Privacy Policy

The short version

We use Strava only to read the activities you choose to print. We never post to Strava on your behalf, and we never sell your data. We show your Strava data only to you. You can disconnect Strava — and ask us to delete your data — at any time.

Data we get from Strava

When you connect Strava, you authorise us (via Strava’s OAuth) to read your activities. We request read access only — including activities you’ve marked “Only You”, so any run can be printed. From Strava we access:

• Your basic athlete profile: name, profile photo, and your measurement preference (miles/kilometres).
• Your activities: the route map (GPS polyline), plus the name, date, distance, duration, pace/speed, elevation, and recorded location of each activity.

Most of this is fetched live from Strava each time you view it and is not stored on our servers. The exceptions are described in “Data we store”, below. We use Strava data solely to display your activities and to produce the print you order. We do not use Strava data — directly or indirectly — to develop, train, evaluate, or operate any AI or machine-learning system, and we never display one user’s Strava data to anyone else.

Data we store

To keep you signed in and to fulfil orders, we store:

• Account & session: your Strava athlete ID, name and profile photo, your Strava access and refresh tokens (so we can keep reading the activities you choose without asking you to reconnect), and session details (a session token, expiry, IP address, and browser user-agent). We do not receive or store an email address from Strava.
• Your design: when you add a print to your bag, we save a snapshot of that specific design — the route geometry and the activity stats and caption you chose to show on it, plus your size and frame selection — so we can render and fulfil exactly what you ordered.

Checkout & payment

Checkout and payment are handled by Shopify. When you buy, Shopify collects and processes your name, contact details, shipping address, and payment information. We do not see or store your full payment card details — those are handled by Shopify and its payment processors. Your use of checkout is also subject to Shopify’s own privacy policy.

Fulfilment

Framed and unframed prints are produced and shipped by our print partner, Prodigi. To make and post your order we share the print design and the shipping address you provide at checkout with Prodigi. They process this data to fulfil your order and under their own privacy policy.

Other processors

We also rely on these service providers to run Waymark:

• Our hosting and database providers, which store the account and design data described above.
• A content-delivery layer that gives us your approximate country (from your IP) so we can show the right currency and sizes, and decide whether to ask for analytics consent. We don’t use this to identify you.
• PostHog (EU) and Meta for the analytics and advertising measurement described below — and never with your Strava activity data.
• Map data providers used to render the printed maps (see our map credits).

Analytics & advertising

With your consent (or, outside the EEA/UK, until you opt out) we use two measurement tools to understand how the site is used and how our ads perform:

• PostHog (EU-hosted) — privacy-friendly product analytics. We disable session recording and automatic capture, and only record a small set of anonymous funnel events (e.g. which step you reached, the size or frame chosen).
• Meta Pixel— measures the effectiveness of our advertising (e.g. that a visit led to an order). US visitors are covered by Meta’s Limited Data Use.

We never share your Strava activity data with these tools — no activity names, routes, distances, or your Strava account. Visitors in the EEA, UK, and Switzerland are asked to opt in before any of this loads; everyone can change their choice any time via Cookie settings (here or in any page footer).

Cookies & local storage

We use a session cookie to keep you signed in, a cart cookie to link you to your Shopify basket, and a consent cookie to remember your analytics choice. Your place in the customise flow is kept in your browser’s session storage on your device. When you add a print to your bag, the design you configured is saved on our servers so we can show your basket and print your order, and the basket itself is held by Shopify, who run our checkout. With consent, PostHog and Meta also set measurement cookies as described above.

Legal bases (UK/EU)

Where UK/EU data-protection law applies, we process your data to perform our contract with you (showing your activities and fulfilling orders), on the basis of your consent (connecting Strava, which you can withdraw at any time), and for our legitimate interests in operating and securing the service.

How long we keep it

The activities you browse are fetched live from Strava each time and are not stored on our servers. When you add a print to your bag we save that one design — the shape of the route and the figures shown on the poster — because we need it to show your basket and to print your order. We keep your account (your Strava profile and tokens) while your account is active.

When you disconnect — either in the app or from your Strava settings — we revoke our access on Strava’s side and delete your account, your stored Strava tokens, your sessions, and any saved designs you had not yet ordered. Designs attached to a placed order are kept only as long as needed to fulfil and support that order. Order records held by Shopify and Prodigi are retained under their own policies and any legal/accounting obligations.

Your choices & rights

• Disconnect any time from within the app (which revokes our access on Strava’s side), or from your Strava settings at strava.com/settings/apps.
• You can ask us to access, correct, or delete the personal data we hold, or to export it.
• Depending on where you live, you may have additional rights and the right to complain to your local data-protection authority (in the UK, the ICO).

To exercise any of these, email us at [email protected].

Children

Waymark is not directed at children and is intended for users aged 16 or over.

Changes

We may update this policy from time to time. We’ll change the “last updated” date above and, for material changes, take reasonable steps to let you know.

Contact

Questions about this policy or your data? Email [email protected].

Waymark uses the Strava API but is not endorsed, certified, or otherwise approved by Strava. Strava is a trademark of Strava, Inc.