Privacy

Barefacts is a personal, independent project by Carlo Padrón, not affiliated with Strava. For anything about your data, write to hola@barefacts.cc.

Only after you connect and grant access:

• Your profile: name, photo and time zone.
• Your activities, private ones included: name, sport, date, distance, elevation gain, moving time and route summary. Private ones are needed so your totals are right.
• An activity's description, only when facts are about to be written to it, so your own text is kept.

Only the facts line, in the description of your activities, and only with your consent: when you press "Add to Strava" on an activity, or after you switch on auto-publish (which shows you a preview first). Your own text is never changed, and any line can be undone.

• Your Strava athlete ID and the access permissions you granted.
• Your Strava access tokens, encrypted (AES-256), so auto-publish can work while you are away.
• Your Barefacts settings and app language.
• For each activity, only what totals need: ID, sport, start date, distance and elevation. No names, routes or descriptions.
• A log of what auto-publish did: activity ID, result and the lines it wrote.
• When you joined, when you last opened the app and whether you have seen the intro.

Everything that comes from Strava is kept for seven days at most: after that it is deleted automatically and read again from Strava when needed. Your tokens and settings stay until you delete your data. Separately, we keep daily totals of how the app is used (for example, how many people connected or how many facts were written): just a number per day, with no athlete or activity IDs and nothing read from Strava, so they aren't linked to you and stay after you delete your data.

Your settings and a copy of your activity list (with names and route summaries) are kept in your browser so the app opens quickly. They never leave your device, are dropped after seven days and are deleted when you log out. We also use cookies that are strictly necessary: your login session (inaccessible to scripts), a signed athlete ID and a short-lived security cookie while connecting. No advertising or tracking cookies. To know how many people visit, we count page views with Vercel Web Analytics: no cookies, no identifiers stored on your device, only the page path (without query strings), referrer, country, browser and device type, in aggregate.

We don't sell your data, share it with anyone, show you ads, use it to train AI models, or show it to other people. Your data is only used to write your own facts.

• Vercel hosts the app (its request logs, with IP addresses, are kept for a short time) and counts page views without cookies (Web Analytics).
• Neon hosts the database, in the United States (Washington, D.C. region).
• Strava provides your data through its API, under the Strava API Agreement.

• "Delete my data", in the menu under your profile picture, deletes everything we keep on our server at once, revokes Barefacts' access to Strava and clears your browser.
• Revoking access from Strava (Settings → My Apps) also deletes everything on our server, automatically.
• Logging out clears what was kept in your browser.

Facts already written to your descriptions belong to your activities: you can undo them in Barefacts first, or edit them on Strava.

You can ask to access, correct or delete your data, or object to how it is used, by writing to hola@barefacts.cc. If you are in the EU, you can also complain to your data protection authority.

If this policy changes, the date at the top changes too. Important changes will be shown in the app.