Privacy Policy

1. Who we are

Combatif is a competition platform, made for cycling first and open to other sports with a GPS track. You can join competitions and clubs, import or upload your activities, and see results. "We", "us" and "our" mean Combatif, which is responsible for the personal data described here.

Questions about this policy or your data: support@combatif.com

2. What data we collect

• Account: display name, email address and password. The password is stored only as a salted PBKDF2 hash, never in plain text. Optionally phone number, birth year, country and gender (used for age and gender categories). We also store when you accepted this policy, a two-factor authentication key if you turn that on, and a link to your Google account if you sign in with Google.
• Activities: activities you import from a platform you connect (Strava, intervals.icu or Garmin Connect, see section 12) or upload as a file. This includes name, type, start time, duration, distance and elevation, and when your file or platform provides them, the GPS route, speed, power, heart rate and device name. Heart rate is only kept if you have said yes to it (see section 4). We keep the original file you uploaded or we imported, so results can be recalculated. Without your consent to heart rate, we keep a copy of the file with only the route, elevation and times instead of the original. When the same ride arrives from more than one platform, we keep the data of one copy only, from the source you rank highest under Settings, Activity sources, and for the others just the platform's name and activity id, so we can link to it.
• Connected platforms: your user ID on that platform, when you connected and last synced, and the access tokens needed to fetch your activities.
• Competitions and clubs: competitions you join and your results, clubs you belong to and your role, and what you post there: posts, comments, reactions, event replies, images and route files. Also routes (Parcourses) you create or save.
• Notifications and settings: your notifications and the choices you make about them.
• Reports and moderation: see section 7.
• Email: a record of the emails we send you (for example verification, password reset and notifications).
• Technical data: IP address, browser and requested page, in our hosting providers' logs, used for security and operation.
• Analytics, only if you agree: see section 8.

3. Who can see what

• Other signed-in users can see your display name, your results and your activities, including the map of the route and, when your activity has it, your heart rate. You can hide any of your activities from other riders on the activity itself.
• Privacy zones: in Settings, under Privacy, you can mark up to five places, such as your home, with a radius of 200 metres to 2 kilometres. Other people never see the part of a route that falls inside a zone. Other riders can make a Parcourse from an activity of yours that they can see, but only from the part outside your zones, and never from an activity you have hidden. Zones apply to all your activities, also older ones, and you always see your own full route.
• Heart rate: in the same place you can hide your heart rate. When it is hidden, nobody but you sees it, and that includes platform administrators. We still store it, and it is in your data export.
• Storing heart rate at all: also under Privacy. Turning it off deletes the heart rate already stored with your activities, including in the files, and new activities are stored without it.
• Club posts, comments and events are visible to the members of that club. If a club has sharing turned on, members can create a link that shows a short preview of a post or event to anyone who has the link.
• Your country is shown on your profile. Your birth year and gender are used to place you in age and gender categories. Your email address and phone number are not shown to other users.

4. Why we use your data, and on what legal basis

• To provide the service you signed up for (account, competitions, clubs, results, emails you need): performing our agreement with you, GDPR Article 6(1)(b).
• To import activities from a platform you connect: your consent when you connect it, Article 6(1)(a). You can disconnect at any time.
• Heart rate is health data under GDPR Article 9. We only store it with your explicit consent, Article 9(2)(a), which you give or refuse when you create your account (or the first time you sign in after this was introduced). It is a separate choice from accepting the terms, and saying no changes nothing else about the service. You can withdraw it at any time under Profile, Privacy, and the heart rate we hold is then deleted. We only use it to show it with your activities.
• Security, abuse prevention, moderation and keeping competitions fair: our legitimate interests, Article 6(1)(f).
• Analytics: your consent, Article 6(1)(a), see section 8.

We do not sell your data and we do not use it for advertising.

5. Map and location services

Maps on Combatif load their map images from OpenStreetMap (openstreetmap.org, run by the OpenStreetMap Foundation in the UK), which receives your IP address and browser details when a map is shown. To turn coordinates into place names and to look up elevation, our server sends coordinates or the place you searched for to OpenStreetMap's Nominatim service and to Open-Elevation. These services receive the coordinates or search text from our server, not your IP address.

