Privacy Policy

Last updated: 17 July 2026

Delo Velo (delovelo.eu) is a self-hosted training-planning tool for cyclists, built and operated by me, Jim Vermunt, as an individual — not a company. This page explains what data the app collects, why, and what you can do about it.

What data is collected

When you create an account and connect a data source, the app stores:

• Account info: an email address (your real one if you sign in with Garmin; a placeholder address if you sign in with Strava, since Strava's API doesn't share your email), an optional display name, and when your account was created.
• Authentication: for Garmin, your password is sent directly to Garmin's own servers to sign in (the same way Garmin's own apps do) and is never stored by this app — only an encrypted session token is kept so you don't have to re-enter it every time. For Strava, the app uses Strava's official OAuth login and stores only the encrypted access/refresh tokens Strava issues, never your Strava password.
• Ride and training data: activities synced from Garmin or Strava (duration, distance, heart rate, power, cadence, data streams), plus anything you enter yourself — daily check-ins, weekly availability, training blocks/goals, and in-app feedback.

What it's used for

Solely to give you your own training dashboard and weekly plan. Nothing here is sold, used for advertising, or shown to anyone but you — there are no public leaderboards or cross-athlete comparisons built from your data.

The stack this runs on

• Garmin / Strava: the app talks to their servers to fetch your activities, using the credentials/tokens described above.
• Cloudflare: the app is served through Cloudflare's network (Cloudflare Tunnel) for HTTPS and DDoS protection. Cloudflare can see connection metadata as part of normal internet routing but has no access to your account data.
• The server itself: a single machine I personally operate (a self-hosted Raspberry Pi) running a Python/FastAPI backend with a local SQLite database — not distributed to any other cloud provider. Garmin/Strava tokens are encrypted at rest; everything is served over HTTPS in transit.
• No other third party has access to your data. There is no analytics or ad-tracking script on this site.

How long it's kept

For as long as your account exists. If you'd like your account and all associated data deleted, email me (see below) and I'll remove it — there's no automated retention limit beyond that request, since this is a small, personally-operated service without a self-service deletion button yet.

Your rights

You can ask to see, correct, export, or delete your data at any time by emailing me. If you're in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens) if you believe your data has been mishandled.

Children

This app isn't directed at, or knowingly used by, children under 16.

Changes

If this policy changes materially, the "last updated" date above will change accordingly.

Contact

Questions, data requests, or anything else: privacy@delovelo.eu.