Privacy Policy

Last Updated: March 8, 2026

This Privacy Policy describes how Clocking Sweat ("we", "us", or "our") collects, uses, and handles your personal information when you use our web application located at clockingsweat.com (the "Service").

1. Information We Collect

To provide our Service, we strictly collect only the information necessary to synchronize your activities between Strava and Google Calendar:

Google Account Information: When you connect your Google account, we collect your email address, primary name, and the unique Google User ID associated with your account.
Strava Account Information: When you connect your Strava account, we collect your unique Strava Athlete ID and your preferred measurement units (e.g., kilometers vs. miles).
Authorization Tokens: We securely store the OAuth access and refresh tokens provided by Google and Strava, which allow our automated background workers to read your activities and write them to your calendar.
Application Data: We store your preference for which Google Calendar you wish to synchronize your activities to.

2. How We Use Your Information

We use the information we collect strictly to operate the core functionality of the Service:

To retrieve new workout activities from your Strava account when they are completed.
To create, update, or properly format events on your selected Google Calendar based on those activities.
To display your connection status and user preferences within the application dashboard.

3. Google API Services Limited Use Policy

Clocking Sweat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we strictly adhere to the following principles:

We do not use your Google data for serving advertisements.
We do not share or sell your data to any third parties whatsoever.
We limit our access strictly to the scopes requested (e.g., calendar.events and calendar.calendarlist.readonly) solely to facilitate the automation of writing events to your calendars.

4. Data Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personally identifiable information to outside parties. All backend systems and databases are hosted securely within Amazon Web Services (AWS).

5. Data Retention and Deletion

We keep your information only as long as you maintain an active connection between your accounts.

Account Deletion: You may permanently delete your account and all associated data at any time by clicking the "Disconnect all services" button located at the bottom of the application dashboard. This action will:

Immediately delete your user profile from our databases.
Immediately delete all of your OAuth tokens.
Revoke our application's access to your Google Calendar and Strava accounts.
Note: Deleting your account will not delete previously synced events from your Google Calendar. You must remove those manually if desired.

6. Security

We take the security of your data seriously. All sensitive information (including OAuth access and refresh tokens) is actively encrypted at rest using Amazon Key Management Service (AWS KMS) before being stored in our database. We employ strict Content Security Policies (CSP) and enforce HTTPS for all secure transit.

7. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any major changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top.

8. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us via the GitHub repository or the social links provided in the application footer.