1. Who controls your data
VeloConquest is operated by Tomasz Ogrodowczyk, an individual developer based at Bajkowa 23, 71-799 Szczecin, Poland (the “Controller”, “we”, “us”). Privacy enquiries can be sent to privacy@veloconquest.app. General support enquiries can be sent to support@veloconquest.app.
2. What VeloConquest collects
Account and profile data
- email address and internal account identifier used for authentication;
- optional username, display name, avatar URL, country and city;
- leaderboard visibility preference.
Strava connection data
- Strava athlete identifier and connection status;
- OAuth access and refresh tokens and granted scope needed to keep the connection working;
- when available, basic Strava athlete profile information such as name and profile image.
Cycling activity and location data
- activity name, sport type, date/time, distance, moving/elapsed time, elevation gain, average and maximum speed;
- GPS latitude/longitude route points for eligible activities;
- derived route geometry, loop polygons, captured territory area, perimeter, compactness and related geospatial values.
Competition and integrity data
- loop count, territory statistics, defense visits, strongholds, Conquest Score, league and leaderboard data;
- integrity scores, quality-control status and technical flags used to detect invalid or suspicious activities;
- background processing status, synchronization timestamps and limited operational error information.
3. Where the data comes from
Most cycling data is received from Strava after you explicitly connect your Strava account. Profile information may also be entered directly in VeloConquest. Technical and derived competition data is generated by VeloConquest from authorized activity data.
4. Why we use the data
- Provide the service: authenticate you, import rides, calculate territory, display your profile and maintain rankings.
- Process your Strava authorization: maintain the integration and react to activity create/update/delete events.
- Fair play and security: detect suspicious routes, prevent manipulation and protect the integrity of competition.
- Reliability: operate background workers, retry failed imports and diagnose service errors.
- Legal compliance: respond to lawful requests and exercise or defend legal claims where necessary.
5. Legal bases in the EEA/UK
Depending on the operation, processing is based on performance of the VeloConquest service you request, your consent/authorization for the Strava connection, our legitimate interests in securing and operating a fair competition service, and compliance with legal obligations.
6. Service providers and sharing
We do not sell personal data. VeloConquest currently relies on service providers that may process data for the purposes described above:
- Supabase — authentication, PostgreSQL database, geospatial processing and server-side functions;
- Strava — third-party activity source and OAuth authorization provider;
- Vercel — hosting and delivery of the VeloConquest website;
- Apple / Google — application distribution and store services when the app is published through their platforms.
We may also disclose information when required by law, to protect users or the service, or in connection with a lawful business reorganization subject to appropriate safeguards.
7. No advertising sale or profiling
VeloConquest is not designed to sell your activity or precise route data to advertisers. The current service does not use your cycling routes for third-party advertising profiles.
8. Retention
- Account/profile data is retained while your VeloConquest account exists, unless a longer period is legally required.
- Strava OAuth credentials are retained while the Strava integration remains connected and are removed when the connection/account is deleted.
- Imported activity metadata and derived competition data are retained to provide your VeloConquest history and rankings until you request deletion or remove the relevant imported data.
- Temporary OAuth authorization state is short-lived. Route-cache records may carry short expiry periods while derived competition results can remain until the underlying data/account is deleted.
- Operational logs may be retained for a limited period under infrastructure-provider settings and security needs.
9. Your choices and rights
You can disconnect Strava, request deletion of imported Strava data, hide your profile from the public leaderboard, and permanently delete your VeloConquest account. Depending on your location, you may also have rights of access, correction, portability, restriction, objection and complaint to a data-protection authority.
See Privacy Choices and Delete Account.
10. Account deletion
Deleting your account removes the VeloConquest account and associated records that are linked to it, except information we must retain by law. VeloConquest also attempts to revoke the corresponding Strava authorization as part of the deletion flow.
11. Security
VeloConquest uses authenticated access, server-side authorization, row-level security for user data, restricted credentials, and backend-only processing for sensitive integration credentials. No internet service can guarantee absolute security.
12. International transfers
Our service providers may process information in countries other than your own. Where required, transfers are handled under recognized legal safeguards such as adequacy decisions or contractual protections.
13. Children
VeloConquest is not directed to children and should only be used by people who are legally able to use the connected services and consent to data processing in their jurisdiction.
14. Changes
We may update this Privacy Policy as the product evolves. Material changes will be reflected by a new effective date and, where required, additional notice.
15. Contact
Tomasz Ogrodowczyk
Bajkowa 23
71-799 Szczecin
Poland
Telephone: +48 504 021 561
Privacy: privacy@veloconquest.app
Support: support@veloconquest.app