Privacy policy

Who we are

Gruzo (gruzo.app) is an independent project run by Yannick Lombart in Belgium, who is responsible for the personal data described here. Questions about your data, or a request for a postal address, go to hello@gruzo.app.

What we collect

Your account

Your email address, which is how you sign in: we send you a one-time code. If you signed in with Facebook before, Facebook told us your name, your email address and your profile picture. We asked for nothing else from Facebook and never posted anything there. Signing in with Facebook is no longer possible.

Your profile

Your full name, birth year and gender, if you fill them in. All three are optional and only you and the admin can see them.

Verified rides

When you verify a ride you upload a GPX or FIT file. We read it in memory, check which route you rode, and then throw the file away. The track itself is never stored. What we keep is the result: which route you rode, when you started and finished, the distance, the climbing, how much of the route you covered, and a fingerprint of the file so the same file can't be counted twice. Your XP, level and Territory are calculated from these results.

Your rides are visible only to you. Other people see just the total number of verified rides on a route. Rides from Strava count in that total only if you allow it (see below).

Strava

Only if you connect Strava. Gruzo then reads your bike activities since 1 January 2026, with their GPS track and timestamps, and new rides as Strava tells us about them (through Strava's webhook). Like an uploaded file, the track is read in memory to check which route you rode and then thrown away.

What we keep: the access tokens we need to talk to Strava on your behalf, your Strava athlete number, the rides that matched a route (stored like an uploaded ride, with the Strava activity number), and a list of the activity numbers we already checked, so we don't fetch them again. Nothing else from Strava.

Strava rides count only for you: your XP, level and Territory. If you also turn on "Count my Strava rides on the Wall" in your settings (only possible while you're on the Wall of Fame), they count on the Wall and in the number of verified rides on a route as well.

You can disconnect Strava in your settings, or remove Gruzo in your Strava settings. Either way, your Strava rides, the list of checked activities and the tokens are removed from Gruzo. Rides you uploaded as a file stay.

Wall of Fame

Only if you opt in. Then the Wall shows your rank, the display name you chose and your number (off-road km or share of the network explored), to anyone, signed in or not. You can switch it off in your settings at any time and you disappear from the Wall right away.

How you use Gruzo

Which routes you open and download, what you search for, and, if you search near your current location, the coordinates of that search. When you're signed in these are linked to your account, so we can remember your downloads and see which routes and regions people are interested in. We don't store your IP address with any of this.

Newsletter

Only if you tick the box. We store your email address and when you confirmed. You first get an email with a confirmation link (double opt-in), and every newsletter has a link to unsubscribe. You can also switch it off in your settings.

Technical data

Like any website, our servers see your IP address and browser when you visit. We count page visits with Vercel Web Analytics, which uses no cookies and doesn't identify you. When something breaks on our server, an error report goes to Sentry so we can fix it.

Why we use it

• To run the service you signed up for: your account, ride verification, XP, levels, Territory and your downloads.
• With your consent: the newsletter, the Wall of Fame, connecting Strava (and counting your Strava rides on the Wall), and searching near your location. You can withdraw consent at any time, and that doesn't affect what happened before.
• Because we have a legitimate interest in it: keeping Gruzo secure and free of bots, fixing errors, and knowing which routes and regions people use, so we know which routes to add.

Who else handles your data

We use a few services to run Gruzo. They only process your data for us, not for their own purposes.

• Supabase: database and sign-in.
• Vercel: hosting and visitor counts.
• Resend: sending our emails, such as the newsletter confirmation.
• hCaptcha: checks that you're not a bot when you sign in. It sees your IP address and browser details.
• Sentry: error reports from our server.
• Facebook: only if you signed in with Facebook before.

If you connect Strava, we read your activities from Strava with the access you gave us there. Strava is not a service we hire: it has your data because you use it, under its own privacy policy. We send Strava only the requests for your own activities.

The map tiles load directly from OpenStreetMap, which therefore sees your IP address. Our fonts and map library come from our own servers. To turn a place name or your location into a search, our server asks OpenStreetMap's Nominatim; your IP address isn't sent along with that.

Some of these companies are based in the United States. Where data leaves the European Union, they rely on the safeguards the GDPR requires, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

We never sell your data and never share it for advertising.

Cookies and storage on your device

We use no advertising or tracking cookies, which is why there's no cookie banner. What we do store:

• Sign-in cookies, to keep you signed in.
• gruzo_search, a cookie with your last search (place name or "near me", and the radius, never your coordinates) so the next visit starts where you left off. It lasts 180 days.
• Local storage in your browser: which routes you downloaded in the last 30 days (so we can suggest verifying them), your share-card design, and whether you closed the install prompt.
• An app cache, so Gruzo works as an installable app. It holds the app's own files, none of your data.

How long we keep it

• Your account, profile and verified rides: until you delete your account.
• Strava tokens, Strava rides and the list of checked activities: until you disconnect Strava or delete your account.
• Views, downloads and searches: when you delete your account, they're no longer linked to you. We keep only the anonymous counts.
• Newsletter: until you unsubscribe. Deleting your account removes you from the newsletter as well.
• Error reports and visitor counts: for as long as Sentry and Vercel keep them under their own retention rules.

Your rights

Under the GDPR you can ask to see the data we have about you, to correct it, to delete it, to get a copy to take elsewhere, to limit what we do with it, or to object to it. Email hello@gruzo.app and we'll answer within a month. You can change your name, profile, newsletter and Wall of Fame choices yourself in your settings.

To delete your account, see Delete your data.

If you think we're handling your data wrongly, you can complain to the Belgian Data Protection Authority (dataprotectionauthority.be). We'd appreciate the chance to sort it out with you first.

Children

Gruzo isn't meant for children under 13. If you're a parent and your child created an account, let us know and we'll delete it.

Changes

When Gruzo starts doing something new with your data, this page changes first and the date at the top changes with it. If the change is significant, we'll tell you in the app or by email.