Your workouts stay on your device

Who we are

Ravalen is published by Luke Morgan, an independent developer in the United Kingdom (“we”, “us”), who is responsible for the information this policy describes (its “controller”, in the words of data protection law). For anything about this policy or your information, write to support@ravalen.co.uk.

What the app keeps, and where

The app keeps the following in its own storage on your device. None of it is sent to us or to anyone else, except as described under “Strava” below.

• Your workouts. For each one: when it was, how long and how far, your speed or pace, your heart rate if you wore a strap, on a ride your power and cadence, the incline or gradient, your laps, and the route you chose. Each is also kept as a FIT file, the kind of file Strava and other training software read.
• What your equipment sent. Beside each of your ten most recent workouts the app keeps a log of the raw Bluetooth messages from your treadmill, trainer and strap, so that a fault can be found if you ask us for help; older workouts lose it, to save space. It contains nothing those devices did not send.
• Your settings. Units, graphics, time of day, your maximum heart rate and zones, your weight and your bike's, your FTP and threshold pace, and which Bluetooth devices you have used, so that they connect again.
• Routes and workouts you have made. The routes you draw and the structured workouts you build.
• Your Strava connection, if you make one: see below.

Heart rate is information about your health. The app uses it to show you your heart rate and its zone and to record it in your workout, and for nothing else. It leaves your device only in a workout you choose to upload to Strava (below).

Bluetooth

The app uses Bluetooth to find and talk to the treadmill, trainer and heart-rate strap you choose. While it is looking, it can see the names of nearby devices that announce themselves as fitness equipment; it lists them for you to choose from and keeps only the ones you connect. It does not use Bluetooth to work out where you are, and it does not use your location at all.

Strava (only if you connect it)

Connecting Strava is optional. If you do, the app opens Strava's own page for you to give permission; your Strava password never reaches the app. Then:

• The app sends Strava the FIT file of each workout you choose to upload (one at a time, or automatically after each save if you switch that on), with a name for it and whether it was a run or a ride. The file holds what is listed under “Your workouts” above, heart rate included.
• The app receives from Strava two keys that let it upload for you, kept until you disconnect. When you connect, Strava's answer also describes your profile (your name, your Strava number and a few other details, such as your picture); the app keeps only your name, to show which account is connected, and for a week at a time, after which it asks Strava again. When it is about to upload, it reads the list of your activities that began within an hour of the workout, to check that the workout is not there already; nothing from that list is kept. And the number Strava gives an uploaded activity is kept with the workout for a week, so that the app can open it for you; after that the app finds it again when you ask, and if you have deleted it on Strava, the app no longer shows it as there.
• Where that is kept: on your device only. Your workouts, and the list of your activities, go straight between the app and Strava and never pass through us.
• Connecting goes by way of a computer of ours. Strava hands out the two keys only to a request that carries a password belonging to Ravalen itself, and that password must not be inside the app, where anyone could read it. So when you connect, Strava sends your browser back to this website with a one-time code. Our server exchanges that code with Strava for the two keys at once, adding the password, and holds the keys and your name, in its memory, for ten minutes at most, until the app collects them; then it forgets them. If the app never comes for them, it tells Strava to withdraw the permission. Every few hours after that while the app is using Strava, the app asks our server to renew the keys: it adds the password, passes the request on to Strava and passes Strava's answer back to the app. It keeps no copy of the keys or of your name, and writes none of this down.
• To stop: press DISCONNECT under Connected services in the app. It deletes at once everything the app held from your Strava account, tells Strava to withdraw its permission (if you are offline, as soon as you are next online, keeping only the key it needs for that until then) and tells you it has done so. Or remove Ravalen under “My Apps” in Strava's settings: the app deletes it all as soon as it finds out, at the latest the next time it is used with an internet connection.
• Why we may: because you ask us to, by connecting Strava and by choosing to upload. That is your consent, and for your heart rate, which is health information, your explicit consent. You can withdraw it whenever you like: switch automatic uploads off, or disconnect.
• Strava's own records: Strava may monitor and collect data about how Ravalen uses its service (which requests the app makes for you, and when), and may use that data for any business purpose of its own.

What you upload to Strava is then held by Strava under Strava's own privacy policy, which says where Strava keeps it and how it protects it; deleting it there is done on Strava. More about what is sent and when is on the Strava uploads page.

