FormWeek — Privacy Policy
Effective date: August 7, 2026
FormWeek is a personal cycling training-analytics web app. This page explains what data FormWeek accesses, where it lives, how it is used, and how you can control or delete it.
What we access
With your authorization via Strava's OAuth flow (scopes: read,
activity:read_all, and profile:read_all), FormWeek reads:
- Your Strava profile — name, avatar, and heart-rate zones.
- Your cycling activities — summary fields (distance, time, elevation, and similar) and heart-rate/GPS streams — from the Strava API.
Where your data lives
All activity data is stored only in your own browser, in localStorage on
your device. There is no server-side database of your activities. A Strava refresh
token is kept in a secure, HttpOnly cookie in your browser so you stay signed in. The
only server-side record FormWeek keeps is minimal webhook sync metadata — activity
IDs and timestamps of change events — never activity content.
How your data is used
Your data is used solely to render your personal training analytics in your own browser. It is never shared with, sold to, or disclosed to any third party. FormWeek does not use advertising or analytics/tracking services, and does not use your Strava data for AI or machine-learning purposes.
Exports
The KML route export is generated entirely in your browser from data already loaded there — nothing is uploaded anywhere.
Retention and deletion
Your data stays in your browser until you disconnect or log out, which immediately deletes all locally stored Strava data. Disconnecting also revokes FormWeek's access on Strava and deletes the server-side sync metadata described above. You can also revoke access at any time at strava.com/settings/apps; upon revocation, all data is deleted (and in any event within 30 days). Activities you delete on Strava are removed from the local cache via webhook events and periodic re-sync.
Strava
Use of the Strava API is subject to Strava's terms, and Strava may monitor and collect usage data about this application's API use. FormWeek is not affiliated with or endorsed by Strava.
Your rights (GDPR / UK GDPR)
Access and erasure are self-service, as described above. The legal basis for processing is your consent: you choose to connect your Strava account, and you can withdraw that consent at any time by disconnecting.
Contact
Questions about this policy can be sent to nate@sourcedigital.net.
FormWeek is not affiliated with or endorsed by Strava.