MyVeloLog — Privacy Policy
Last updated: 25 October 2026
1. Who we are
MyVeloLog (www.myvelolog.bike) is a cycling-analysis service. It reads your rides from Garmin Connect and turns them into reports, trends and maintenance records.
The data controller is:
- Remonen DevLabs, a Finnish sole trader (toiminimi)
- Business ID (Y-tunnus): 3665233-4
- Address: Naulakalliontie 26, 00970 Helsinki, Finland
- Privacy contact: privacy@myvelolog.bike
This policy explains what personal data MyVeloLog processes, why, who else receives it, how long it is kept, and your rights under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018).
AI Transparency Statement
MyVeloLog uses artificial intelligence only to describe your own data back to you, and only if you switch it on. AI features are off until you give explicit consent in Settings → Privacy, and you can switch them off at any time with one click.
- What the AI does: writes a plain-language reading of one ride, a comparison of your rides or a season of your riding; writes Today's reading of your day (only if you allowed health data in AI); writes a route insight from a route's figures and your own ride history on it; turns a search question you type into a filter over your own rides; and turns a ride you describe in plain words (in the route planner, Plan a ride or Routes) into a route request.
- Your data only, shown to you only. Each AI reading uses the data of the signed-in user alone and is shown only to that user. MyVeloLog never combines data from different users, never analyses users as a group, and never builds summaries, statistics or profiles across users. Comparisons between two riders have no AI reading.
- No training. Your data is never used to train, fine-tune or evaluate any AI model, by MyVeloLog or by its AI provider.
- What is sent: ride metrics such as distance, power, heart rate, cadence and temperature; dates; ride titles and bike names as you named them, which can contain place names; route figures such as climbs, surfaces, traffic and wind exposure, without coordinates or the route name; and the text you type into AI features. Never your GPS track, your own name, your username or your account identifiers. Daily health figures only if you separately allowed health data in AI (section 4).
- Never Strava data. Data received from Strava is not sent to any AI system.
- Fault analysis by the administrator. The administrator can ask AI to help read the service's error lines. Usernames in them are replaced with neutral labels, and email addresses, IP addresses and coordinates are removed before sending.
- Who processes it: Anthropic, PBC (USA), through its commercial API (sections 6 and 7). Readings are stored in your own account so they can be shown again, and are deleted with your account or when you withdraw consent.
- Not advice, not decisions. AI readings are descriptive text. They are not medical or training advice, and nothing about you is decided automatically from them.
If you withdraw consent, no further data is sent to the AI provider and your stored AI readings are deleted.
2. What data we collect
We collect only what the service needs to analyse your cycling. We never sell personal data or use it for advertising.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Username, password hash (never the password itself), email address, settings and consent choices | You |
| Profile and home | Home location (the place name you type and its coordinates), body weight, preferred riding times | You |
| Activity data | Your activity history and new activities, as summaries and original .FIT files: GPS track, time, speed, distance, altitude, heart rate, power, cadence, pedalling dynamics, temperature, sensor details, radar traffic counts; Garmin's weather for each ride; your gear (bike names) and device list | Garmin Connect, with your authorisation |
| Health and wellness data (opt-in only) | Daily metrics such as resting heart rate, heart-rate variability, sleep, stress, Body Battery, steps, floors, intensity minutes, skin temperature and Garmin's readiness score, including intraday curves; heart rate from walks and other non-cycling activities | Garmin Connect, only after your explicit consent (section 4) |
| Strava data (optional) | Segment efforts and segment details for your rides | Strava, only if you connect your Strava account |
| Equipment and plans | Bikes, components, service history, wear readings, spare parts, packing lists, planned routes, break points and road marks | You |
| Home weather station (optional) | Your station's access key and its readings | You and TFA.me, only if you add a station |
| Derived data | Reports, trends, fitness/fatigue figures, AI readings, weather, wind and rain for your rides | Calculated by MyVeloLog |
| Technical and security | IP address, browser user-agent, sign-in attempts and outcomes, password-reset requests, server logs | Your browser and our server |
GPS tracks and your home location can reveal where you live. Each user's data is kept in a separate area and is never shown to other users, unless you choose to share it, for example by moving or lending a bike to another rider, which gives them that bike's records.
3. Data from Garmin Connect
MyVeloLog receives your Garmin Connect data only with access you give it for your own Garmin account. We never store your Garmin password.
- What we receive: your activity history and new activities as summaries and .FIT files, Garmin's weather for each ride, your gear and device list, and (only with health consent) daily health and wellness data.
- What we use it for: your own reports, trends, maintenance tracking and the features you turn on. Nothing else.
- What we don't do: we do not sell Garmin data, share it with advertisers, or pass it to other services except the processors listed in section 6, and then only the minimum each one needs.
- Sending routes to Garmin: if you use "Send to Garmin", the route you planned is sent to your Garmin Connect account as a course.