Testing a pre-release version (TestFlight)

Before Ravalen is in the App Store, people we invite test it with Apple's TestFlight app. TestFlight is run by Apple. If you are one of those testers, Apple collects the following and shares it with us, and this cannot be switched off while you are testing. Apple describes it in its TestFlight & Privacy notice.

• Who you are as a tester: the email address and the name we invited you with, and whether you have accepted and installed. If you joined through a public link, we do not see your name or email address.
• How the test version is used: which version you have installed and how many times, how many times it has been opened, how many times it has crashed and a report of each crash (what the app was doing when it stopped, and how long it had been running), and your device's model, an identifier for it, its iOS version and its language.
• Feedback, only if you send it: your comments and any screenshot you choose to send from TestFlight, with your device's mobile network, time zone, processor, connection type (Wi-Fi or mobile), free space, battery level and screen resolution, any Apple Watch paired with it, and how long the app had been open.
• A log on your device. The test version also keeps a log of what the app itself did, for the last 20 times it was opened: the equipment it connected to, the worlds it loaded, the graphics it chose and any errors. It stays on your device and reaches us only if you send it yourself, from the Files app. The version in the App Store will keep no such log.

We use all of this only to find and fix faults and to improve Ravalen. It stays in Apple's App Store Connect, where Apple keeps feedback for a year and crash reports and usage until the faults are fixed; any copy we take to look into a fault is deleted once it is fixed. To stop, leave the test in TestFlight or delete the test version. To have what we hold about you as a tester removed, write to support@ravalen.co.uk.

What we collect

Nothing, apart from what Apple's TestFlight gives us about the people testing a pre-release version (above). The app itself has no analytics, no advertising or tracking software, no crash reporting and no accounts. The one time it speaks to a computer of ours is the step described under “Strava” above, and nothing of that is kept. We cannot tell who uses the app, or anything about them.

If you write to us, we receive your email address and whatever you choose to send, and use it only to answer you. We keep the correspondence for as long as it is useful for helping you and then delete it. If you send us a workout's files or the app's log to look into a fault, we use them for that and delete them afterwards. If you send a whole folder, please leave out the file called strava.cfg: it holds the keys to your Strava connection.

This website

This site sets no cookies, uses no analytics and loads nothing from other companies: its typefaces, pictures and films are all served from the site itself. It and our server are hosted for us by Northflank Ltd, which handles what passes through them only on our behalf, on servers in London: nothing of it leaves the United Kingdom. Like any website, the computers that serve it keep a short technical log of requests (the time, the page and the address the request came from), which Northflank uses to run the service and keep it secure. We do not use it to identify anybody.

The same computers carry what connecting to Strava needs. Our own record of that is the time and whether it worked, with no address, no code and no key. The hosting log of requests may include the address Strava sends your browser back to, which carries the one-time code: such a code works only once, and our server uses it at once. So that the service cannot be misused, our server also counts how many such requests have come from each address in the last quarter of an hour; the count is held in its memory only and then dropped.

Why we may use your information

• Strava: your consent, given by connecting and by choosing to upload; for your heart rate, your explicit consent. Withdraw it by switching automatic uploads off or by disconnecting.
• Your emails to us: our legitimate interest in answering you and helping with the app.
• What TestFlight gives us: our legitimate interest in finding and fixing faults before the app is released.
• This website's technical log: our and Northflank's legitimate interest in running the site and our server securely.

Children

Ravalen is not directed at children under 13, and we do not knowingly hold information about anyone.

Your choices and your rights

Because your information is on your own device, you are in control of it. Delete a workout in History; delete a route or a workout you made where it is listed; disconnect Strava under Connected services, which deletes everything the app held from your Strava account and tells you so; or delete the app, which removes everything it has kept. On an iPhone you can see everything the app keeps in the Files app, under On My iPhone, Ravalen, and share a workout's FIT file from there.

You also have rights under data protection law, such as to ask what we hold about you, to have it corrected or deleted, and to complain to the data protection authority where you live (in the United Kingdom, the Information Commissioner's Office). As we hold nothing but any emails you have sent us and, if you are testing through TestFlight, what Apple shares with us, the quickest way to use those rights is to write to support@ravalen.co.uk. If you ask us to delete something, we do it within 30 days and confirm by email that it has been done.

Changes

If the app or this site ever begins to handle your information differently, this page will say so before it happens, and the date at the top will change.