Privacy Policy

We use the data we collect to:

• • Provide and operate the VeloWhere Service
• • Personalize your user experience
• • Enable authentication with third-party services you choose to connect
• • Analyze usage to improve the Service
• • Communicate with you about updates, features, or important notices

If you are located in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• • Your consent (when you authorize integrations or provide personalization data)
• • Performance of a contract (to provide you with the VeloWhere Service)
• • Our legitimate interests (to improve the Service and ensure its security)
• • Compliance with legal obligations (where applicable)

You can withdraw your consent at any time by disconnecting third-party services or contacting us.

We rely on these processors to operate the Service:

• • Google (Firebase) — authentication (sign-in), and Google Analytics for usage statistics
• • Microsoft Azure — hosting, databases, and file storage
• • Strava, Garmin, Wahoo, Ride with GPS — fitness data providers you choose to connect (direct relationship with you)

If you are in the EEA, transfers to these providers rely on the European Commission's standard contractual clauses where applicable.

You can delete your account at any time, from either the app or the web:

• • In the app: Settings → Delete Account. This immediately and permanently deletes your profile, sign-in, connected providers, imported activities, and cloud-saved data.
• • On the web: use our account deletion page (for when you no longer have the app). We verify the request by replying to your sign-in email and delete within 7 days of your request.

Deletion also revokes our access to your connected fitness-provider accounts. Your activities at those providers (Strava, Garmin, Wahoo, Ride with GPS) are yours and are never touched.

Note: Garmin allows historical data to be downloaded only once per account. If you delete your VeloWhere account and later return, previously imported Garmin history cannot be imported again.

Routes and files saved only on your device are not part of the account and remain until you remove them yourself.

Your data may be stored on servers located in various countries. While we take reasonable steps to protect your data, we cannot guarantee that all personal data will be stored exclusively on servers located in Norway or within the European Economic Area (EEA).

How long we keep data: account and provider-connection data is kept while your account is active. Imported activities and routes are kept until you delete them in the app or delete your account. When you delete your account, your data is removed immediately (in-app) or within 7 days (web request); only a minimal record that the account existed and was deleted is retained to prevent the deleted identifier from being reused, and it contains no personal information. Analytics events are retained by Google Analytics for a maximum of 14 months. Messages you send us are kept while needed to handle your request and for follow-up, then deleted.

By using the Service, you consent to the transfer of your personal data to countries that may have different data protection laws than your country of residence.

You have the right to:

• • Request access to the personal data we hold about you
• • Request correction of inaccurate data
• • Request deletion of your data (where legally permissible)
• • Withdraw consent to data processing where applicable
• • Request portability of your data (where applicable under GDPR)

To exercise any of these rights, please contact us using the form below.

If you are located in the EEA, you also have the right to lodge a complaint with your local data protection authority.

The VeloWhere Service is intended for users who are 16 years of age or older.

If you are under the age of 16, you may only use the Service if you have obtained consent from your parent or legal guardian.

We do not knowingly collect personal data from users under the age of 16 without such consent. If we become aware that we have collected personal data from a user under the age of 16 without the necessary parental consent, we will take steps to delete the data.