Privacy notice

Last updated Sat 14 Nov 2026.

This says what SupraMonta holds about you, why it is allowed to, who else sees it, how long it stays, and what you can make it do about any of that. It covers this installation of the software and nothing else.

Who is responsible for your data

The controller - the organisation or person who decides what happens to your data, and who you can hold to this notice - is Gabriel P.

Reach them about anything on this page at privacy@supramonta.com.

No data protection officer is appointed. One is required only where an organisation's core activity is large-scale monitoring or large-scale special-category processing, which this is not; if that changes, so does this paragraph.

What is held, why, and what allows it

Every row is a thing this application actually stores. The last column is the part of Article 6 - or, for the special-category rows, Article 9 - that permits it.

Your sweat figures are worked out automatically from your own data, which the law calls profiling. Nothing here decides anything about you without a person involved: there is no automated decision-making of the kind Article 22 is about.

Your sweat figures on the User Biometrics page are worked out automatically, from a fixed table, your own weigh-ins and your sweat tests. They decide nothing for you, and each one says where it comes from.

Where it comes from

Your account details come from you, when you type them in.

We ask your date of birth once, when you sign up, and do not keep it. You have to be at least 16 to have an account here, because this application holds heart-rate and location data and the law protects both more strongly for children. The date is used to work out the answer and then discarded — what is kept is that the question was asked, when, and what the age limit was at the time. There is no way here to ask a parent or guardian instead, so under that age the answer is no.

If your account is older than that question, we will ask you now. Accounts made before we started asking never answered it, and we do not treat silence as a yes. You will see a notice on every page with a date on it; confirm on your profile page and nothing changes. If you do not, syncing stops. You can no longer give any consent, choose to keep what your Strava privacy settings restrict, upload a plan, or add or change anything on the User Biometrics or User Preferences page or the Sport tab of your Pantry, and nothing more of yours goes into the copy used for training. Downloading everything held about you, deleting your account or anything on those pages, seeing the activities already here and withdrawing any consent all go on working, because those are your rights rather than something we do to you. Nothing is deleted.

Your activities and their telemetry come from Strava, through the authorisation you grant when you connect your account. They are your data and Strava already holds them; connecting asks Strava to hand a copy to this application.

Your Strava privacy settings come with them, and are obeyed here. If you have turned off heart-rate sharing on Strava, no heart rate is requested or kept for that activity — not the detailed recording and not the average and maximum either, and anything already stored is removed at your next sync. If an activity is private, or visible only to you or to your followers, the detailed recording is not collected for it at all. The activity itself is still synced, because that is what you asked this application to keep.

You can choose to keep them anyway. Those settings decide who sees an activity on Strava, and nobody but you sees anything here. So your profile page has a box that keeps the detailed recording and the heart rate of the activities they restrict. It is unticked unless you tick it, and it works only with your consent to heart-rate data. Unticking it deletes what it kept straight away. Nothing changes on Strava either way.

Who else sees it

• Strava, which we ask for your data on your behalf.
• The mail provider this installation sends through, which carries password-reset and address-confirmation messages to you, the warnings described below, and the message that an archive you asked for is ready, and, where you turned it on, the message on your Friday that next week has nothing planned.
• The object storage provider this installation keeps telemetry and the archives you ask for with, in the sense that the telemetry files — including your heart rate, if you ticked the box for it — and the copy used for training — if you agreed to it — and the archive of everything held about you — once you ask for one, and for as long as it can be downloaded — sit on their machines.
• Whoever hosts this installation, in the sense that the database and its backups sit on their machines.

Nobody else. There are no advertisers, no analytics, no trackers and no third-party scripts — the pages load nothing from anywhere but this site, and the Content-Security-Policy they are served with makes that a rule the browser enforces rather than a promise you have to take on trust. Your data is not sold, and it is not shared with anybody for their own purposes.

Data leaving the UK and the EEA

Strava is a company in the United States, so connecting your account sends a request there and receives your activities back. That transfer happens under Strava's own terms with you, which you accepted when you made your Strava account.

Where the hosting, object storage and mail providers for this installation are, and what makes sending data to them lawful — an adequacy decision, standard contractual clauses, or neither because they are inside the UK or the EEA — depends on who runs it, and is not supplied by whoever runs this installation.

