Privacy statement

Information we collect

• Account information: an internal account ID, your display name and provider profile picture URL, the provider you sign in with, that provider’s account identifier, and when your account was created.
• Profile information: the display name, optional biography and town or region, and distance units you choose, together with the time your profile was updated.
• Connected Strava account: your verified Strava athlete ID. If you enter an ID before connecting, we temporarily hold it to check it against the account you authorise.
• Community membership: the communities your account belongs to and whether each membership is active or suspended.
• Security and technical information: temporary sign-in records, session identifiers and expiry times, and operational error and request information. Our hosting provider processes connection information such as IP addresses and browser details to deliver and protect the service.

Do not put sensitive information in your biography or town/region field. These fields are optional.

Signing in with Google or Strava

You sign in on your chosen provider’s website. Dirt Kin does not receive your Google or Strava password.

Google sign-in requests basic profile access. We use your Google account identifier, name and profile picture; we do not request the email permission or store your Google email address. Strava sign-in requests basic read and activity read permissions and supplies your athlete ID and name. You can decline activity access and still sign in. We store Strava access and refresh tokens encrypted, with their expiry time and granted permissions, so our backend can access your rides without asking you to sign in each time. Google tokens are not retained in the account database.

Connecting Strava requires you to authorise the connection with Strava so we can verify ownership. A verified Strava ID cannot be changed through the profile editor.

When you request your rides, our API retrieves cycling activity summaries from Strava, including names, dates, distances and durations. The API returns them only to your signed-in account and does not save ride summaries in our database. We request access to rides visible to Everyone or Followers, excluding Only Me rides. We do not currently import GPS tracks, health information or segment results. Garmin sign-in is not currently available. We will explain additional data use and request any required permissions before introducing further activity features.

Providers handle information under their own policies: Google Privacy Policy and Strava Privacy Policy.

How we use information

We use account information to authenticate you, maintain your profile, verify connected accounts and check access to your communities. We use security and operational information to prevent misuse, investigate errors and keep the service working.

Where applicable data protection law requires a legal basis, we process information necessary to provide the account service you request and for our legitimate interests in operating and securing it. Where we rely on consent for an optional feature, you can withdraw that consent.

The current app does not sell your personal information, serve targeted advertising or use your information to train AI models.

Storage and sharing

Dirt Kin runs on Cloudflare. Account and profile records are stored in Cloudflare’s database service, and Cloudflare processes traffic and operational information on our behalf. Its infrastructure may process information in countries other than your own. See Cloudflare’s Privacy Policy for information about its handling of personal data.

Your profile is currently available through your signed-in account, rather than a public rider directory. Community access is checked against your membership. Authorised service operators may access information when necessary to provide support, maintain the service or investigate abuse.

Google or Strava receives the requests needed when you choose its sign-in or connection flow. When your provider picture is shown, your browser retrieves it from the provider’s image host, which receives connection information such as your IP address. We may also disclose information where required by law or necessary to protect the service and its users.

Cookies

The app uses essential cookies to complete sign-in and keep you signed in:

• __Host-dirtkin_login lasts up to 10 minutes and connects a sign-in attempt to your browser.
• __Host-dirtkin_session lasts up to 7 days and identifies your signed-in session. Signing out clears it and invalidates the session.

These cookies use HTTPS and are not readable by page scripts. The app does not add advertising or analytics cookies. You can clear or block cookies in your browser, but signing in will not work without the essential cookies. Provider websites may use their own cookies.

How long information stays

Account, profile, encrypted Strava authorisation and membership records remain while your account is held with Dirt Kin. There is currently no automatic deletion of inactive accounts. You can request account deletion using the contact details below.

Sign-in attempts expire after 10 minutes and sessions after 7 days. A scheduled daily cleanup removes expired records; completed sign-in attempts are consumed when used. Operational logs and backup copies follow the hosting services’ retention settings and may remain after records are removed from the active database. Information needed to meet a legal obligation or resolve a security incident may need to be retained longer.

Your choices and requests

You can update your profile after signing in. To request a copy, correction or deletion of your account information, contact us below. Account deletion is currently handled by request; there is no self-service delete button. We may need to verify account ownership before acting.

You can revoke Dirt Kin’s access in your Google or Strava account settings. Revoking access stops future access to that provider and may prevent you from signing in with it. When a ride request detects invalid Strava authorisation, we remove the saved Strava tokens and ask you to reconnect. Revocation does not by itself delete your Dirt Kin account, profile or verified athlete ID; contact us to request deletion.

Depending on where you live and the applicable law, you may also have rights to restrict or object to processing, receive a portable copy of your information, withdraw consent, or complain to your local data protection authority.

Contact

For privacy questions or requests, contact the Dirt Kin operator.

Changes to this statement

We will update this page when our handling of information changes and show the revised date above. For material changes affecting existing information, we will provide additional notice where required.