Privacy
Effective date: 2026-08-11
Who operates Scratlas
Data Controller: Harold Choo
Privacy Contact: support@scratlas.com
Website: www.scratlas.com
Data from Strava
With your authorization, Scratlas receives profile name and avatar, activity summaries, and activity location fields needed to resolve country and supported region. When Activity Memories is enabled (on by default), Scratlas may fetch the documented primary photo from a detailed activity response and retain its remote URL and display metadata. We request read and activity:read by default. You may explicitly choose activity:read_all, which includes “Only You” activities and privacy-zone data.
Why we process information
We process Strava data after your authorization and consent so Scratlas can provide your private passport and progress views. We process account and security information as necessary to operate and protect the service. Scratlas also records limited first-party product analytics such as session starts, passport/country/region views, share actions, and first-touch acquisition source. Acquisition data is limited to sanitized UTM fields, the referring host, and landing path; Scratlas does not store a full referrer URL, IP address, or user agent in this analytics dataset. If you contact Support, we process the contact information and message you provide to respond to and manage your request. These purposes do not make support messages Strava Data unless you voluntarily include Strava information in them.
Purpose and retention
We use Strava-derived data only to display your private passport. Activity summaries—including activity names, dates, types, distances, times, and elevation—resolved countries and regions, passport stamps, totals, and Activity Memories metadata are maintained only as part of the same transient cache. Scratlas targets a complete revalidation from Strava within six days. It does not display the cached activity data or its derived information after seven days without successful revalidation, and expired activity, media, and derived records are automatically deleted. Failed refreshes do not mark the cache as current. Cached profile name and avatar are also cleared when the cache expires. Limited first-party product analytics and acquisition attribution are separate from the Strava-derived cache, are associated only with the Scratlas account, and are deleted when that account is deleted.
Optional discovery notification emails
If you choose to subscribe, Scratlas stores the email address you enter, the time you consented and verified the address, whether alerts are enabled, and short-lived records of which country or region discoveries triggered a notification (deleted within seven days). Scratlas does not obtain your email address from Strava. We send a confirmation link before activating notifications. Discovery emails omit locations and GPS data and link back to your authenticated private passport. We use email delivery providers to send these optional transactional notifications, not advertising. You may turn alerts off in Settings or unsubscribe using the link in each email. Notification preferences and queued records are deleted when your Scratlas account is deleted.
Support messages
If you use the Support form, Scratlas may collect your optional name, email address, and message contents. We use this information only to respond to and manage the support request. We do not use support contact information for advertising or marketing.
Voluntary contributions
If you choose to support Scratlas, you are directed to an external payment provider to make a voluntary contribution. The payment provider, not Scratlas, handles payment information under its own privacy terms. Scratlas does not send your Strava identity, profile, activity data, GPS coordinates, or account identifiers to the provider and does not maintain a donation-status history associated with your Scratlas account. You can donate again at your discretion without creating an account upgrade.
Coordinates and security
Coordinates are processed transiently on the server for country/region resolution and immediately discarded. They are not persisted, logged, returned to the browser, or disclosed to other Scratlas users. OAuth tokens are encrypted before storage and kept server-side.
Service providers
Scratlas uses third-party providers for application hosting and server execution, server-side database and storage, aggregate site analytics, and delivery of Support messages and opted-in discovery emails. These providers process information only as needed to provide those services. Scratlas does not use these providers to sell Strava Data, target advertising, or disclose one athlete’s Strava Data to another user.
What we do not do
We do not sell Strava Data, use Strava Data for advertising, AI, analytics reuse, or product-improvement analytics, or disclose it to other Scratlas users. Limited first-party product interaction analytics are used to understand Scratlas usage, but they do not contain Strava activity details, routes, coordinates, or Strava athlete IDs. We do not create public Scratlas pages or public maps from Strava Data. We do not retrieve Strava videos because the current public DetailedActivity API does not document an equivalent video collection, and we do not scrape Strava or use undocumented endpoints. Activity Memories and optional discovery notifications can be turned off without reconnecting.
Your choices, rights, and data access
You can see Scratlas’s currently retained Strava-derived information in your private Scratlas account. You may contact Scratlas Support to request information about data Scratlas currently holds about you. Strava’s own export tools remain the appropriate place to obtain the complete original Strava dataset. You can withdraw consent by disconnecting. Disconnect & Delete Strava Data revokes access, deletes local Strava and derived data, clears the session, and shows a durable written confirmation ID and timestamp. Strava-side deletion and revocation are handled through Strava’s revoke endpoint and deauthorization webhooks. You may also use Strava’s own connected-app settings and privacy controls.
Strava statements
Strava may monitor and collect Usage Data relating to API access and may use Usage Data for any business purpose, including API or platform enhancements, support, and compliance. Strava’s own privacy practices are described in its Privacy Policy.
Policy reference: Strava API Policy effective June 1, 2026.
Scratlas is independently operated by Harold Choo.