How long it is kept

• Your account and activities: until you delete your account, or until it has gone unused for 24 months — nobody has signed in to it, or used it while signed in. Then we write to the email address your account has at that time, if it is confirmed — an address you changed counts once you have confirmed the new one — and delete the account and everything here with it 30 days later, unless you sign in before then. Signing in is all it takes to keep it. If the address is not confirmed, or the message cannot be delivered, the account is deleted all the same, when those 30 days are up; while a restriction you asked for is in force, it is not deleted. An account nobody uses is data kept for nothing, and the person who forgot it is the one least likely to ask us to delete it.
• Where your runs started and finished: 365 days, or not at all if you say so — see below. A run that begins at your door records where you live, and a long enough record of them says when your home is empty and for how long — so after 365 days those exact positions are cleared. The activity stays: the distance, the times, the pace, the elevation, the city, state and country it was in, and its heart rate while you consent to keeping that. It is the doorstep that goes, not the run.
• Telemetry, and the average and highest heart rate and relative effort of each activity: until you withdraw consent, which deletes them immediately, or until you delete your account.
• The copy used for training: until you withdraw that consent, which deletes it immediately, or until you delete your account. An activity you delete leaves it straight away.
• Your sport nutrition: until you delete a product or your account.
• Your goal, your diet and the cuisines you like or avoid: until you change them or delete your account.
• Your dietary restrictions: until you untick one, withdraw that consent — which deletes all of them immediately — or delete your account.
• Your planned sessions: until you delete one, upload a plan over its day, or delete your account. A session's fuelling target is kept with it, until you clear the target; a plan uploaded over its day carries it to the new session of that day and sport nearest in length.
• What you took during a session: with its activity, until Strava tells us you deleted it there — what came off your counts stays off, since you ate it — until you delete the answer, or delete your account. A question you never answered, or said was not that session, goes 14 days after the activity's day, unless a restriction you asked for is in force. Deleting the session, or moving it to another day or sport, leaves what you took without it, and your menus stop counting it.
• Your weight and HRV, your weigh-ins around a session, and your sweat tests: until you delete one, withdraw that consent — which deletes all of them immediately — or delete your account. A weigh-in also goes with its activity, if you delete that on Strava, and how warm you said the session was goes with its weigh-in. A sweat test more than two years old is kept until you delete it, and used for nothing. Your sweat and sodium figures are not kept at all: they are worked out when you look, and when your archive is made.
• Your height, sex and age band: all three until you delete them, choose on the User Biometrics page to keep your entries only or not to keep your body data, or delete your account. An age band stays as you chose it, and does not move on as you get older.
• The archive of everything held about you, once you ask for one: 7 days from when it is made, for you to download, and then it is deleted, within two hours. It goes sooner if you ask for a new one, withdraw a consent to data it holds, or delete your account. Making it and each download are recorded as reads, as below.
• Your session: 30 minutes, renewed while you are using the site. Signing out ends it at once.
• A device you ask to keep you signed in, by ticking “Keep me signed in on this device”: 30 days after you last used it, each visit renewing it. What it holds is good once and replaced at each use; only a hash of it is kept here, with when it was given, used and ended — no address, browser or place — each for 30 days. Signing out on that device, “Sign out everywhere else”, or changing or resetting your password ends it at once.
• Password-reset links: 30 minutes. Address-confirmation links: 1440 minutes. Both are single-use and only a hash of each is stored.
• Warnings about changes to your account are sent and not stored — there is no record here that one went out beyond the ordinary server log.
• Failed sign-in attempts: 15 minutes, after which the rows are dropped.
• A record of who read your health data and dietary restrictions: 365 days. Every time your heart rate or telemetry, your weight and HRV, your height, sex and age band, or your dietary restrictions are read out of here — by you, by an administrator, or by this application itself — the fact is recorded: when, what, how much, and which page did it, or, for this application's own reads, what they were for. Never the data itself. It is how we could tell you what was affected if this service were ever breached, which the law gives us 72 hours to do. It outlives your account; see below.
• A record that your account was deleted: 365 days after the deletion finished. The number your account had, when and why it was deleted, and how far each store had got — nothing else of yours. It too outlives your account; see below.
• A record of what a withdrawal or the age question deleted: 365 days after that deletion finished. Made each time you withdraw your consent for telemetry or for training, or tell us you are under 16 while you consent to training: which it was, when and why, and how far each store had got — counts, never what was deleted. It is in your archive, and it can outlive your account too; see below.

When your data is actually gone

Deleting your account removes it, your activities, your telemetry files and everything else above from the live database straight away, and hands the Strava authorization back to Strava on the way out — afterwards the credentials are gone from here, so this is the last moment anything here can end that. Copies remain in backups for up to 30 days, because backups are taken on a schedule and are not edited afterwards — a backup somebody has been reaching into is not one you can restore from.

Those backups are encrypted, are not read except to restore from, and rotate out on their own.

Your telemetry files are not kept that way. The storage they are in keeps no previous version of a file, so a deleted one is gone from it at once. The backups hold the list of your telemetry files, not what is in them.

If a store does not delete something straight away, it is asked again every fifteen minutes until it has, and we are told if that takes longer than a day. Whoever runs this service also checks, with a key only they hold, that nothing of yours is left where your files were kept.

