This privacy policy describes how the Les segments app ("the App", "we") collects, uses and protects the personal data of athletes who use it. Our goal is to offer time-boxed community challenges around Strava segments while complying with the General Data Protection Regulation (GDPR) and the French "Informatique et Libertes" law.
1. Data we collect
When you create an account and use the App, we may collect and process the following categories of data:
- Account data: username, Strava ID, email address, profile picture and preferences (language, notifications).
- Authorized Strava data: athlete information, list of your public running activities, efforts performed on the segments featured in the current challenges, times, distance, elevation and related technical metadata (date, segment ID).
- Participation data: challenges you joined, leaderboard positions, prizes you may have won.
- Technical data: App version, device model, operating system, technical install identifiers, error logs required for proper operation.
We do not collect your postal address, phone number or banking details. We do not import the full GPS trace of an activity: only efforts associated with the segments involved in a challenge are used.
2. Purposes and lawful basis
Your data is processed for the following purposes:
- Service delivery (lawful basis: contract performance): manage your account, display active challenges, compute leaderboards, notify you of your results.
- Community engagement (lawful basis: legitimate interest): highlight top leaderboard positions and let athletes compare themselves.
- Improvement and analytics (lawful basis: legitimate interest): measure usage in an aggregated way to improve the service.
- Optional communications (lawful basis: consent): inform you about new challenges or prizes, only if you opted in.
3. Connecting to Strava
Les segments is an application that is independent from Strava, Inc. and relies on the Strava API through OAuth 2.0. When you connect your Strava account, you are redirected to Strava and must explicitly authorize the requested scopes. You can revoke this access at any time from your Strava app settings .
The App only uses Strava data for the purposes described above. In accordance with the Strava API terms:
- we never sell Strava data;
- we only store the data strictly necessary to operate the challenges (segment efforts, identifiers, times);
- Strava's brand, logo and visual assets remain the property of Strava, Inc.
4. Sharing with third parties
We never sell your data. It may be shared with a limited set of technical sub-processors acting on our instructions and bound by confidentiality commitments:
- Hosting: OVH SAS, our infrastructure provider in France (see legal notice).
- Strava, Inc.: provider of the API used to retrieve your efforts on the challenge segments.
- Mobile notifications: Apple Push Notification Service and Firebase Cloud Messaging for the optional notifications.
5. Cookies and audience analytics
The les-segments.fr website may use strictly necessary technical cookies and anonymized audience analytics tools. You can configure your browser to block these cookies; some features may then be degraded. The mobile App does not set advertising cookies.
6. Data retention
Your account data is kept for as long as your account is active. After your account is deleted, it is erased or anonymized within at most 30 days, except for data we must retain for legal obligations (accounting, technical logs). Public performances may be retained in an anonymized form for statistical purposes.
7. Your rights
In accordance with the GDPR and the "Informatique et Libertes" law no. 78-17, you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data. You can:
- access, modify or delete most of your data from the Settings > My account screen of the App;
- revoke Strava access from your Strava app settings ;
- contact us by email at contact@mioza.app for any further request.
If you disagree, you also have the right to lodge a complaint with the French data protection authority CNIL.
8. Security
We implement reasonable technical and organizational measures to protect your data: encryption in transit, access control, logging, security updates and regular backups. No system is infallible: we encourage you to choose a strong password for Strava and to enable two-factor authentication.
9. Disclosure
We may be required to disclose information about you in response to a judicial request or to an authority conducting an investigation related to an illegal use of the service.
10. Changes to this policy
We may update this policy to reflect the evolution of the App or the legal framework. The last update date is shown at the top of this page. Material changes will be highlighted in the App or via email. By continuing to use the service after such notification, you accept the updated version.