- Withdrawing access: ask us at privacy@myvelolog.bike and we delete the stored access at once. Data already received stays in your account until you delete it or your account is closed (section 9).
Garmin is an independent controller of the data in your Garmin Connect account. Their handling is covered by Garmin's privacy policy.
4. Health data and your consent
Daily health and wellness data is a special category of personal data under GDPR Article 9. MyVeloLog collects it only with your explicit consent, and it is off by default.
- Two separate switches in Settings → Privacy: one allows collecting and showing daily health data; a second, off by default, allows including it in AI readings (Today's reading and season readings). The second can be on only when both health data and AI features are on.
- Consent comes before collection. Nothing is fetched from Garmin for your account until you switch it on. Each change is time-stamped.
- Withdrawing consent stops collection immediately and removes it from AI readings. You choose whether to delete the stored health records at once or keep them; a delete button stays in Settings either way.
Heart rate during rides. Heart rate recorded during a ride is part of the activity file itself and can count as health data. Accounts are created by the administrator. At your first sign-in, before any ride pages open, MyVeloLog asks for your explicit consent to process it; until you agree, no rides are fetched or analysed for your account. You can withdraw this consent in Settings → Privacy. Ride analysis then stops, but nothing is deleted automatically; ask us if you want your data deleted (section 10).
5. Why we use your data, and the legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Run your account and sign you in | Account data | Contract, Art. 6(1)(b) |
| Analyse your rides: reports, trends, records, maps, segment views | Activity data, Strava data | Contract, Art. 6(1)(b); for ride heart rate also explicit consent, Art. 9(2)(a) |
| Daily health and readiness views | Health and wellness data | Explicit consent, Art. 9(2)(a) |
| Bike and component maintenance, route planning, weather and ride forecasts | Equipment and plans, home location, route coordinates | Contract, Art. 6(1)(b) |
| AI readings (ride, comparison, season, Today, route insight), plain-English search and route requests | Ride metrics, dates, ride and bike names, route figures, text you type (never your GPS track or your own name); health data only if you allowed it | Your explicit consent (AI switch), Art. 6(1)(a); health part Art. 9(2)(a) |
| Service emails: password reset, email verification, service reminders | Email address, username | Contract, Art. 6(1)(b) |
| Security and fault diagnosis: lockout after failed sign-ins, abuse prevention, error logs, backups | Technical and security data | Legitimate interest in keeping the service and your data safe, Art. 6(1)(f) |
| Meet legal and accounting duties | Data required by law | Legal obligation, Art. 6(1)(c) |
MyVeloLog makes no decisions with legal or similarly significant effects about you by automated means. AI readings are descriptive text for you to read; nothing is decided from them.
6. Who else receives data
MyVeloLog runs on its own server in Helsinki, Finland. A few outside services receive the minimum each needs to do one job.
| Recipient | Country | What they receive | Why |
|---|---|---|---|
| Garmin Ltd and its subsidiaries | Switzerland / USA | Your authorisation; courses you choose to send | Source of your activity and health data; receives routes you send to your device |
| Strava, Inc. (only if you connect it) | USA | Your authorisation | Source of segment data |
| Anthropic, PBC (only with AI consent) | USA | Ride metrics, dates, ride titles and bike names, route figures without coordinates, and text you type into AI features; daily health figures only if you allowed them in AI; for the administrator's fault analysis, error lines with usernames replaced and emails, IP addresses and coordinates removed | AI readings, plain-English search, AI route requests and fault analysis (see the AI Transparency Statement) |
| Foreca Ltd | Finland | Coordinates and times of a planned route; your home area rounded to about 1 km | Weather forecasts for planned rides and the Today page |
| Open-Meteo | Switzerland | Sample points and times from a ride, including a few hours before the start; the Today page's forecast location rounded to about 1 km; the place name you type as your home | Wind and rain for your rides, the Today forecast, and finding your home's coordinates |
| OpenStreetMap Foundation (Nominatim) | United Kingdom | Place names you type into place search, and the map area around the search | Finding places for route planning |
| National Land Survey of Finland (Maanmittauslaitos) | Finland | The map area being viewed, requested by our server | Aerial photos in the route planner |
| TFA.me (only if you add your own weather station) | Germany | Your station's access key, used by our server | Showing your own home weather |
| Map and script providers loaded by your browser: unpkg.com, jsDelivr, Plotly (cdn.plot.ly), OpenStreetMap tile servers, OpenFreeMap, Amazon Web Services (elevation tiles), IGN Spain (aerial photos) | Various, incl. USA | Your IP address, browser details and the map area viewed | Drawing maps, 3D views and charts in your browser |
| Hetzner Online GmbH | Germany | Encrypted backups of the server | Off-site backup and disaster recovery |
| Hostingpalvelu.fi | Finland | Your email address and the content of service emails | Delivering emails from and to MyVeloLog |
| Superblock, LLC (Pushover) | USA | Fault alerts to the administrator, which can include a username, an IP address and a short error line | Alerting the administrator about service faults |
Strava and Garmin are independent controllers of the data in your accounts with them. Anthropic, under its commercial terms, does not use data sent through its API to train its models.
