Privacy Policy

1. Information we collect

• Account information. When you sign in with Google, we receive your name, email address, and profile picture from your Google account.
• Routes you create. The GPX files you upload and the analysis we compute from them (distance, elevation, gradients, climbs, and the geographic coordinates of the route), plus any routes you choose to save to your library.
• The suggestion box. What you write in it (footer, Contact page) is kept with the kind you picked, the section of the site you wrote from (such as “garage”), whether you were on a phone, a tablet or a computer, the version of Cycloscape and the date — never your account (even if you are signed in), your IP address or your browser. If you ask for a reply, we also keep the email address you give, only to answer you. Please don’t write personal details you don’t want us to have; to have a suggestion deleted, write to us at info@cycloscape.com.
• Rides you finish. For each ride you finish on a route (an official world, a public route or one of your own), we keep its time, distance, average and normalized power and energy, the gravity world, the stretch of the route you rode, whether a trainer or power meter gave it real power and, since 13 October 2026, what share of its distance you rode with a trainer, a power meter and a heart-rate strap connected — never their readings or the devices’ names — and, since 23 October 2026, whether you rode on a phone, a tablet or a computer, and the name and version of your browser and the name of its system (for example “phone, Chrome 141, Android”), never the browser’s full description. Results on public routes appear on that route’s leaderboard.
• Workouts you create (Cycloscape Pro). If you build or import a structured workout, we keep it in your account — its name, your notes, its blocks and where it came from (the editor, a library workout or a .zwo, .erg or .mrc file) — until you delete it. Only you can see your workouts; they are never shared.
• Payment information (Cycloscape Pro). If you subscribe to Cycloscape Pro, the payment is handled by Stripe: your card details go straight to Stripe and never reach us. We keep your Stripe customer and subscription ids, your plan, its status (trial, active, cancelled) and its renewal or end date.
• Strava data (optional). If you connect Strava, we access your Strava profile and the activities or routes you import, under the permissions you approve (read, activity:read_all, activity:write). We store Strava access and refresh tokens so the connection keeps working until you disconnect. When you choose to upload a ride to Strava, we send it to your Strava account as an activity: its track, time and speed and, if you rode with a smart trainer or power meter, your power, and with a heart-rate sensor, your heart rate. Uploading a ride also creates its page (see Shared rides, below), and the activity’s description carries that page’s link. For each ride you upload we note its time, distance and start time and whether it carried power or heart rate, to tell which ride it was.
• TikTok data (optional, Cycloscape Pro). If you connect TikTok, we receive your TikTok account’s identifier, display name and profile picture, under the permissions you approve (user.info.basic, video.upload and, if you post from Cycloscape, video.publish), and we store TikTok access and refresh tokens so the connection keeps working until you disconnect. When you choose to send a ride film to TikTok, we send that film to your TikTok drafts, or post it with the caption and audience you set. See section 4c.
• Instagram data (optional, Cycloscape Pro). If you connect an Instagram professional account, we receive its identifiers, username, name, profile picture and account type, under the permissions you approve (instagram_business_basic and instagram_business_content_publish), and we store an Instagram access token so the connection keeps working until you disconnect. When you press Post on a ride film, we publish it to your account as a Reel with the caption you set. See section 4d.
• Performance data (optional, Cycloscape Pro). If you turn on Performance Lab, we store, for each ride you finish, your power, cadence and speed second by second and, if you ride with a heart-rate sensor, your heart rate second by second, together with the rider profile you set (FTP, weight, maximum heart rate) and the metrics we derive from them (best efforts, cardiac drift, aerobic efficiency, durability, training load). Heart rate is health data: we store it only with your explicit consent, which you give in Settings and can withdraw there at any time. If you connect Strava and ask us to import your history, we store the same streams from your Strava activities.
