Privacy notice
Fleap is a training-analysis service for endurance athletes. This notice explains what personal data we process, why, and what your rights are under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The data controller is [name / company]. Contact: [email].
2. What we process
- Account: email address, display name, password (stored only as a salted hash), language, settings, and when you accepted these terms.
- Training data you import from Strava, Garmin or FIT files: date, sport, duration, distance, speed, heart rate, power, cadence, elevation, laps, and the second-by-second recording including the GPS route. Also the targets, plans, tags, training blocks and notes you create.
- Health data (only with your explicit consent): sleep, heart-rate variability (HRV), resting heart rate, stress and similar values from your connected devices. Health data is a special category of personal data (GDPR art. 9).
- Location settings: the home area you choose (or that we estimate from where you usually start), used only to find activities near you.
- Community: clubs, club activities, posts, comments, RSVPs, friend requests, and club images you upload.
- Connections: your athlete id at Strava/Garmin and the access tokens or API key, stored encrypted.
- Technical data: IP address and browser information in server logs, kept for security and troubleshooting.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service you signed up for: importing, analysing and showing your training, plans and insights | Contract, art. 6(1)(b) |
| Analysing health data together with your training | Explicit consent, art. 9(2)(a), withdrawable at any time |
| Showing your segment efforts to friends or club members, and using your rides to detect group rides | Legitimate interest, art. 6(1)(f), with a right to object at any time. Defaults: your segment efforts are visible to your friends only (never heart rate or power if you hide them), and your rides count anonymously (never named, only groups of at least 5 athletes). Change or turn off under Settings → Sharing; it takes effect at once. |
| Security, preventing abuse, keeping the service running | Legitimate interest, art. 6(1)(f) |
| Emails about your account (verification, security) | Contract, art. 6(1)(b) |
We do not sell your data, we do not show advertising based on it, and we do not use tracking or analytics cookies. Partner content in Knowledge is always labelled and is never chosen from your personal data beyond the sports you selected.
4. Who else processes the data
- Render (hosting) and Supabase (database): our processors under data processing agreements. Data is stored in the EU (Frankfurt). Both are US companies; transfers are covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.
- Our email provider, to send account emails.
- Strava and Garmin: you connect them yourself; their own privacy policies apply to their services.
- OpenStreetMap services (map tiles, and address search via Nominatim and Photon): receive your IP address when the map loads, and the text you type in an address search, never who you are.
- Other athletes see only what you chose to share (Settings → Sharing) and what you post in clubs.
5. How long we keep it
As long as you have an account. When you delete your account, all your data is deleted at once; backups are overwritten within 30 days. Server logs are kept for at most 30 days. If you withdraw consent for health data, no new health data is imported, and you can delete what was imported in Settings.
6. Your rights
- Access and portability: download all your data under Settings → Security & data.
- Rectification: change your details in Settings, or edit your activities.
- Erasure: delete single activities, or your whole account under Settings.
- Withdraw consent (health data, sharing) at any time in Settings; this does not affect processing before the withdrawal.
- Object or restrict processing: contact us at [email].
- Complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the authority where you live.
7. Security
Passwords are hashed; tokens and API keys are encrypted; all traffic uses HTTPS; every data request is limited to your own account.
8. Age
Fleap is for people aged 16 or older.
9. Changes
If we change this notice in a way that matters, we tell you in the app before it takes effect.
Last updated 2026-11-01.