Your data stays yours.

What is kept

• Your account. The name and email address your sign-in provides, your role, and when you last signed in.
• Your activities. The files you upload or that a connected service sends, kept whole as your device recorded them, and everything worked out from them: routes, times, heart rate, power, best efforts, records and rankings. Your gear and goals too.
• A connection to Ride with GPS, if you make one. The access Ride with GPS grants, stored encrypted. Your Ride with GPS password is never shared with us.
• A request for an invite. The email address typed into the form on the front page, and whether an administrator has invited you yet.
• An audit log. A record of what administrators do to accounts, such as inviting or suspending somebody, so it can always be checked.

Who can see it

You. There are no public profiles, no feed and no followers, and your activities appear nowhere but your own pages. A sticker is seen by whoever you share it with, because you chose to share it. The people who run the server can reach the database, as on any website, and look at it only to keep the service running.

Cookies and your browser

One cookie keeps you signed in. It cannot be read by the page's scripts, and it lasts 30 days from your last visit. Signing in, and connecting Ride with GPS, use short-lived cookies of their own that only carry the sign-in through. None of them follows you anywhere else.

Your browser remembers your preferences, such as units, theme and accent, and a note that you are signed in, which lets the front page send you straight on to your report. These stay in your browser and never reach the server.

Other services

• Your sign-in provider handles your password; StatsOverlay never sees it. It tells us your name and email address.
• Ride with GPS, only if you connect it, sends your activities here. Disconnecting stops that, and what it already brought in stays with you.
• Open-Meteo, a weather archive, may be asked what the weather was where and when an activity happened, for the wind along your route and the temperature. It is sent a location and a time, never who you are.
• Google Fonts supplies the typefaces, so your browser fetches them from Google when a page opens.

Like any web server, ours logs the requests it answers, including the address they came from, to keep the service running and to stop abuse such as a flood of invite requests.

Leaving

Delete your account in Settings whenever you like. Your activities, files, gear, goals and connections go with it, and any connected service is told to forget the access it gave. The audit log keeps a note that the account was deleted, with its email address, so an administrator can see what happened to it. A lost or borrowed laptop is covered too: Settings can sign you out everywhere at once.