Privacy Policy

Last updated: 26 March 2026

1. Who We Are

Velobooker ("we", "us", "our") is a cycling tour management platform operated by Dragan Jovanović. You can contact us at hello [at] velobooker.com .

2. What Data We Collect

2.1 Account Data

When you create an account or sign in via a third-party provider, we receive:

Provider	Data received
Google	Name, email address, profile photo
Strava	Athlete name, profile photo, athlete ID
RideWithGPS	Name, email address, athlete ID

We do not receive or store your passwords. Authentication is handled entirely by the third-party provider via OAuth 2.0.

2.2 Tour and Route Data

• GPX route files imported from RideWithGPS or Strava, or uploaded directly
• Tour details: name, dates, description, day plans
• Your membership status and role within a tour (organiser or participant)

2.3 Strava Activity Data

If you connect your Strava account, we access:

• Your own past activities ( activity:read scope) — used solely to match your completed rides against the planned daily route
• We access only activities belonging to the authenticated user
• We do not access other athletes' data
• We do not read, store, or display third-party segment leaderboards

2.4 Expense Data

• Expense entries you create: description, date, amount, currency
• Receipt photos you choose to attach (optional)

2.5 Media

• Photos and videos you upload to a tour gallery
• Files are stored on our servers and accessible to other members of the same tour

2.6 Usage Data

• Basic server logs (IP address, request timestamps, error logs) for operational purposes
• We do not use third-party analytics trackers

3. How We Use Your Data

Data	Purpose
Account data	Identify you, display your name and photo to tour members
GPX and route data	Generate daily briefings, weather forecasts, elevation analysis
Strava activity data	Match post-ride activities against the day's planned route
Expense data	Calculate cost settlements between tour participants
Media	Display in-tour photo/video gallery to tour members
Server logs	Diagnose errors, ensure platform security

We do not use your data for advertising. We do not sell, rent, or share your personal data with third parties, except as described in Section 6.

4. Legal Basis for Processing

We process your personal data under the following legal bases (GDPR Article 6):

Legal basis	Applies to
Contractual necessity	Account data, tour/route data, expense data — required to provide the service you signed up for
Legitimate interest	Server logs — necessary for platform security and error diagnosis
Consent	Strava and RideWithGPS data — you explicitly authorise access via OAuth
Consent	Media uploads — you choose to upload photos/videos to a tour gallery

You may withdraw consent at any time by disconnecting the relevant third-party provider in your account settings or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Data Storage and Security

• Data is stored on servers hosted on Google Cloud Platform in the EU (europe-west region)
• Data in transit is encrypted via TLS (HTTPS)
• OAuth tokens are stored encrypted at rest
• GPX files and media are stored in object storage (Cloudflare R2) with access-controlled URLs

6. Data Sharing

We share data only in the following limited cases:

• Within a tour : your name and profile photo are visible to other members of tours you join
• RideWithGPS : when you import a route or event, we make API calls on your behalf
• Strava : when you connect Strava, we read your activities via their API under their terms
• OpenMeteo : we send GPS coordinates (from GPX waypoints) to the OpenMeteo API to fetch weather forecasts. No personal data is sent.
• Legal obligation : if required by law, court order, or to protect the rights and safety of our users

7. Strava Data

We comply with Strava's API Agreement . Specifically:

• We only access data the user has explicitly authorised
• We use Strava data only for the purposes described in this policy
• Strava activity data is cached for a maximum of 7 days and is not retained beyond that period
• If you delete data on Strava, we will reflect that deletion within 48 hours
• Users can disconnect Strava at any time from their account settings, after which we delete all Strava personal data — including cached activity data and OAuth tokens — from our systems
• We respect the privacy settings you have configured on Strava
• Strava may collect and use data related to our access to the Strava API, as described in Strava's Privacy Policy

8. Data Retention

Data type	Retention
Account data	Until you delete your account
Tour and route data	Until the tour organiser deletes the tour, or you delete your account
Expense data	Until the tour is deleted, or you delete your account
Media	Until deleted by the uploader or tour organiser, or account deletion
Server logs	90 days rolling
Strava activity data	Maximum 7 days cached; deleted on Strava disconnect or account deletion
Strava OAuth tokens	Deleted immediately on Strava disconnect or account deletion

9. Your Rights

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your data in a portable format (GPX files, expense records)
• Restrict processing of your personal data in certain circumstances
• Object to processing based on legitimate interest
• Withdraw consent at any time for processing based on consent (e.g., Strava connection)
• Disconnect third-party providers (Google, Strava, RwGPS) at any time
• Lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — www.aepd.es ) or your local EU supervisory authority

To exercise any of these rights, contact us at hello [at] velobooker.com . We will respond within 30 days.

10. Children

Velobooker is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. We will notify users of material changes by posting a notice in the app or by email. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact

For any privacy-related questions or requests:

Email: hello [at] velobooker.com
Website: velobooker.com