• Race Pacing reports (Cycloscape Pro). For each ride you finish with Race Pacing guidance, we store its execution report: the event you planned for, the route, the FTP and experience level of the plan, your scores and the power figures behind them (normalized and average power, time above your caps, power spikes, the fuel and drink reminders you acted on). The heart-rate drift a report measures is stored only with your Performance Lab consent, and withdrawing that consent deletes it from your reports.
• Ride photos. While you ride a route saved to your account, or a public or official route, signed in, your browser takes one picture of the 3D world (your rider on the road, without your numbers) about 90 seconds in, and we keep it as that route’s picture on your home. One per route: your next ride on it replaces it. It is private: stored where only our server can read it, and shown to you alone, through links that expire after an hour.
• Shared rides (optional). When you share a ride, or upload it to Strava from Cycloscape, we create a page for it at cycloscape.com/r/… and keep with it: a photo of the ride from the 3D world and, with Cycloscape Pro, the short film your own browser made (a free rider’s film is made and kept on their own device: it is never uploaded); the route’s name, only if the route is public or one of our official routes; the world and the date; the ride’s distance, climbing, moving time, top speed and, only when you rode with a smart trainer or power meter, average power; and the Strava activity it was uploaded to, if any. A shared ride never includes your heart rate, a map or coordinates. Its page is public to anyone with the link and is not listed in search engines, and you can delete it at any time with “Delete this page” on the page itself. See What other people can see.
• Technical data. Standard server logs (such as IP address, browser type, and pages accessed) collected by our hosting provider to operate and secure the service.
• Usage statistics. We count how Cycloscape is used in two ways, and neither uses cookies or tells us who you are.
  • Vercel Web Analytics and Speed Insights. Our hosting provider counts page visits (the page, the site that sent you there, your country, and your browser, operating system and type of device), a few actions on route pages such as copying or sharing a link or pressing Ride, and how fast pages load and respond on your device. It sets no cookies; to tell visits apart within a day it uses a hash of the request that is discarded after 24 hours. We see only totals, never individual visitors.
  • Our own event counts. When you reach one of a few steps (opening the pricing page, starting checkout, asking for a sign-in code and entering it or signing in with Google, starting or finishing a ride, creating a route, trying to save a route when your library is full, finding that your browser cannot connect sensors, opening a route from one of our emails, arriving by a link someone shared, pressing one of the share buttons, connecting a trainer, power meter or heart-rate strap (or losing it), your ride being saved or not, your ride film being made or not, or picking up a ride this device kept), your browser tells our server which step it was, with a few details about it: for example the plan you picked, the world of the route, the campaign tags of the email link, where a shared link was shared, which share button you pressed and whether it shared a film, a photo or a link, the kind of sensor and the name of the error when it would not connect (never the device’s name or identifier), and the version of Cycloscape you were using. We also count the pages you open on Cycloscape: the page, with any id in its address taken out (a route’s page counts as “a route page”, never which one), and, for the first page of a visit, the site that sent you there (its domain only, such as google.com), the campaign tags of the link, whether you are on a phone, a tablet or a computer, and your country as our hosting provider sees it from the connection (we never read your IP address for this). When something breaks in a page, we count it the same way: its kind, the page and the version, never what was on the page. The links Cycloscape makes for sharing (a ride’s page, a group-ride invite, the link in a Strava activity) carry a short tag naming where they were shared, such as ?via=whatsappor ?via=strava, and never who shared them; the page removes it from the address bar when it opens. To count the steps of one visit together, your browser keeps a random visit id in that tab’s session storage and sends it with each step; it is deleted when you close the tab and replaced after 24 hours even if you don’t, so it never links one visit to the next. If you are signed in, we record only that the step was taken by a signed-in rider: never your account, your name or your email address. We do not keep your IP address with these counts. Your browser sends none of this if it is set to send Global Privacy Control or Do Not Track, and you can switch counting off on this browser (see Not counted).

