basis

  • To provide the Service (contract, GDPR Art. 6(1)(b)): creating and securing your account, importing and analysing your rides, showing your data to you, running templates, planning, notifications.
  • Legitimate interests (Art. 6(1)(f)): keeping the Service secure, preventing abuse, fixing bugs, rate-limiting integrations, and basic service statistics. We balance these interests against your rights and do not use your data for advertising.
  • Consent (Art. 6(1)(a)) and explicit consent (Art. 9(2)(a)): heart rate, weight, thresholds and similar measurements can reveal information about your health, which is a special category of data. We process it only to provide the features you use, on the basis of your explicit consent, which you give by uploading or connecting that data and by using these features. Sharing your data with a coach is likewise based on your explicit consent: it only happens after you accept a coaching relationship. You can withdraw consent at any time (see section 13); withdrawing does not affect processing done before.
  • Legal obligations (Art. 6(1)(c)): where the law requires us to keep or disclose data.

4. Who can see your data

  • You see all of your own data.
  • Other riders: only the activities and profile details that the Service shows to other riders (for example to followers), with privacy-zone areas masked. A rider can require approval for new followers. Your raw GPS files, connection keys and email address are never shown to other riders.
  • Comments and public profile: your name, profile photo and the comments you write are visible to the riders who can see the related ride or profile.
  • Administrators of the Service can access data where needed to operate the Service, handle your requests, moderate content and fix problems.

5. Coaching

Coaching works only with your consent.

  • A coaching relationship starts only after the rider accepts. Either side can send the invitation; accepting it (or requesting a coach yourself) is your consent. A rider has at most one active coach at a time.
  • Only after you approve, your coach can see your training data, including private activities, curves, templates, personal bests, calendar and settings. Privacy-zone areas stay masked on maps, and your email address, connection keys and raw GPS files are never visible to your coach.
  • Your coach can change only your training settings (FTP, weight, thresholds, power zones, training defaults) and your planned workouts, races and calendar notes. Every such edit is labelled "set by coach", recorded in an audit list, and you are notified.
  • You can end coaching or block a coach at any time and access stops immediately. A coach can also leave. Data that a coach created for you (for example planned workouts) stays in your account.
  • If you are a coach, you are responsible for handling the athlete's data you can see confidentially and only for coaching that athlete.

6. Integrations (Strava, Intervals.icu, Wahoo and Garmin)

Integrations start only when you connect them under Settings, Connections.

  • Strava: you authorise us through Strava's own login (permission to read your activities). We import your rides and activity data (streams such as power, heart rate and GPS, and basic ride details) and store the access tokens on our servers. Strava notifies us of new rides so we can import them.
  • Intervals.icu: you give us your athlete ID and API key. We import your rides and, if you use the feature, push planned workouts to your Intervals.icu calendar. The key is stored write-only and is not readable from your browser. It is never visible to other riders or coaches.
  • Wahoo: you authorise us through Wahoo's own login. We import your rides recorded on Wahoo devices (with their .fit files) and, if you use the feature, push planned workouts to your Wahoo calendar. Wahoo notifies us of new rides so we can import them. We store the access tokens on our servers.
  • Garmin: you authorise us through Garmin Connect's own login (Garmin Connect Developer Program). We use your Garmin data only to provide the features you switch on: (1) importing activities you record after connecting (the activity file with its sensor data, such as power, heart rate, cadence, speed, time and, where recorded, GPS and strength-training sets) so they appear in your training log and analysis, and (2) sending your planned workouts to your Garmin calendar. Garmin sends us new activities and notifies us when you change permissions or remove our access; earlier activities are not imported from Garmin. We store the Garmin user ID and access tokens on our servers. Garmin data is shown only to you and to people you have allowed to see your training (for example your coach), exactly like rides from other sources. We do not sell Garmin data, do not share it with anyone other than the service providers in section 7 that run the Service, and do not use it for advertising. We do not use Garmin data to train, fine-tune or evaluate artificial intelligence or machine learning models, and the Service does not use AI on it.
  • Connected apps (partner apps): third-party apps that we have approved, such as an indoor-cycling game, can ask you for permission through our own login and consent screen. Only after you approve, the app can upload rides to your account (and, if you grant it, read your FTP, weight and units). We do not send your activities to these apps. The app is named on the consent screen and listed under Settings, Connections, Connected apps, where you can disconnect it at any time, which revokes its access immediately. We log registrations, approvals, disconnects and rate-limit events for security.
  • Disconnecting: you can disconnect any integration in Settings at any time. This deletes the stored tokens or key, stops syncing and, for Strava, Wahoo and Garmin, revokes our access at the provider. If you remove our access in your Garmin Connect account, Garmin tells us and we disconnect automatically and stop receiving your data. You can also revoke access in your Strava, Intervals.icu, Wahoo or Garmin account. Rides that were already imported stay in your account until you delete them or ask us to delete your account.
  • Your use of those services is governed by their own terms and privacy policies. We receive data from them only as you authorise.

7. Service providers and third parties

We use the following providers to run the Service. They process data on our behalf, except where noted.