We may disclose data to authorities when Finnish or EU law requires it.
7. Transfers outside the EU/EEA
Your data is stored in Finland, and backups in Germany. Some recipients in section 6 are outside the EU/EEA:
- Switzerland and the United Kingdom have an EU adequacy decision, so no extra safeguards are needed.
- USA (Anthropic, Pushover, Strava, Garmin, and browser-loaded providers such as Plotly, Amazon Web Services and the script CDNs): transfers rely on the EU–U.S. Data Privacy Framework where the recipient is certified, or otherwise on the European Commission's Standard Contractual Clauses in the recipient's data processing terms.
We keep what crosses the border to a minimum. For example, AI features never receive your GPS track.
8. Where data is stored and how it is protected
All MyVeloLog data lives on a dedicated server in Helsinki, Finland, operated by the controller. Encrypted backups are kept on a local drive and with Hetzner in Germany.
- All traffic to the site uses HTTPS.
- Passwords are stored only as salted hashes. Repeated failed sign-ins lock the account and alert the administrator.
- Each user's data is stored separately; one user's pages cannot read another user's files.
- API keys and access tokens are kept outside the application code and the code repository.
- The server accepts administrative access only through an encrypted VPN with key-based login, sits behind a host firewall, and receives security updates automatically.
- Backups are encrypted before they leave the server.
- When diagnosing faults, the administrator may use an AI coding assistant (Anthropic) that can read server logs. These contain usernames; IP addresses, email addresses, links and access codes in them are masked. It has no access to the live service's ride, health or account files.
If a personal data breach is likely to put your rights at risk, we will notify the Data Protection Ombudsman within 72 hours and inform you without undue delay.
9. How long we keep data
We keep your data while your account exists, so your history and trends stay complete. If you ask us to close your account, we delete its data within 30 days.
| Data | Kept for |
|---|---|
| Account, activity data, .FIT files, reports, equipment and plans | Until you delete them or your account is closed |
| Health and wellness data | Until you delete it, withdraw consent and choose deletion, or your account is closed |
| Strava data | Until you disconnect Strava (then deleted at once) or your account is closed |
| AI readings | Until you withdraw AI consent or your account is closed |
| Garmin and Strava access tokens | Until you withdraw access or your account is closed |
| Password-reset links | 45 minutes, single use |
| Email-confirmation links | 24 hours |
| Sign-in log (IP address, browser, outcome) | Trimmed automatically to about the newest 5,000 entries; on account closure your name in it is replaced with "[deleted]" |
| Server logs | About 8 weeks for the application's logs, 14 days for the web server's |
| Data-export files | Removed by the administrator after delivery, and always when your account is closed |
| Encrypted backups | Up to 12 months on our own backups, plus up to 10 weeks of the backup provider's snapshots; deleted data disappears from backups as they rotate out |
Accounting records required by the Finnish Accounting Act are kept for the period that law sets.
10. Your rights
You can exercise any of these rights free of charge by emailing privacy@myvelolog.bike. We answer within one month.
- Access: get a copy of the personal data we hold about you.
- Rectification: have wrong data corrected. Most account details you can change yourself in Settings.
- Erasure: have your data deleted, including your whole account. The administrator carries out deletion on request and sends you a summary of what was removed.
- Restriction: ask us to pause processing while a dispute is resolved.
- Portability: receive your data as a zip file: your original .FIT files, ride summaries, equipment, plans, health records, AI readings and your account settings, in common machine-readable formats.
- Objection: object to processing based on our legitimate interest (section 5).
- Withdraw consent at any time in Settings, without affecting processing done before.
We may ask you to confirm your identity before acting on a request, so no one else can obtain your data.
If you think we handle your data unlawfully, you can complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), PO Box 800, 00531 Helsinki, or to the authority in your own EU country.
11. Cookies, children and changes
Cookies. MyVeloLog sets one strictly necessary cookie: a session cookie that keeps you signed in. It is sent only over HTTPS, cannot be read by scripts, and ends when you close your browser. Your browser's storage keeps display preferences such as map layers and sort orders, and the last ride description you typed in the route planner, plus the Today page's scroll position for the current visit; this stays in your browser and is not sent to us. There are no analytics, tracking or advertising cookies, so no cookie banner is needed.
Children. The service is not intended for children under 13. If we learn that a child under 13 has an account, we delete it.
Changes. We will update this policy when the service or the law changes. The date at the top shows the latest version. If a change affects how your data is used, we will tell you by email or on the site before it takes effect.
Contact. Questions about this policy or your data: privacy@myvelolog.bike, or by post to the address in section 1.