2. How we use your data

To authenticate you, generate and store your 3D worlds, show your route library, publish the pages of the rides you choose to share, run your Cycloscape Pro subscription, connect to Strava at your request, keep the service secure, and improve how it works. We do not use your data for advertising and we do not sell it. Performance data is used only to show you your own analysis in Performance Lab and your own history in Race Pacing. It is never shown to other riders, used for advertising, sold or shared.

Where you ride. If you answer “Where do you ride?” after signing up (or in Settings), we keep the country and town you choose, to understand where our riders are and to shape Cycloscape for them, and, if you get our marketing emails, to check tomorrow’s weather there (see below). We keep the town only: no coordinates, no address, and we never use your device’s location for this. It is optional, private (it is not shown on your profile) and you can change or clear it in Settings. The town list comes from GeoNames and is searched on our own site: what you type is not sent to anyone else.

What other people can see. Your rider profile page — your level, badges, lifetime distance, rides and calories, your full name, @username, bio and join date — opens only for you: for anyone else, signed in or not, it does not exist, and search engines are told not to index it and AI crawlers are kept away from it. Your Google profile picture is never shown to anyone. Where a name appears next to a result (a leaderboard, a public route’s creator), visitors who are not signed in see only your first name and last initial. Your routes are private unless you make one public; a public route shows its name, its map and elevation profile, can be downloaded as a GPX (you can hide its exact start and end), and names you as its creator. Your best ride on a public route appears on its leaderboard. A ride you share (or upload to Strava from Cycloscape) has its own page that anyone with its link can open: its photo or film, the world, the date, the ride’s distance, climbing, moving time and, when it was measured, average power, the route’s name if the route is public, and your name. We ask search engines not to index these pages and keep AI crawlers away from them, but anyone you send the link to can pass it on. The photo and film show your rider in the 3D world built from the route (its real road and terrain, never a map). Wherever your name appears to the public, riders signed in to Cycloscape see your display name, and everyone else, search engines included, sees only your first name and the initial of your last name. You can change your display name at any time in Settings.

Marketing emails. We email the Ride of the Week and occasional Cycloscape updates, only about Cycloscape itself. Accounts created from September 27, 2026 receive them unless they tick “Don’t send me these emails” when signing up; accounts created before that receive them only if they turn on “Weekly rides, new routes and Cycloscape updates” in Settings. Anyone can stop them at any time, in Settings or with the unsubscribe link in every one of these emails. To send them we share with Loops your email address, first name, account id, plan (Free or Pro), sign-up date, the date of your last ride, how many routes you have created and, if you told us, your country and town, and Loops tells us when you unsubscribe or an email bounces. Loops also tells us when one of these emails is sent to you, opened or clicked (Loops detects opens and clicks itself), and we keep that with your account id to learn which emails are useful. Sign-in codes and account emails are separate and are not affected by this setting.

Weather emails. If you get these emails and told us your town, the day before a day that looks poor for riding outside (rain, strong wind, storms, snow or ice, extreme cold or heat, thick fog) we may email you a route to ride indoors instead: at most one such email every seven days, and none if you have no town saved. To know tomorrow’s weather we ask WeatherAPI.com for the forecast of your town, sending only the town and country names, once for everyone in that town: never your name, email address, account or position. We keep why an email was sent (the town, the date, the weather and the route) with the record of that email.

3. Legal bases

Where the GDPR applies, we process your data to perform our contract with you (to provide the service, including the pages of the rides you choose to share, and, if you subscribe, Cycloscape Pro), to meet our legal obligations (such as the payment records tax law requires), on the basis of your consent (for example, connecting Strava), and for our legitimate interests in keeping the service secure and improving it. Marketing emails are sent on the basis of your consent if you turned them on in Settings, or, for accounts that receive them from sign-up, of our legitimate interest in telling the people who use Cycloscape about Cycloscape, as Article 21.2 of Spain’s LSSI and Article 13(2) of the ePrivacy Directive allow. You can object at sign-up, in Settings or in any of these emails. Your heart-rate data, and the performance data stored with it, is processed only on the basis of your explicit consent (GDPR Article 9(2)(a)): for what we store, the Performance Lab consent you give in Settings; for a ride you upload to Strava, your request to upload it, which sends the heart rate your sensor recorded to your Strava account — we pass it on and do not keep it.

