Privacy

OORMA saves a few things in your browser’s local storage. They stay there: nothing is sent anywhere and we don’t see any of it.

• Your preferences: the style and format you picked last time

  Until you clear the site data

• The last ten activities you loaded, with the trace and the numbers

  Past the tenth, the oldest delete themselves

• Your Strava access tokens, if you connected it

  Seven days, then access revokes itself

• The styles you unlocked with a code

  Until you clear the site data

• The fact that you dismissed the invitation to install the app

  Seven days: after that, the invitation may reappear once

To delete all of it, clear the site data from your browser settings. You don’t need to ask us, and there is nothing we could delete on your behalf: we don’t have it.

The photo you choose and the trace of your activity are not uploaded to any server. The final image is drawn by your browser and stays yours: you download it or share it, when you want to.

That isn’t a promise on our word — it is how the application is built. There is no address a photo could be sent to.

To understand whether the product is any use we run Umami, which uses no cookies and collects no personal data. We see aggregate numbers: how many visits, which pages, and a few product events — that an activity was loaded and for which sport, that an image was exported, with which style and format, and whether a load failed and why.

None of those events contains your activity, your location or your photo: they contain categories, not content. Statistics are not collected on preview deployments or in development. If you use a tracker blocker, the site works exactly the same.

Connecting Strava is optional: it only saves you from hunting for a file. When you do, Strava is who grants the access — your password never passes through us and we never see it.

There is one single piece of OORMA that runs on a server, and this is what it is for: exchanging the code Strava returns for access tokens, because that step needs a key that cannot live inside the browser. That function stores nothing and keeps no logs. The list of your activities and the trace travel from Strava to your browser without passing through us.

Access lasts seven days and then revokes itself. Activities imported from Strava stay on the device for seven days, then they are deleted. You can revoke access whenever you like, from the “Disconnect” button or from your Strava account settings.

The pages are served by Vercel. Like any web server, in order to deliver you a page the provider processes the IP address of the request: that is technically necessary and we don’t use it to profile anyone.

The typefaces are served from our own domain and not by third parties, so opening the site makes no requests to outside services.

The Regulation asks us to say on what basis each piece of data is processed. In our case there are three, and none of them is consent to being profiled:

• What stays on your device

  It makes the service you asked for work: without it we couldn’t show you the activity you just loaded.

• Usage statistics

  Legitimate interest: understanding whether the product is any use. They are aggregate numbers, with no cookies and without identifying you — and you can object at any time, even just with a tracker blocker.

• The Strava connection

  Your consent, given to Strava and revocable whenever you like. Without it the app works just the same: you load the file by hand.

Three providers touch something, and none of them sees your photos — those don’t leave the device:

• Vercel hosts the site. Pages are served from its European locations, but it is a US company.
• Umami counts the visits.
• Strava, only if you connect it yourself, and in that case the relationship is also between you and them.

All three are companies based in the United States: a transfer of data outside the European Union is therefore possible, and happens under the safeguards the Regulation provides — standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.

The European Regulation gives you the right to access your personal data, to correct it and to have it deleted. In our case the answer is short: we hold no personal data of yours. What exists is in your browser, under your control, and is deleted by clearing the site data.

If you believe we are handling your data badly you can come to us, and in any case you have the right to lodge a complaint with the Italian data protection authority or with the authority in your own country.

For the data that lives on Strava, their privacy policy applies, and the relationship is between you and them.

OORMA is a product of BE/OND, which is the data controller. For any question about this page you can write to oorma@beiond.it.

Registered name

Beiond di Caldarariu Paul Florin

Registered office

Via Rivaira 24, 12030 Cavallermaggiore (CN), Italia

VAT number

04060590041

Company register

CN-333296

If we change anything about how we handle data, we will change this page and the date at the top first.