Peaks privacy
Rutera Peaks adds the named climbs you rode all the way up to the description of your new Strava rides. This page explains what it reads, what it keeps and for how long.
Peaks is part of Rutera. The controller and the contact are those of the Rutera privacy policy: basecamp@rutera.cc.
What Peaks reads from Strava
- When you connect: your Strava athlete id, the permissions you grant and the access keys Strava issues.
- For each new ride, about 10 minutes after it reaches Strava: its details (type, start time, whether it is private, indoor or manual, its title and its description) and its GPS track. Before writing, it reads the ride again.
- Right after your first connection: your list of recent rides and the GPS track of the latest eligible one, for the preview.
The GPS track and the description are used only in the function's memory and are forgotten when it finishes. They are never stored.
What Peaks writes to Strava
Only a few lines at the end of the description of a new ride with complete catalogue climbs: a header, one line per climb and a credit line. It never changes your text, title, photos or anything else, never writes twice, and never writes while the description is changing. Anyone who can see the ride sees the lines.
What Peaks keeps, and for how long
| Data | Kept |
|---|---|
| Athlete id, permissions, your settings (rides, e-bike, language, paused) and the Strava keys, encrypted | While you are connected |
| Sign-in sessions (a hash of the session cookie) | 30 days, or until you sign out or disconnect |
| Last-7-days list: ride id and title, result, ids of the climbs found and language | 7 days |
| Check of the connection to Strava and of the one-time preview (no personal data) | 10 minutes |
| Deleted-ride marker (its id) | 1 day |
| Hourly count of Strava events | 1 hour |
GPS tracks, descriptions, climb names and any permanent record of your climbs are never kept. The description of the ride on Strava is your record.
Where
Peaks runs as Vercel Functions at peaks.rutera.cc. Its records are in Upstash Redis, in the EU. Upstash QStash delays the check of each ride by about 10 minutes and carries only your athlete id and the ride id. Strava is the source and destination of your ride data, under its own terms.
Cookies
- __Host-peaks_session: 30 days, keeps you signed in on this device.
- __Host-peaks_oauth: 10 minutes, protects the connection to Strava.
- __Host-peaks_preview: 10 minutes after the first connection, to show the preview only once.
- peaks_lang: 1 year, the page language, only when you choose one.
No analytics, advertising or tracking cookies. The pages run no scripts.
Disconnecting and deleting
“Disconnect & delete” deletes everything above at once and asks Strava to revoke Peaks' access. If you revoke access on Strava instead, Peaks deletes your data once Strava confirms it. If you delete a ride on Strava, its entry is removed at once. Lines already added stay on Strava as your text. Pause stops checking new rides without deleting anything.
Climb data: OpenStreetMap (ODbL)
Climb names and routes come from the Rutera climb catalogue (version 2026.11.1), a Derivative Database of OpenStreetMap data. © OpenStreetMap contributors. The catalogue is available under the Open Database License (ODbL) 1.0. The lines added to your rides credit “© OpenStreetMap contributors”.
You are free to copy, distribute, use, modify and produce works from the catalogue, as long as you attribute OpenStreetMap contributors, keep any adapted database under the ODbL, and do not apply technical restrictions that contradict the licence.
OpenStreetMap: openstreetmap.org/copyright. Licence: opendatacommons.org/licenses/odbl/1-0/.
Strava
Rutera Peaks uses the Strava API but is not developed or endorsed by Strava.
Contact and your rights
Write to basecamp@rutera.cc to access, correct or delete your data, or with any question. Your rights are explained in the Rutera privacy policy. You can also complain to the Spanish data protection authority (AEPD).