Privacy Policy

Effective 17 Oct 2026. mynextpr writes a race countdown into the descriptions of your own new Strava runs. Nothing else.

Data we collect

Strava tokens (access + refresh) and token expiry — stored server-side only, never shown to pages, never logged.
Your Strava athlete ID and display name, your chosen race + goal, pause flag, and the IDs of activities already stamped (so nothing is stamped twice).
Month and year run totals, fetched live to compose the countdown — shown to you only, never stored.
Site analytics via Google Analytics 4 (Measurement ID G-B63L6BJZLY): page views on mynextpr.com only. This is separate from your Strava data and is processed by Google under the Google Privacy Policy.

How we collect it

Only through Strava's official OAuth sign-in on strava.com, and through Strava webhooks when one of your activities is created or updated. This page never sees your Strava password. Scopes requested: read (identity), activity:read (find your new run), activity:write (update its description).

How we use it

One purpose only: writing the countdown block into the description of your own new runs. Titles are never touched.
Your data is shown only to you. We never show one athlete's data to another user.
We do not train AI models on your data, do not aggregate or anonymize it for analytics, do not sell or transfer it, and do not use it for advertising.
Activity content is not cached at all. The only activity-derived record is a stamped-ID dedup log (IDs plus timestamps, no content), pruned to entries from the last 7 days on every write.

Withdrawing consent

Pause updates any time on the Manage page. Disconnecting stops all future writes. You can also revoke access in your Strava app settings — revoking there deletes your data here automatically.

Deleting your data

On the Manage page choose “Delete my data”, or POST to /api/delete-account. This revokes our Strava access and permanently deletes your tokens, race selection, and stamped-ID list from our servers. Descriptions already written on Strava stay as they are unless you edit them on Strava. Deletion completes promptly and always within 30 days. To download what we hold first, use /api/export (tokens are never included in exports).

Security

Tokens live in server-side files only, never in pages, logs, or the repo. API responses are marked no-store. If you suspect misuse, contact support immediately.

Strava's own policy

Strava processes your Strava account data under the Strava Privacy Policy, which controls where it conflicts with this page.

Contact

Questions or deletion requests: see Support.

mynextpr · Compatible with Strava. Not endorsed by Strava.