Privacy Policy

Overview

RouteFuel™ ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our application. This policy covers both the RouteFuel web application and the RouteFuel Live iOS companion app.

Information We Collect

Account Information

• Username and email address (for traditional registration)
• Securely hashed password (we never store plain-text passwords)

Strava Data

When you connect your Strava account, we access:

• Your Strava athlete profile (name, profile picture)
• Your activity data (routes, segments, timestamps, GPS coordinates)
• Segment effort details and statistics

We only access data you authorize through Strava's OAuth process. You can revoke access at any time through your Strava settings.

Spotify Data

When you connect your Spotify account, we access:

• Your Spotify user profile
• Your playlists and saved tracks
• Ability to create playlists on your behalf in either your Spotify account or in the RouteFuel system account on Spotify
• Playback control using the RouteFuel iOS companion app (aka RouteFuel Live)

We only access data you authorize through Spotify's OAuth process. You can revoke access at any time through your Spotify account settings.

RouteFuel Live iOS App Data

When you use the RouteFuel Live iOS companion app to track a live activity, we collect:

• Background location — The app requests "Always On" location permission so that GPS tracking continues while your phone is locked or in your pocket. We collect latitude, longitude, altitude, bearing, speed, and accuracy for every location point during your activity.
• GPS trace — The full sequence of location points captured during your activity is uploaded to our servers at the end of the activity and associated with your activity record.
• Activity metadata — Activity name, start and end times, duration, distance, and elevation.
• Music Pin trigger events — Which Music Pins fired during your activity, including timestamps, your distance and bearing relative to each pin, and your speed at the time of trigger.
• Spotify playback events — For each Music Pin that triggers, we record the track queued or played, how long you listened, whether you skipped it, and the track that was playing before the pin interrupted (if applicable). This data is used to power your post-activity Musical Journey timeline and improve Music Pin recommendations.

Location data is used solely to detect Music Pin boundaries and record your activity. We do not share your GPS trace with third parties or use it for advertising purposes.

How We Use Your Information

• Display your Strava activities on interactive maps
• Enable creation and management of Music Pins™ on your existing activities & routes
• Trigger music playback in real time as you enter Music Pin boundaries during a live activity tracked by RouteFuel Live
• Provide AI-powered music recommendations based on segment data from Strava or RouteFuel Live activities
• Create Spotify playlists from your Music Pins™
• Improve and personalize your experience

Cookies & Local Storage

Web application — RouteFuel uses session cookies to:

• Keep you logged in during your browsing session
• Maintain your authentication state with Strava and Spotify
• Store temporary session information

Our session cookies are:

• Essential only - we do not use tracking or advertising cookies
• Secure - cryptographically signed to prevent tampering
• Session-based - cleared when you close your browser

RouteFuel Live iOS app — The iOS app does not use browser cookies. Instead, it stores the following data securely on your device using iOS Secure Enclave-backed storage (Keychain):

• Your RouteFuel authentication token
• Your Spotify access and refresh tokens
• Your cached user profile

On-device tokens are stored with iOS "After First Unlock" accessibility so background location and music playback work while your phone is locked during an activity. This data never leaves your device except as part of normal API communication with our servers over HTTPS.

Data Security

• Passwords are securely hashed using industry-standard algorithms
• OAuth tokens are stored securely and refreshed automatically
• All data transmission uses HTTPS encryption
• On-device credentials in the iOS app are stored using iOS Keychain-backed secure storage
• We do not sell or share your personal data with third parties

Third-Party Services

RouteFuel integrates with the following third-party services:

• Strava - For activity and segment data (Strava Privacy Policy)
• Spotify - For music playback and playlist creation, including the Spotify iOS SDK used by RouteFuel Live for native playback control (Spotify Privacy Policy)
• OpenStreetMap - For map tiles on the web application (OSM Privacy Policy)
• Apple - The RouteFuel Live iOS app is distributed through the Apple App Store and uses Apple platform services including CoreLocation for GPS and the iOS Keychain for secure credential storage (Apple Privacy Policy)

Your Rights

You have the right to:

• Access your personal data stored in RouteFuel
• Request deletion of your account and associated data, including any GPS traces and activity records
• Disconnect your Strava and/or Spotify accounts at any time
• Revoke OAuth permissions through Strava or Spotify settings
• Revoke location access for the RouteFuel Live iOS app at any time through iOS Settings › Privacy & Security › Location Services

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at help@routefuel.ai.