The models trained on the copy used for training are kept. A model is a handful of numbers worked out across everybody who agreed, not your activities, and nothing in it says who you are. Its record does keep when the latest activity it learnt from started, to the second, which may be one of yours. Every model made now is worked out across at least five people; one made before that rule is kept, but no longer used. What a model was trained from goes the night after your account does, and a model that learnt from you can then no longer be trained again the same way.

Three records are deliberately kept longer, and none of them holds your data itself. The record of who read your health data and dietary restrictions stays for 365 days, including after you delete your account. It holds no heart rate, no location and nothing you wrote — only that a read happened, when, and how much it covered. It is kept because somebody who broke into an account, took everything in it and then deleted the account would otherwise erase the only evidence that it happened, and because the law requires us to be able to tell you what was affected after a breach. The law that gives you erasure says so too: Article 17(3)(b) and (e) keep what is needed for a legal obligation and for legal claims. So is the record that your account was deleted: the number it had, when and why, and how far each store had got — nothing else of yours — kept as long after the deletion finished, so that we can show it was done. And so are the records of what was deleted when you withdrew your consent for telemetry or for training, or told us you are under 16: each is kept 365 days after that deletion finished, whether your account is still here or not.

So 30 days is the outside figure for your data being gone, and 365 days is the outside figure for the record that it was read. The record that it was deleted is kept for 365 days counted from when the deletion finished: once every copy this service keeps in storage has gone and whoever runs it has checked that nothing of yours is left, which waits on them. That does not wait for what a model was trained from, which goes the night after your account does, as above.

What you can do about it

These are your rights under Chapter III, and where each one already has a button.

• See what is held (Article 15) — "Download your data" on the profile page gives you the lot in one archive: your account, every activity, the telemetry behind them, any linked sign-in account, and your consent history. It also lists what is deliberately left out and why. The sweat and sodium figures worked out from the body data you chose to keep are in it too, worked out when it is made. It is made when you ask for it, which can take a few minutes, and you download it there, signed in, for 7 days; we email a confirmed address when it is ready, with no link in the email. Your details are on that page and your activities on the dashboard if you would rather just look.
• Correct it (Article 16) — the profile page edits your name, username and address. If your account has no password, set one first to change the address.
• Delete it (Article 17) — "Delete account" on the profile page, which is immediate and cannot be undone.
• Take it with you (Article 20) — the same archive. CSV, JSON and Parquet, all of them formats another application reads. The CSV export on the dashboard is still there if you only want the activities and only want a spreadsheet.
• Withdraw consent (Article 7(3)) — untick the box: on the profile page, the one for heart rate or the one for training; on the User Preferences page, the one for your dietary restrictions. On the User Biometrics page, choose “Don't keep my body data”. Each is as easy as agreeing was, and each deletes what it covered — the telemetry already collected, the copy used for training, every restriction you ticked, or every weight, HRV and sweat test you entered and your height, sex and age band. Choosing “Keep my entries” instead of the option that also uses your latest weight for menu calories takes back only that, and deletes only your height, sex and age band. Withdrawing does not make what happened before it unlawful.
• Ask us to freeze it (Article 18) — “Restrict, or object” on the profile page. It takes effect the moment you ask, before we have decided anything: syncing stops, and nothing here deletes your data while it lasts — not even the tidying-up that normally clears where old activities start and end. Only these still go by age while it lasts: the archive you asked for, when its 7 days are up — it is a copy, and what it copies stays; the copies in our backups, after 30 days, for the same reason; the record of who read your health data and dietary restrictions, after 365 days; the record of what was deleted when you withdrew your consent for telemetry or for training, or told us you are under 16, after 365 days counted from when that deletion finished; and failed sign-in attempts and expired links, which keep your account safe rather than hold anything for you. You can still see, download and delete everything yourself, because those are your rights rather than our processing. We have a month to answer, and we will tell you what we decided and why.
• Object (Article 21) — the same place. This right reaches processing we do on our own legitimate interests, and exactly two things here are that: the record of failed sign-in attempts that stops somebody guessing your password, and the backups. Everything else is either what you asked us to do, something the law requires of us, or something you consented to — and consent you take back the way you gave it, as easily. Tell us about your particular situation: that is what we have to weigh, and we can only carry on if our grounds are compelling enough to override it. We do no marketing of any kind, so the version of this right where objecting simply stops it — Article 21(2), no balancing at all — has nothing here to apply to. It is not missing; there is nothing for it to switch off.
• Complain (Article 77) — to the data protection supervisory authority where you live, work, or where you think something went wrong. In the UK that is the Information Commissioner's Office; in the EEA it is your national authority. You do not have to raise it with us first, though we would rather you did.

You can stop us keeping where you run

A run that starts at your door records your door. Two controls on your profile page do something about that, and you can use either or both.

