Privacy Policy

Welcome to Tailwind KOMpass. We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website and services, particularly in relation to our integration with Strava.

This policy outlines our practices concerning the data collected through your interaction with our platform, including data obtained via the Strava API after your explicit authorization. By connecting your Strava account and using our services, you agree to the collection and use of information in accordance with this policy.

We collect information to provide and improve our services to you. The types of personal information we collect include:

Information from Strava (with your permission):

• Profile information: your Strava User ID, first name, last name, and profile picture URL.
• Authentication tokens: access tokens, refresh tokens, and token expiration dates provided by Strava so we can access your Strava data on your behalf.
• Activity data: data related to your activities logged on Strava, specifically segment data including segment ID, name, distance, location coordinates, elevation, activity type, and map polyline data.

Information from our platform:

• Account information: your user ID within our system (linked to your Supabase authentication ID).
• Usage information: timestamps such as when your account was last updated or when you last logged in via Strava.
• Rider profile: FTP, weight, height, rider type, your best 1- and 5-minute power, bike and kit weight, riding position and tyre type, if you choose to enter them (used to estimate power and pacing on segments).
• City and sex: read from your Strava profile at connect time, used to suggest a starting segment and to resolve which leaderboard record (KOM/QOM) we compute your feasibility against.
• Target leaderboard preference: an optional override if you choose to compute against the men's (KOM) or women's (QOM) record explicitly, rather than the default based on your Strava profile.
• Alert contact details: the email address you provide for tailwind alerts, and Web Push subscription details for any device you enable push notifications on.
• Alerts without an account: if you ask for a tailwind alert on a segment page without connecting Strava, we store your email address, the segment, your time zone and unit preference, and when you confirmed. We only email you after you click the confirmation link, at most once a day. Unconfirmed sign-ups are deleted after 7 days, and unsubscribing deletes your address. If you later connect Strava in the same browser, the alert moves into your account.
• Segment best times: your best observed time on segments you have ridden, taken from the activity data Strava shares with us, used to show your gap to the KOM/QOM. With each best time we keep the activity it came from, the average power when it was measured by a power meter, how many riders Strava grouped into that activity, and the forecast wind at that hour, so we can tell what a time says about you alone and estimate your power from it. We do not store your heart rate.
• Alert and login history: a record of the tailwind alerts we sent you and of each time you signed in.
• Referral data: if you were referred by another rider's share link, or share your own, we store the referral code and a log of link visits to attribute the referral.

We do not collect sensitive personal information beyond what is necessary for the functioning of the application and provided via Strava with your consent.

• To provide and operate the service: authenticate your account, connect with your Strava profile, display your relevant Strava data (like segments), and enable the core features of the application.
• To improve and personalise the service: understand how users interact with our platform and enhance the user experience.
• To communicate with you: respond to inquiries or provide service-related updates (we aim to keep this minimal).
• To maintain security: protect against unauthorised access or use of your information and our platform.

Your data is stored securely using industry-standard practices.

• Storage: we use Supabase, a secure backend-as-a-service provider, for our database needs. Your data is stored in a PostgreSQL database hosted by Supabase.
• Row Level Security (RLS) is enforced in our database so users can only access data they are authorised to view.
• Authentication tokens (like Strava access/refresh tokens) are stored server-side only.
• Authentication uses Supabase's built-in system to manage user logins and sessions securely.
• Encryption in transit: communication between your browser, our servers, and Strava's API uses HTTPS.

No method of transmission over the Internet or electronic storage is 100% secure, but we apply layered safeguards.

• Strava: data is inherently shared with Strava as part of the integration. We only request the permissions and data scopes required for our application's functionality.
• Supabase: as our backend and database provider, Supabase processes data on our behalf and is bound by its own privacy and security policies.
• Polar.sh: if you purchase Pro, Polar.sh processes the payment on our behalf as our merchant of record and is bound by its own privacy and security policies. We do not receive or store your payment card details.
• Other service providers that process limited data on our behalf: Resend (sends alert and account emails, receives your alert email address); WeatherAPI.com (wind data, receives map coordinates); MapTiler (map tiles, weather layer and place search); Google Firebase Hosting and Google Fonts (serve the website and its typefaces); DataFast (cookieless page analytics); and your browser’s push service (Google, Apple or Mozilla) for any device you enable push notifications on.
• Legal requirements: we may disclose information if required to do so by law or in response to valid requests by public authorities.
• No sale of data: we do not sell your personal information to third parties.

• Access and correction: you can review and update your Strava profile information through Strava directly.
• Disconnecting Strava: disconnect your Strava account from our application at any time using the Disconnect button on the Settings page (or through your Strava account settings). This revokes our access to Strava and stops further data synchronisation.
• Data portability (export): you can download a complete copy of the personal data we hold about you as a machine-readable JSON file at any time, using “Export my data” on the Settings page.
• Data deletion: you can permanently delete your account and all associated personal data at any time using “Delete my account” on the Settings page. This revokes our Strava access and erases your data from our systems, subject to any legal retention obligations. You may also contact us to request deletion.

Our service relies heavily on integration with Strava. When you interact with Strava through our platform or directly, you are subject to Strava's own Privacy Policy and Terms of Service. We encourage you to review their policies.

We may update this Privacy Policy from time to time. Significant changes will be reflected by updating this page and the "Last updated" date above. We encourage you to review this Privacy Policy periodically.

Questions about this Privacy Policy?

• Email: support@tailwindkompass.com
• X: @thom_hartogg