Privacy
Q/KOM Hunters is a small, invite-only app run for a handful of riders. This page is both the plain summary and the formal notice required under Articles 13 and 14 GDPR.
Who is responsible
The controller is the private individual who runs this project. For any question about your data, or to exercise any of the rights below, write to hello@qkom.sbnck.de. There is no data protection officer — the project is far below the threshold that requires one.
What is stored, and where it comes from
From Strava, with your permission: your name and athlete id, your starred segments, your efforts on them (including power where your bike computer recorded it), your profile figures (weight, FTP, sex), your routes, and — only when you ask for a crown scan — the summary of rides where you took one. Your Strava access and refresh tokens, encrypted at rest with AES-256-GCM.
From you: home coordinates, when you can ride, bike weight, units, sport and surface preferences, and a leaderboard alias if you choose one. If you gave a digest address before that feature was withdrawn, it is still stored and still yours to have deleted on request.
Generated by the app: predictions, calibration results, crown history, planned attempts, and a log of which alerts you have already been sent so you are not told the same thing twice.
Why, and on what legal basis
- To run the app you asked for — scoring segments, discovery, the leaderboard, your account. Art. 6(1)(b) GDPR, performance of a contract.
- Push alerts — Art. 6(1)(a), consent. Off by default, and withdrawing consent is one click in Settings. The weekly digest email is currently withdrawn: no email is sent, and no mail provider is configured.
- Keeping the group workable — invite accountability, moderation, rate-limit protection, and security. Art. 6(1)(f), legitimate interests in running a small invite-only service that is not abused.
There is no profiling and no automated decision-making that produces legal effects about you within the meaning of Art. 22 GDPR. The predictions are about road segments, not about you as a person.
Who else sees it
Only the services needed to run the app. Nothing is sold, and nothing is shared for advertising.
| Service | Purpose | What it receives | Where |
|---|---|---|---|
| Strava | Source of your activity data | OAuth tokens, API requests for your own data | USA |
| Vercel | Hosting | Everything the app processes, plus request logs | EU region, US company |
| Turso | Database | Everything stored, listed above | EU region, US company |
| Open-Meteo | Weather forecast | Coordinates only — rounded to ~5 km buckets | EU (Germany) |
| OpenStreetMap Overpass | Road/gravel lookup | Segment coordinates only | EU (Germany) |
Some of these are US companies, so data may be transferred outside the EU. Those transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Weather and road lookups deliberately receive coordinates only, never anything identifying you — and the coordinates sent for forecasts are rounded to roughly 5 km buckets, which is also why two riders on the same segment share one cached forecast.
What other members can see
Only your self-chosen leaderboard alias and your crown counts, and only if you set an alias. Your real name, your home location, your times, your power, and your segments are never shown to another member. The administrator can see the member list and account status for moderation.
What it never does
It only ever shows you your ownactivity. No other athlete's identity or data is requested, stored, or displayed, and nothing is used to train any model — both requirements of Strava's API agreement. There is no advertising, no third-party analytics, and no tracking cookies. The only cookies are the ones that keep you signed in and, briefly, carry an invite through the Strava sign-in round trip.
How long it is kept
Your account data is kept for as long as you have an account. Alert history is deleted after 30days, and cached weather is deleted once it expires. Deleting your account removes everything immediately — see below. Shared, non-personal reference data such as a segment's shape and elevation profile is not tied to you and remains.
Your rights
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable form, and to withdraw any consent at any time without affecting what was done before. Write to hello@qkom.sbnck.de and you will get a reply.
You also have the right to complain to a data protection supervisory authority — in the EU, the one where you live, where you work, or where you think something went wrong.
Deleting your data
You can delete your account at any time from Settings, which permanently removes everything the app holds about you in a single operation — tokens, segments, efforts, attempts, crown history, alerts, and the account itself. You can also revoke the app's access directly in your Strava settings, which stops any further data being read.