6. Service providers and transfers outside the EEA

These companies process data for us under data processing agreements, only to run Combatif:

• Fly.io (USA) hosts our servers and database in Amsterdam. Backups of the database volume and platform logs are processed in the USA.
• Netlify (USA) hosts the website. Its access logs are processed in the USA.
• Resend (USA) sends our emails. It stores email data in the USA.
• Cloudflare (USA) stores files. Your original activity files are kept in private storage restricted to the EU. Club images and route files are kept in public storage in Europe, but that location is not guaranteed to stay in the EU.
• Sentry (USA) receives error reports from our servers, stored in Frankfurt, Germany. A report holds the error and where in our code it happened. We remove your name, email, IP address, cookies and anything you typed before it is sent.
• Cloudflare Turnstile (USA) checks that a person, not a bot, is creating an account, asking for a password reset or asking for a new verification email. It only runs when you submit one of those forms, and reads your IP address and browser signals. Cloudflare also uses those signals for its own purpose of improving Turnstile, and is responsible for that itself.
• Upstash (USA) runs our job queue in Frankfurt, Germany.
• PostHog (USA), only if you accept analytics. Data is stored in Frankfurt, Germany.

Where data goes to the USA, the transfer relies on the EU-US Data Privacy Framework, which these providers are certified under, and on the European Commission's standard contractual clauses. Transfers to the UK rely on the EU's adequacy decision for the UK.

Platforms you choose to use are responsible for their own processing: Strava, intervals.icu and Garmin if you connect them, and Google if you sign in with Google. Their own privacy policies apply to what they hold.

7. Moderation data

Keeping competitions honest means holding some data about reports and decisions. This section says what, and for how long.

• If you report an activity, we store that you reported it, the reason you selected, any comment you wrote, and when. This is visible only to platform administrators. Below a threshold we set, it is not visible to the rider concerned.
• We keep reports even after deciding they were not well founded. The pattern of who reports whom over time is what lets us identify reports being used to target a particular rider. A record consisting only of upheld reports could not show that.
• If you delete your account, the reports you submitted are deleted with it.
• If you report a club post, comment or event, we store the reason, any comment you wrote, and when. The moderators of that club and platform administrators see the report and your name. The author does not. A moderator can hide the content or dismiss the report. The report is kept for as long as the content exists and is deleted together with it, with the club, or with your account. If the moderator who handled it deletes their account, the record of who handled it is removed.
• Decisions made by platform administrators are kept, including the name of the administrator who made them, even if that person later closes their account. This lets us answer why an activity was excluded from a competition, which is in the interest of the rider affected. We rely on legitimate interests for this.

8. Analytics, cookies and browser storage

When you first visit, we ask whether we may use analytics. If you say no, no analytics script is loaded. You can change your answer at any time with Cookie settings at the bottom of every page, and declining there stops analytics and deletes its cookies from your browser.

If you say yes, we use PostHog to see which pages and features are used. That includes session recordings that show layout, clicks and scrolling, with all text, everything you type, all images, maps and charts hidden, so no route or heart rate is recorded. PostHog links this to a random ID for your account, never your name or email address. It keeps events for up to 7 years and recordings for 30 days.

Your browser stores the following:

We do not use advertising cookies.

9. How long we keep data

• Your account data is kept for as long as you have an account.
• Accounts whose email address is never verified are deleted after 7 days.
• Records of emails we sent, and of emails that could not be delivered, are deleted after 90 days.
• Hosting logs: Fly.io keeps them for 7 days, Netlify for 90 days and up to 1 year in its backups.
• Error reports in Sentry: up to 90 days, usually 30.
• Database backups: daily snapshots at our hosting provider are kept for 5 days, and an encrypted nightly copy in our private storage in the EU for 35 days. Data you delete, or an account you close, is gone from all backups once they expire.

When you delete your account (you confirm it with your password, or with your email address if you only sign in with Google) we delete your profile, your activities and their original files, your results, club memberships and competition entries, your connected platforms (and we withdraw our access at Strava, intervals.icu and Garmin), reports others made about your activities, and every email to your address. Where other people's posts, comments or notifications mention you, the mention becomes "@[deleted]", with no link to your account. Competition rankings are recalculated without you. If you were the only admin of a club or competition, another member takes over, so it can still be managed.

What stays: posts, comments and events you wrote in clubs, and routes you created, remain visible to others, shown as written by "[deleted]". Moderation decisions you made as an administrator are kept as described in section 7. Deleted data can remain in database backups for up to 5 days.