Keep no start and end points at all. One switch. It clears the ones already stored as well as stopping new ones, and it keeps everything else — distance, times, pace, the city, state and country, and heart rate while you consent to it. Turning it back on does not bring anything back: we do not hold what we cleared, and nothing here fetches an activity it already has again. Strava still has them.

Or name a private area. A centre and a radius, usually home. Activities that start or finish inside it lose that point and keep the other, so a run out from your door to a café keeps the café — and a race you travelled to is untouched. That is the reason to use this instead of the switch, which would throw the race away too.

We suggest centres from the activities you have already synced, rather than showing you a map. A map would mean asking a map company for tiles, which would tell them where you were looking — and the places you look at hardest are the ones you are trying to hide.

The centre of a private area is encrypted in our database, under a key that is not kept with it. It has to be: it is your address, stated exactly, and it lasts as long as the area does, while the coordinates it hides are cleared within 365 days.

If your account changes, we tell you

We email you when your password changes — whether you changed it yourself or used a reset link. A change signs out every other browser, so without a message the first sign of one you did not make would be finding yourself locked out.

And when the address on your account changes, we tell the old address. That is deliberate: whoever made the change already has the new one, so a warning sent there would reach the wrong person. The message names the new address and says honestly that nothing sent to the old one can reverse the change — if it was not you, the route is to contact whoever runs this installation, named at the top of this page.

Neither message contains a link. A warning about your security that asks you to click something is the shape every phishing email takes, and these need none: you can reach the sign-in page the way you always do.

Changing your address needs your current password. Nothing else on your profile does. It is the one change that decides where a future password reset goes, so a borrowed browser should not be enough to make it.

If you ask, we email you on Friday when next week isn't planned

Off until you turn it on, with “Email me on Friday if next week isn't planned” on the profile page. Then, from 09:00 on Friday by your own clock, if no session is planned for any day of the coming week, we send one email to the address on your account, if that address is confirmed. A Friday we miss is made up on Saturday or Sunday, always between 09:00 and 21:00 your time. The email names the Monday the week starts on and links to the Plan page, where you sign in as usual.

At most once a week, and none once a session is planned. Nor while the age check holds your account, nor while a restriction or an objection of yours is in force. So that it goes only once, we keep, with your account, the Monday of the week the last one was for, beside the setting itself. The two go when your account is deleted, and the archive you can download has them.

A link in each of these emails stops them, with no need to sign in, and stops nothing else: it opens a page with a button for it. Your mail program's unsubscribe button works too, as does unticking the box on your profile.

Cookies

One cookie keeps you signed in, and two short-lived ones exist only while a sign-in or a Strava connection is in progress, to make sure the answer coming back belongs to the request that went out. If you tick “Keep me signed in on this device”, one more keeps that device signed in for 30 days after each visit. When you are signed out, one lasts ten minutes to tell the sign-in page why, and one holding nothing but a 1 says this browser has been signed in, until you sign out or 30 days after your last visit, so that the sign-in page can say your session ended instead of greeting you as new. If you choose light or dark with the button in the bar, one more says which, on that device, for a year; choosing your device's own again removes it.

Your browser also keeps, for SupraMonta, so that the shopping list works in a shop with no signal: the app's own files - its styles, scripts, fonts and icons; the shopping lists you opened, by aisle, by day and by shop, of this week and next, as you saw them last and when; the products you said you bought from them, or took out of your pantry again, with how much of each and when you said so, from the moment each is sent until it is saved or refused; and a code saying whose the lists and those products are, which names nobody. Nothing else of yours is kept there - not your body data, your profile or your privacy choices. Signing out, your session ending, or somebody else signing in on that browser deletes the lists and those products.

All of them are strictly necessary for something you asked for, so there is no banner asking permission for them — there is nothing else to permit. No analytics or advertising cookies are set, by us or by anybody else.

While a new menu is being made, the Meals pages also keep, in your browser's session storage for that tab, until a Meals page next loads there or the tab is closed: a digest of which menu each week showed and of each dish and shopping list in it, which of them had just been asked for or marked new, which parts you had open, where you were on the page, which button or field had the focus, and whether you had kept the wheels still - so that it can mark what the new menu changed and put you back where you were. The digests identify the dishes; nothing of it is sent anywhere.

When you press Send to Notes by a shopping list - or Copy for Notes, where your browser has no share sheet - the list goes from your browser to your device's share sheet, or to its clipboard, and from there wherever you choose - nothing of it comes back to us. A list you keep in Notes, or anywhere else, is yours: deleting your account here does not reach it.

Changes to this notice

The date at the top changes when the wording does. Each of the four consents — heart rate, training on your activities, weight and HRV, and dietary restrictions — is versioned separately and more strictly: the wording you agreed to is recorded with your decision and is never edited, so if it changes you are told where you gave it, and asked again, rather than being held to something you never read.