Privacy Policy

BIVORA ("we", "our") is committed to protecting your privacy. This policy explains which data we collect, why we collect it, how we use it and how you can manage or delete it.

By using the Bivora service you agree to the practices described here.

We collect account information (email, hashed password, display name, avatar, optional city), activity metrics (type, distance, duration, elevation, timestamps), technical identifiers (UUID, session timestamps) and usage data related to challenges, points and rewards.

Data enables core features: authentication, Strava sync, personal statistics, challenges and leaderboards, and to improve service quality and support.

Data is stored securely in Supabase (Postgres). Server-side processing runs on Cloudflare Workers. Short-term cache is used for performance (Cloudflare KV) and Strava sync uses OAuth 2.0 tokens.

We do not sell your data. We rely on trusted providers (Supabase, Cloudflare, Strava) who are contractually bound to privacy obligations. We may disclose data when legally required.

We use HTTPS/TLS, hashed passwords (bcrypt), encrypted tokens and Row-Level Security on the database. Rate limiting and monitoring reduce abuse risk.

You have access, rectification, erasure, portability and objection rights. Use the account settings to export or request deletion; we respond within 30 days.

8.1 Deletion procedure

To delete your Bivora account:

1. Open the Bivora app
2. Go to Profile (bottom-right tab)
3. Open Privacy
4. Scroll to "Delete my account"
5. Confirm deletion (two confirmations required to avoid mistakes)

8.2 Effects of deletion

Once your account is deleted, all your data is immediately erased from our servers:

• Complete removal from Supabase (profile, activities, statistics)
• Revocation of Strava tokens (automatic logout)
• Purge of the Cloudflare KV cache
• Removal from leaderboards and challenges

📌 Note: This deletion is immediate and irreversible. No backups are retained. If you wish to use Bivora again, you will need to create a new account.

8.3 Partial deletion (Disconnect Strava)

If you want to stop Strava sync without deleting your account:

1. Go to Profile → Integrations
2. Tap "Disconnect Strava"

Your previously imported activities will remain but no new ones will be synchronized.

You can also request the deletion of your data and Bivora account by contacting bivora.app@outlook.com. We will process your request within 30 days and confirm when deletion is complete.

Profile and activities are kept while your account is active. Inactive accounts may be removed after long inactivity and caches are short-lived (5-15 minutes).

The mobile app does not use tracking cookies. The website uses only strictly necessary cookies for sessions and language preferences. No third-party advertising cookies are used.

Your data may be stored or processed in locations outside your country (Supabase servers in EU/US, Cloudflare global network). Transfers follow standard contractual safeguards when applicable.

BIVORA is intended for users aged 13 and above. We do not knowingly collect data from children under 13; parents can request deletion if needed.

We may update this policy. Significant changes will be communicated by email, in-app notification or a banner on this page. The last update date is shown above.

For questions about privacy or to exercise your rights, contact us at bivora.app@outlook.com. We aim to respond within 30 days.

Data collected: identifiers, activity summaries (no raw GPS). Purpose: authentication, Strava sync, statistics, leaderboards and gamification. Security: HTTPS/TLS, hashed passwords. Deletion: immediate upon request via profile settings.