  • Supabase – database, authentication and file storage (profile photos).
  • Vercel – hosting of the website and its server functions.
  • Google – "Continue with Google" sign-in, only if you choose it. Google acts as an independent controller for your Google account.
  • Strava, Intervals.icu, Wahoo and Garmin – only if you connect them, as described in section 6. Data from Garmin is processed on our behalf only by Supabase (storage and database) and Vercel (hosting and server functions), and is not passed to any other party.
  • Map tile providers (MapTiler, or OpenStreetMap) – when you view a map, your browser requests map images from the provider, which therefore receives your IP address and the map area you view. Your activity data is not sent to them.
  • Email delivery provider (Resend) – if email notifications are switched on, we send notification emails (for example about coaching or follow requests) to your account email address through this provider. You can turn this off in your settings.
  • Google Analytics – only if the operator has enabled it on the deployment; the Service works without it. If enabled, it measures page usage and may use cookies.
  • Reddit Pixel (Reddit, Inc.) – only if the operator has enabled it on the deployment; the Service works without it. If enabled, it loads a script from Reddit that receives your IP address, browser details and the pages you visit, plus a sign-up event when you register, to measure the performance of Reddit advertising. It may set cookies, and only loads after you accept the Marketing category (section 11). We do not send Reddit your activity or health data.

We do not sell your personal data and we do not use your activity data for advertising. The optional Reddit Pixel above only measures visits and sign-ups from our own Reddit campaigns.

8. Google user data and Limited Use

If you sign in with Google, we request only your basic profile (name and email address) and use it solely to create and authenticate your account. We do not access your Google Drive, Gmail, Calendar, contacts or any other Google data.

VelocityStack's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular we do not use Google user data for advertising, we do not sell it, and we do not allow humans to read it except with your consent, for security purposes or where the law requires.

9. International transfers

Our providers may process data outside your country, including outside the European Economic Area (for example in the United States). Where that happens we rely on the providers' appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

10. How long we keep data and how to delete it

  • We keep your data for as long as your account exists.
  • Disconnecting an integration deletes its tokens or key immediately (for Garmin it also removes our registration at Garmin and any queued, not yet imported activity notifications). Activities already imported from Garmin remain in your account until you delete them in the app or ask us to delete your account; you can access and download them in the app, correct them where editable, or ask us by email for a copy. Individual items such as rides, templates, notes, races and your profile photo can be deleted by you in the app.
  • Deleting your account: the app does not currently have a self-service "delete account" button. To delete your account and the associated data (activities, files, settings and relationships), email koli440@gmail.com from your account address. We will delete the account and its data within 30 days and confirm to you. Backups held by our providers are overwritten in their normal cycle.
  • Server logs at our providers are kept for a short period set by those providers.
  • We may keep limited data longer only where the law requires or to establish or defend legal claims.

11. Cookies and local storage

When you first visit, a banner asks you to accept or reject optional cookies. Optional categories are off until you turn them on, the Service works fully if you reject them, and nothing optional loads or is stored before you choose. You can change or withdraw your choice at any time through Cookie settings in the footer or at the bottom of this page. We ask again if the categories change and at least every 12 months.

Strictly necessary (always on, no consent needed)

  • Sign-in session (Supabase) – stored in your browser's local storage (key starting sb-) so that you stay signed in. Removed when you sign out.
  • Cookie choice (`vs.consent`) – local storage, records your choice, its version and date. Kept up to 12 months.
  • Preferences – such as theme and display options, stored in your browser.
  • Sign-up attribution – campaign parameters (utm_source, utm_medium, utm_campaign, gclid) are kept in session storage only while a Google sign-in is in progress, and a marker in local storage prevents counting a sign-up twice. These are used only if you accepted the matching category; otherwise they are not sent anywhere.

Analytics (only if you accept)

  • Google Analytics 4 (Google) – sets _ga and _ga_<container id> cookies (up to 2 years) to measure page usage and sign-ups. Only loaded if the operator has enabled it on the deployment.

Marketing (only if you accept)

  • Google Ads signals (Google) – consent for advertising storage, ad user data and ad personalisation is granted only in this category, via Google Consent Mode v2 (all denied by default); this may result in cookies such as _gcl_au.
  • Reddit Pixel (Reddit, Inc.) – loads a script from Reddit and may set cookies such as _rdt_uuid to measure Reddit advertising. Only loaded if the operator has enabled it on the deployment.

If you withdraw consent, we stop the scripts and delete the cookies listed above that we can reach on this site; cookies on third-party domains are governed by those providers' policies.

12. Security

Data is transmitted over HTTPS. Access is controlled by row-level security in the database so that each account reads its own rows, and coaches and riders see only what the rules in this policy allow. Passwords are hashed by the authentication provider, integration secrets are stored server-side and are not readable from the browser, and privileged operations run on the server. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.

13. Your rights

Depending on where you live (for example under the GDPR) you have the right to:

  • access your data and receive a copy;
  • have inaccurate data corrected (most of it you can edit in the app);
  • have your data erased;
  • receive your data in a portable format (you can also download your own original files from the app where offered, and we will provide an export on request);
  • restrict or object to processing based on legitimate interests;
  • withdraw consent at any time, for example by ending coaching, disconnecting an integration, or asking us to delete your account;
  • complain to a data protection supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ, uoou.gov.cz); you may also contact the authority where you live.

To use these rights, email koli440@gmail.com. We may need to verify your identity and will respond within one month.

14. Children

VelocityStack is not intended for people under 16. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

15. Changes to this policy

We may update this policy. The "Last updated" date above shows the latest version. If a change is significant we will tell you in the app (for example in "What's new") or by email before it applies where required.

16. Contact

Jan Kolář, koli440@gmail.com.

Privacy Policy · Terms of Service ·