4. Service providers

We share data only with providers that help us run Cycloscape:

• Supabase — database, authentication, and file storage.
• Vercel — hosting and content delivery, and the cookie-free Web Analytics and Speed Insights described in Usage statistics.
• Google — sign-in.
• Postmark — sends your sign-in codes and account emails (it receives your email address).
• Stripe — payments for Cycloscape Pro, only if you subscribe. Your card details, billing address and invoices are handled by Stripe and never reach us; see Stripe’s privacy policy.
• Loops — marketing emails, only if you opt in. See Marketing emails.
• WeatherAPI.com — weather forecasts for the towns of riders who get our marketing emails. It receives town and country names only, never who lives there. See Weather emails.
• Strava — only if you connect it, to import your activities and routes and to upload the rides you choose to send to it.
• YouTube (Google) — only if you connect it, to publish the ride films you choose to your own channel as YouTube Shorts. See section 4b.
• TikTok — only if you connect it, to send the ride films you choose to your TikTok drafts. See section 4c.
• Instagram (Meta) — only if you connect it, to publish the ride films you choose as Reels. See section 4d.

5. Storage and security

Your data is stored with Supabase and protected by row-level security, so each account can only access its own profile, routes, and Strava connection. The Strava, YouTube and TikTok tokens go further: their tables have row-level security with no policy at all, so they are unreadable from a browser and reachable only by our server. All traffic is encrypted in transit over HTTPS. The pictures of your rides are kept apart on purpose: the ride photos on your home sit in private storage that only our server can read, while the photo and film of a ride you share are public files, which anyone who has their address can open until you delete the ride’s page.

6. Retention

We keep your account and saved routes until you delete them or ask us to close your account. Disconnecting Strava, YouTube, TikTok or Instagram deletes the stored tokens for that service immediately, and in YouTube’s and TikTok’s case also asks them to revoke them. The record of the films you sent to TikTok or posted to Instagram goes with the shared ride’s page or your account. Performance data is kept until you delete it (Settings → Performance Lab), withdraw your consent or close your account. Withdrawing consent stops the collection immediately and deletes the stored streams. Race Pacing reports are kept until you delete them (each one, from Race Pacing) or close your account. A route’s ride photo is replaced by your next ride on it, and deleted with the route or your account. A shared ride’s page, with its photo and film, is kept until you delete it (“Delete this page”, on the page) or close your account; deleting it removes the files as well. Deleting a route does not delete the pages of rides you shared on it: delete those from each page. Our record of your Cycloscape Pro plan and its status goes with your account; the payment records themselves (invoices and payments) are kept by Stripe for as long as tax and accounting law requires. Our own event counts (see Usage statistics) say nothing about who you are: the visit id stored with them only groups the steps of a single visit. We keep them without a set end date, to compare one month with another. The record of the marketing emails sent to you, opened or clicked goes with your account: when your account is closed, those records lose your account id and remain only as counts. Suggestions from the suggestion box are kept while they help us improve Cycloscape, and deleted when you ask.

7. Your rights

Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal data, and you may object to or restrict certain processing or withdraw consent. To exercise these rights, email info@cycloscape.com. If you are in the EU/EEA, you may also lodge a complaint with your local data protection authority. You can download your performance data as a file from Performance Lab at any time.

8. Cookies and browser storage

We use strictly necessary cookies to keep you signed in (your authentication session). We do not use advertising, analytics or third-party tracking cookies: Vercel Web Analytics and Speed Insights work with no cookies at all.

Your browser also keeps a few things in its own storage so Cycloscape works as you left it, such as your ride display and rider settings, or a ride still waiting to be saved. These are used only to make Cycloscape work, never to track you. The only analytics item is the visit id of our own event counts (see Usage statistics), which lives in the tab’s session storage and is deleted when you close the tab: nothing we keep on your device for analytics lasts from one visit to the next.

Not counted. If you would rather not be counted at all, switch it off below. This browser then keeps a single flag in its local storage that says only “don’t count” (the same for everyone, so it identifies no one) and sends no counts until you switch it back on. A browser that sends Global Privacy Control or Do Not Track is never counted.

9. Children

Cycloscape is not directed to children under 16, and we do not knowingly collect their personal data.

10. Changes

We may update this policy from time to time. We will post the updated version on this page and revise the date above.

11. Contact

Cycloscape · info@cycloscape.com. See our contact page for our postal address.