Effective date: 5 October 2026
Your privacy matters. This policy explains what information Routebook collects, how it is used, who helps us process it, and what rights you have. The short version: we hold your rides and the details you choose to give us so we can analyse your training and coach you. We never sell your data or use it for advertising, and you can delete everything at any time.
Account — your email address, required to create and sign in to your account, and an optional username.
Rides — the ride files you upload and the activities we import from Strava if you connect it. These contain GPS routes, timestamps, and sensor data such as heart rate, power, cadence, speed and elevation. We also store what we derive from them: training load, power curves, fitness estimates and ride summaries.
Athlete profile (optional) — date of birth, sex, height, weight, FTP, lactate threshold heart rate (LTHR) and maximum heart rate, if you enter them in Settings or tell the AI coach. They make estimates such as power and heart rate zones more accurate. Routebook works without them.
AI coach conversations — your chat messages, the coach's replies, and a profile the coach keeps so it can remember you between conversations. That profile can include goals, training plans, equipment, the city and country you ride in, and anything about your health you choose to share.
Connections — if you connect Strava, the access tokens needed to import your activities (stored encrypted) and the basic athlete profile Strava provides. If you create access tokens for an AI client such as Claude Desktop, we store those tokens so the client can reach your data, and keep a log of those requests (time, client, IP address and browser or app identifier) for security.
Subscription — a Stripe customer identifier and your subscription status. See Payments & Stripe below.
Apart from the AI client request log above, we do not collect device identifiers or browsing behaviour, and we do not use analytics or advertising services.
Heart rate data, and any medical information you share with the AI coach, is health information. We use it only to analyse your training and to keep coaching advice safe — for example, applying extra caution when you tell the coach about a medical condition. Sharing health details is your choice. You can remove them by asking the coach, editing your profile, or deleting your account. Routebook is not a medical service and its advice is not medical advice.
To provide Routebook: displaying and analysing your rides, estimating fitness and training load, generating ride summaries and workouts, and powering the AI coach. We also review AI coach interactions to check the quality and safety of its answers and to fix problems. We do not send marketing emails or newsletters unless you explicitly ask for them.
We use a small number of providers to run Routebook. They process data only on our behalf to deliver the service. They may not sell it or use it for their own purposes, including training AI models.
Supabase — database, sign-in and file storage. All the data described above is stored here.
Vercel — hosting, and the AI gateway that routes AI requests to the model providers.
Anthropic — the Claude models behind the AI coach, ride summaries, training plans and workouts. Requests include your messages and the ride and profile details relevant to them.
OpenAI — text embeddings that let the coach search your past conversations.
Langfuse — monitoring of AI requests and responses, so we can find and fix quality problems.
Mapbox — maps and satellite imagery. A ride's start location is sent to Mapbox to look up its country.
Strava — only if you connect it, to import your activities.
Stripe — payments, described below.
Before a chat message is processed, email addresses, phone numbers and card numbers in it are removed. Some providers are based outside New Zealand, including in the United States. Where your data is transferred internationally, we rely on each provider's contractual safeguards.
We do not sell, rent or trade your personal data, and there are no advertising partners or data brokers. Beyond the service providers above, we share data only in two cases: where you direct it, such as connecting your own AI client with an access token, or where a court order under applicable law requires it. In the second case we would disclose only the minimum information legally required.
Subscription payments are handled entirely by Stripe, a leading global payment processor. We never see, handle, or store your credit card number, billing address, or any other payment details. That information goes directly to Stripe and never passes through Routebook's systems.
When you subscribe, Stripe assigns your account a secure customer identifier which we store solely to manage your subscription status (active, cancelled, past due). This identifier contains no payment data.
What Stripe collects — Stripe collects your payment card details, billing name, and billing address directly. Stripe is certified to PCI DSS Level 1, the highest standard in the payments industry.
Stripe's privacy policy — Your payment data is governed by Stripe's own privacy policy, available at stripe.com/privacy.
Subscription cancellation — You can cancel your subscription at any time from Account Settings. Cancellation takes effect at the end of the current billing period and no further charges are made.
Account deletion & billing — If you delete your account, your Stripe subscription is cancelled immediately as part of that process. You will not be charged again.
You are in complete control. You can delete your account at any time from Account Settings → Delete Account. Deletion is immediate and permanent. It removes your account, rides, uploaded files, athlete profile, training plan, points of interest, AI coach conversations and the coach's memory of you, Strava connection, access tokens and their request log.
Records of AI requests held by our monitoring provider expire under its retention settings. Stripe keeps payment records as required by law, under its own policy. Apart from these, there are no retention windows and no archives.
You can also correct your data at any time. Edit your profile in Settings, or ask the coach to update or forget something it remembers.
Routebook uses a single session cookie required to keep you signed in. We do not use tracking cookies, third-party cookies, advertising pixels, or any form of cross-site tracking.
All data is transmitted over encrypted HTTPS connections. Access to your data in our database is restricted to your account. Strava tokens are encrypted at rest, and passwords are handled by our authentication provider and never stored by Routebook.
GDPR (EU/EEA) — We process your account, ride and profile data to perform our contract with you: providing the service you signed up for. We process health information only with your explicit consent, which you give by uploading heart rate data or sharing health details, and which you can withdraw at any time by removing that information or deleting your account. We monitor AI quality and safety on the basis of our legitimate interest in a service that works safely. You have the right to access, correct, export, restrict or erase your personal data, and to object to processing.
UK GDPR — The same rights and protections apply to users in the United Kingdom.
CCPA (California) — We do not sell or share personal information for advertising. California residents have the right to know what data is held, to correct it and to request its deletion. All three are addressed in this policy.
NZ Privacy Act 2020 — We comply with New Zealand's Privacy Act and the 13 Information Privacy Principles governing the collection, storage, use and disclosure of personal information, including overseas disclosure to the service providers listed above.
To exercise any of your privacy rights — access, correction, portability, or erasure — you can use the self-service options in Settings, or contact us directly at info@orbital.co.nz.
If we change what data we collect or how we use it, we will notify you by email before those changes take effect. We will never retroactively change how we use data already collected without your explicit consent.
Questions about this policy or your data? Reach us at info@orbital.co.nz. We'll respond promptly.