Privacy & Cookies

What data we collect and why

When you connect your Strava account, we fetch your activity history (activity type, start time, duration, and distance) directly from the Strava API. This data is used to generate your print design.

When you place an order, the design you've configured (activity data, colour choices, title, and print size) is saved to our database so we can render and produce your print. This is necessary to fulfil your order.

We also collect your name, delivery address, and email address at checkout, handled by Stripe (see Third parties below). This information is passed to our print partner to dispatch your order.

We do not store your full Strava activity data beyond what is needed for your order. We do not use your data for advertising or share it with any party other than those required to fulfil your order.

Cookies

We use two cookies, both strictly necessary for the service to function. No analytics, advertising, or tracking cookies are used.

strava_access_token — A short-lived token (6 hours) that allows us to fetch your Strava activities on your behalf. Set when you connect your account and cleared automatically when it expires.

strava_refresh_token— A long-lived token (180 days) that allows us to silently renew your access token when it expires, so you don't have to reconnect Strava on every visit. Cleared after 180 days or if you revoke Strava access.

Both cookies are httpOnly (inaccessible to JavaScript) and are only sent over HTTPS in production.

Because these cookies are strictly necessary to provide the service you've requested, they do not require your consent under UK ICO guidance and UK GDPR.

Data retention

Design snapshots (the activity data and configuration saved when you begin checkout) are retained for order fulfilment and may be kept for up to 12 months thereafter for customer service purposes. Order records (print size, amount, delivery status) are retained for 7 years for accounting and legal compliance.

Third parties

Strava — We use the Strava API to read your activity history. Strava's privacy policy governs how they handle your data.

Stripe — Payment processing is handled by Stripe. Your payment card details are entered directly on Stripe's hosted checkout page and are never seen or stored by us. Stripe also collects your name, email, and delivery address at checkout. Stripe's privacy policy.

Gelato — Orders are fulfilled by Gelato, our print and fulfilment partner. Your name and delivery address are passed to Gelato to produce and ship your print. Gelato's privacy policy.

Your rights

You can disconnect Strava access at any time via Strava's connected apps settings, or by using the Disconnect link in the navigation. This immediately revokes our ability to access your Strava data.

Under UK GDPR you have the right to access, correct, or request deletion of personal data we hold. To exercise these rights, contact us at hello@olcirca.com.

Contact

For any privacy-related questions, contact us at hello@olcirca.com.