10. Your rights

• Access and portability (Articles 15 and 20): on the Profile page you can download everything we hold about you as a ZIP file: every record that refers to you, in machine-readable JSON, and the original files of your activities. Only security secrets such as your password hash and access tokens are left out.
• Correction (Article 16): you can change your display name, email, phone number, birth year, country and gender on the Profile page.
• Erasure (Article 17): you can delete your account on the Profile page, with the results described in section 9.
• Withdrawing consent (Article 7): analytics with Cookie settings, a connected platform by disconnecting it on the Profile page. This does not affect what was done before you withdrew.
• Objection and restriction (Articles 18 and 21): email us.
• Complaints: you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or the authority where you live.

For anything not available directly in Combatif, email support@combatif.com.

11. Security

All traffic to Combatif is encrypted. Our database is not reachable from the internet and its storage is encrypted. Access to data is checked on our server for every request. You can protect your account with two-factor authentication on the Profile page. Passwords are stored as salted PBKDF2 hashes, never in readable form. When you choose a new password we check it against passwords known from data breaches using Have I Been Pwned: only the first five characters of a hash of the password are sent, so neither the password nor anything that identifies you leaves our server.

12. Garmin Connect data

You can connect your Garmin account under Profile, Settings, Connected Platforms. This section says how data from Garmin Connect is handled.

What we receive and how we use it. When you connect your Garmin account, you choose on Garmin's own page what Combatif may read. With activity sharing on, Garmin sends us each activity you record after connecting, as the file your device recorded: type, name, start time, duration, distance, elevation, the GPS route, and when your device records them, speed, power, heart rate and device name. Heart rate is only kept if you have consented to it (section 4). We also store your Garmin user ID and the access tokens Garmin gives us. We use this data only to show your activities in Combatif, to place them in the competitions you take part in, to match them against routes (Parcourses), and to calculate results. We do not use it for advertising, profiling or any other purpose. An activity without a GPS route, such as a strength session, is not stored.

Sending Parcourses to your Garmin device. When you choose Send to Garmin Connect on a Parcourse, or send all your saved Parcourses, we send each one to your Garmin Connect account as a course: its name, description, the start, checkpoints and finish with points along straight lines between them, the distance, the climbing and the activity type. Garmin then puts it on your devices. You allow this on Garmin's page when you connect, and you can turn it off there. We store which Parcourses you sent, so sending again updates the same course. That record is deleted when you disconnect Garmin or delete your account. The course itself is yours in Garmin Connect, under Garmin's privacy policy, until you delete it there.

Who receives or processes Garmin data. Only the service providers that run Combatif, under data processing agreements (section 6):

• Fly.io hosts our servers and database in Amsterdam, where your Garmin activities are stored. Database volume backups are processed in the USA.
• Cloudflare stores the activity files, and our encrypted nightly database backup, in private storage restricted to the EU.
• Upstash runs our job queue in Frankfurt, Germany. A job holds what is needed to fetch one activity: the IDs, the activity's name and type, and Garmin's one-time download link. It never holds the route or other content, and is removed once handled.
• Sentry receives error reports, stored in Frankfurt, Germany. If importing a Garmin activity fails, a report can contain that activity's ID, never its content.

No other company receives Garmin data. Our email provider, Netlify and PostHog never receive it: emails do not contain activity data, Netlify only serves the website files, and PostHog recordings hide all text, maps and charts (section 8).

Sold or shared? We never sell Garmin data and never give it to a third party for its own use. Inside Combatif, other signed-in users see your activities and results as described in section 3, and you can hide any activity, hide your heart rate and set privacy zones. Activities from Garmin are marked as coming from Garmin Connect.

AI transparency statement. Combatif does not use any artificial intelligence system to process Garmin data or anything derived from it, and never uses it to train, evaluate or improve AI models. Our service providers' AI features are turned off for our data. If we ever want to use AI on Garmin data, we will ask for your explicit consent first, in Combatif, with a clear way to withdraw it, and nothing changes until you say yes.

Your control over Garmin data:

• Access and export: your Garmin activities, with their files, are in the ZIP you download on the Profile page (section 10).
• Correct: you can rename an activity in Combatif, and change its data at Garmin, where you recorded it.
• Delete: you can delete any activity, which also deletes its file, or your whole account (section 9).
• Withdraw consent: disconnect Garmin on the Profile page, or remove Combatif in Garmin Connect's account settings. We then stop receiving activities, delete our access tokens and end our registration at Garmin. Activities already imported stay until you delete them or your account. Deleting your account also ends the registration at Garmin. You can also withdraw your consent to heart rate at any time (section 4).

Garmin is responsible for the data it holds itself, under Garmin's privacy policy.

13. Changes to this policy

When we change this policy we update the date at the top. If a change affects something you consented to, such as analytics, we ask you again.