Privacy without the fog.

Audax Tracker is a personal, non-commercial project created for the Irish Audax cycling community. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service.

We use Strava OAuth 2.0 for user authentication. This provides a seamless login experience since most Audax cyclists already use Strava.

When you connect with Strava, we collect and store:

• Your Strava user ID (for authentication)
• Your display name
• Your profile picture URL
• OAuth tokens (encrypted and stored securely for maintaining your login session)

Optional: Strava Activity Import

If you choose to use the Strava Import feature, we will read your Strava activities to help you find and import Audax rides. When you import an activity, we store the ride details (date, distance, name, elevation) and one or more Strava activity IDs for linking purposes (multiple activities can be grouped into a single ride). We do not store activities you choose not to import as rides in your tracker. Your selections and edits exist only in the current page and are discarded when you leave or reload it.

Route matching improvements

When route data is available, we may compare an activity with a catalogue GPX route to improve Strava matching. We retain de-identified comparison results and, when you import the activity, your final matching choice. We do not retain route coordinates or identifiers linking these results to you. Unresolved comparisons are retained for 30 days and labelled comparisons for 18 months.

The Brevet Hiberniae feature lets you track visits to landmarks across Ireland by uploading proof photos.

When you record a visit, we collect and store:

• The proof photo you upload, compressed and stored securely in cloud storage (AWS S3)
• The visit date (which may be extracted from the photo's EXIF metadata if available)
• Optional notes you add to the visit

EXIF metadata (such as the date the photo was taken) is read client-side in your browser to pre-fill the visit date. We do not store raw EXIF data on our servers. The uploaded photo is compressed before storage and the original is not retained.

If you delete a visit, the associated photo is permanently removed from cloud storage. If you delete your account, all your photos and visit records are permanently deleted.

In addition to the Strava authentication data mentioned above, we collect:

• Audax ride information that you enter manually or import from Strava (date, distance, type, location, etc.)
• Award progress and achievements you track in our system
• Brevet Hiberniae visit records and proof photos you upload
• Session information for maintaining your login state

We use your information to:

• Authenticate you and maintain your login session
• Display your profile information
• Track your Audax rides and award progress
• Provide you with personalised statistics and achievements

We take data security seriously:

• All OAuth tokens are encrypted using AES-256-GCM encryption
• All connections use HTTPS/TLS encryption
• Session cookies are secure and HTTP-only
• We follow industry best practices for data protection
• Uploaded photos are stored in encrypted cloud storage (AWS S3) and served over HTTPS

You have the right to:

• Access your data at any time through your account
• Delete your account and all associated data
• Revoke Strava access at any time through your Strava settings
• Request a copy of your data

We retain your data for as long as your account is active. If you delete your account, all your data will be permanently deleted from our systems, including any photos stored in cloud storage.

De-identified route comparisons follow the separate retention periods described in the Strava Integration section above.

We use Strava for authentication and, if you choose to use the import feature, to read activities that help you import rides. We use Amazon Web Services (AWS S3) to store Brevet Hiberniae proof photos. We do not share your data with any other third-party services except as required by law.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

If you have any questions about this Privacy Policy or our data practices, please contact us at our support page.