Privacy Policy

Last updated: July 2026 (aggregate product statistics; approximate riding area; fuller description of synced activity data and ride-conditions estimation)

WaxTrack ("we", "us", "our") is a chain wax interval tracking service for cyclists. This policy explains what data we collect, how we use it, and your rights regarding it.

1. What data we collect

• Account data: your email address and a hashed password when you register.
• Platform credentials: your Intervals.icu or Strava API credentials or OAuth tokens, stored encrypted using AES-256-GCM encryption.
• Platform profile data: your display name and the athlete ID assigned to you by your connected training platform, fetched once when you connect. We use these to label your profile inside the app (e.g. in the top bar) so you can see which platform account is connected. We do not fetch or store profile photos, email addresses, or other profile details from the platform.
• Activity data: cycling activity records synced from your connected training platform — date and start time, distance, duration, activity type, the bike used, and where your platform provides them, elevation gain and power or energy figures. These are the measurements we use to work out how much wear a wax treatment has taken.
• Ride conditions: for outdoor rides we estimate whether the ride was dry or wet. To do this we read the ride's GPS trail from your platform and look up historical weather along it. We do not store your GPS trail. Only the resulting dry/wet estimate and a short weather summary (rainfall, temperature and wind ranges) are kept. You can correct the estimate at any time in the app.
• Approximate riding area: from those same rides we keep a short list of ride starting points, rounded to roughly 11 km so they cannot identify an address, capped at the 20 most recent. We use their midpoint once to work out the country and region you generally ride in, which tells us where our users actually are — signup IP addresses are unreliable for this, as many people use a VPN. We only ever store the country and region, never a town or street, and we do not use this to track your movements or individual rides.
• Chain data: bikes, chains, wax logs, and settings you create within the app. This includes anything you optionally tell us at the point of re-waxing, such as how the chain sounded and felt, and any chain-wear measurements you choose to record.
• Connection data: the IP address you used to sign up and the IP address and timestamp of your most recent login. At signup, the IP is also used for an approximate geographic lookup (country, region, city) which is stored alongside your account.

2. How we use your data

• To provide the WaxTrack service — syncing your rides and tracking wax intervals.
• To authenticate you and keep your account secure.
• To monitor signup activity for abuse prevention and to understand where our users are based (using the connection data described above).
• To produce combined, non-identifying statistics about how wax and lubricant products perform — see below.
• We do not sell, share, or use your data for advertising or marketing purposes.
• We do not share your data with any third parties beyond what is necessary to operate the service (e.g. our hosting provider).

Aggregate product statistics

WaxTrack combines data across all users to work out how wax and lubricant products actually perform in real riding — for example, the average distance riders get from a particular wax in dry versus wet conditions. This is what makes the in-app product comparisons meaningful rather than a reflection of your own settings, and it is the main way WaxTrack gets more useful as more people use it.

These statistics are aggregate and non-identifying. They describe groups of rides and products, never individuals, and we do not publish figures alongside anything that could single you out. We rely on our legitimate interest in improving the service and the accuracy of its recommendations as the basis for this processing. If you would rather not take part, deleting your account removes your data from all future statistics.

3. Data storage and security

Your data is stored on servers hosted by Railway. Platform credentials (API keys and OAuth tokens) are encrypted at rest before storage. Passwords are hashed using bcrypt and never stored in plain text.

4. Data retention

Your data is retained for as long as your account is active. You may delete your account and all associated data at any time from Settings → Account → Delete account in the app. Deletion is immediate and permanent — once confirmed, your account, profiles, bikes, chains, wax logs and synced activity history are removed and cannot be recovered.

If you are unable to use the in-app deletion flow, deletion requests sent to [email protected] will be actioned within 48 hours of receipt. The same 48-hour window applies if you disconnect a third-party platform (such as Strava) from your account: any data associated with that platform connection is removed within 48 hours of the disconnection request.

5. Your rights

You have the right to:

• Access the data we hold about you (use the in-app backup export in Settings).
• Request correction of inaccurate data.
• Delete your account and all associated data (use Settings → Account → Delete account).
• Withdraw consent for data processing at any time by deleting your account.

For anything you can't do directly in the app, contact us at [email protected].

6. Cookies

WaxTrack uses a single session cookie to keep you logged in. No advertising or tracking cookies are used.

7. Third-party services

WaxTrack integrates with Intervals.icu and Strava. Your use of those platforms is governed by their respective privacy policies. We only request the minimum access needed to sync your activity and gear data, and to identify which platform account is connected (display name and athlete ID).

To approximate the geographic region of new signups, we send your IP address to ipapi.co at registration time and store the resulting country, region, and city alongside your account. This lookup happens once per signup; we do not send your IP to ipapi.co on subsequent visits or logins.

To work out your approximate riding area (see section 1), we send a single rounded coordinate — the midpoint of your recent ride starting points, accurate to only about 11 km — to Nominatim, the OpenStreetMap geocoding service, and store the country and region it returns. This happens at most once every 90 days per account, and no individual ride, trail or precise coordinate is ever sent.

For ride weather, we send coordinates and timestamps sampled along your ride to Open-Meteo to retrieve historical conditions. These are used to produce the dry/wet estimate and are not stored by us afterwards.

8. Changes to this policy

We may update this policy from time to time. Significant changes will be communicated via the app. The "last updated" date at the top of this page will always reflect the most recent revision.

9. Contact

Questions about this policy? Email us at [email protected].