← Back to Roulo

Privacy Policy

Last updated: April 4, 2026

1. Introduction

Roulo ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Information you provide

  • Account data: email address, password hash (bcrypt, cost 12).
  • Integration credentials: your intervals.icu API key and athlete ID, encrypted at rest with AES-256-GCM.
  • Profile data: weight, FTP, max HR, birth year, height, nutrition goals.
  • User content: routes (GPX), workouts, food logs, training plans, clothing items.

Information collected automatically

  • Usage data: pages visited, features used, timestamps.
  • Device data: browser type, operating system, IP address (for rate limiting and security).
  • Third-party data: athlete profile, activity history, wellness metrics pulled from intervals.icu on your behalf.

3. How We Use Your Information

  • Provide, operate, and maintain the Service.
  • Generate training plans and nutrition recommendations.
  • Sync data with intervals.icu and other connected platforms.
  • Communicate with you (service updates, security alerts, support).
  • Improve the Service and develop new features.
  • Detect and prevent fraud, abuse, and security incidents.

4. Data Storage and Security

  • Database: PostgreSQL with encrypted credentials (AES-256-GCM).
  • Sessions: JWT access tokens (1-hour TTL) + Redis-backed refresh tokens (30-day TTL, rotated on use).
  • Encryption: integration credentials encrypted at rest. Passwords hashed with bcrypt (cost 12).
  • Transport: all communication over HTTPS. Session cookies are HTTP-only, Secure, and SameSite=Strict.

No service is 100% secure. While we implement industry-standard measures, we cannot guarantee absolute security.

5. Third-Party Services

We share data with third-party services only as necessary to provide the Service:

  • intervals.icu: We send and receive athlete data, workouts, and training plans using your credentials.
  • Strava: OAuth authentication and activity data.
  • Redis: Session token storage. No personal data stored.
  • Hosting: Backend on Fly.io, frontend on Cloudflare Pages.

We do not sell, rent, or trade your personal information to third parties.

6. Data Retention

We retain your data for as long as your account is active. You may request deletion at any time. Soft-deleted data is permanently removed after 30 days.

7. Your Rights

  • Access: Request a copy of your personal data.
  • Correction: Update or correct inaccurate data.
  • Deletion: Request deletion of your account and data.
  • Portability: Export your data in a machine-readable format.
  • Objection: Object to processing of your data for specific purposes.

To exercise any of these rights, contact support@roulo.cc.

8. Children's Privacy

The Service is not intended for children under 16. If we learn we have collected such data, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or in-app notice.

10. Contact

For questions about this Privacy Policy, contact us at support@roulo.cc.