Privacy Policy

What we collect

• Account and connection details: your Strava athlete ID, username, first and last name, the permissions you grant, connection and last-sync times, and the access and refresh tokens needed to maintain the connection.
• Activity details: activity ID, name, sport and activity type, date and time, elapsed and moving time, distance, elevation gain, and average and maximum speed.
• Training metrics: where available, average and maximum heart rate, cadence and power.
• Route data: where available, GPS coordinates, altitude and time points for an activity. Route data may reveal precise locations and regular training patterns.
• Derived insights: calculations we create from your Strava data, such as training volume, consistency, pace estimates, terrain and elevation profiles, and race-readiness indicators.

How we collect it

When you select “Connect Strava”, Strava asks you to authorise Tortoise Endurance using OAuth. Depending on the feature you use, we request permission to read your profile and activities, including activities whose visibility is set to “Followers” or “Only You”. We then retrieve the relevant data directly from the Strava API when you initiate a sync or use a Strava-connected feature. We never receive or store your Strava password, and we do not post activities or make changes to your Strava account.

Why we use it

We use this data to import and display your own training history to you; calculate personalised training, pacing, terrain and race-readiness insights; prepare the reports and coaching services you request; and, where you choose to use the feature, confirm that a race review is associated with a Strava athlete. We do not use Strava data for advertising, sell it, or use it to train a general-purpose artificial intelligence model.

Who can see it

Your Strava data and personalised results are shown only within your Tortoise Endurance account. They are not displayed to other users. Access is limited to you and authorised Tortoise Endurance personnel who need it to provide support, reports or coaching services. Our infrastructure providers process the data on our behalf as described in section 4. We do not disclose your Strava data to other third parties without your explicit consent unless required by law.

Storage and retention

Connection credentials are stored securely in our database and used only to communicate with Strava. Synced activity data and insights derived from it are stored with your Tortoise Endurance account for as long as needed to provide the connected features. You may delete individual imported activities from your activity history. Disconnecting Strava immediately stops future access and syncs and triggers permanent deletion of your connection credentials, imported Strava activities, route data, and derived personal insights. We confirm successful deletion in your account. If an infrastructure error prevents immediate completion, deletion is automatically retried and completed as soon as possible and no later than 30 days, unless the law requires us to retain particular information for longer.

Your choices and Strava’s role

You can withdraw Tortoise Endurance’s access at any time by disconnecting Strava in your Tortoise Endurance account settings or by revoking access in your Strava settings. You can request access to or deletion of the Strava data we hold by emailing support@tortoiseendurance.com. Strava may monitor and collect information about our use of its API and use that information for its own business purposes. Strava handles information under its Privacy Policy, which controls if it conflicts with this policy. You can also obtain a copy of your Strava data using Strava’s own bulk export tool.