Privacy Policy

Last updated: 7 October 2026

1. Who we are

Stricca (“we”, “us”) is operated by Predika Ltd, a company registered in Scotland, company number SC895906. For any privacy question, contact us at hello@predika.co.uk. We are the data controller for the personal data described below.

2. What we collect

• Account data — your email address, your username, and the name and profile photo you add (or, if you sign in with Google or GitHub, the ones they share with us).
• Profile & preferences — units, an optional home location, your body weight if you enter it (used only to estimate the calories of your activities), privacy zones you set (section 4), default route and sharing preferences you set, and names you teach the route assistant for places (for example “home” or “the prom”), each with the location it stands for. Clearing your chat does not remove these names; they are included in your export and deleted with your account.
• Route & location data — the start points, destinations, and routes you generate or save. This can reveal places you visit, so we treat it as personal data.
• Messages — the text you send to the route assistant.
• Route records & ratings — each time we generate a route, we keep a short record of it: a copy of your request, and measurements such as the distance you asked for and the distance we delivered, the climb, the surface, and whether planning worked. If you rate a route with a thumbs up or down, we keep your rating with a copy of the request, the route’s measurements and its rough start area (to about 1 km). We keep the copy of your request so that, after a run, the app can ask whether the route matched what you asked for, and so that we can look into a problem with a particular route. This also applies to the free demo route you can plan without signing in; that record is not linked to any account.
• Activity, photos & videos — runs, walks (including with a pram) and bike rides you record (route, distance, pace, time, elevation, and the time zone your phone was set to when you started, so that the time of day we describe is yours), the named places they passed, any notes, and photos (for those taken in the app during an activity, with where and when each was taken) and short videos you attach to them. Before a video is added to your activity, our server keeps only its picture and sound and removes the information stored alongside them in the file, such as the location, the phone model and the time it was recorded. The file as you uploaded it is then deleted (an upload that is never added to an activity is deleted automatically within about two days), and a video it cannot clean this way is refused. We cannot remove what the video itself shows or says, or anything a camera has written into the picture or sound data themselves. Your data export lists your videos (the video files themselves are not inside it), and they are deleted with your account.
• Activities you import from Apple Health — only if you connect Apple Health in the Stricca iPhone app, which is optional. Nothing is read before you connect it and allow access on Apple’s permission screen. The app then reads the workouts in Apple Health on your iPhone and sends us the runs, walks (including hikes) and bike rides it imports. For each one we receive its Apple Health id, the kind of workout, when it started and ended, the time zone it was recorded in (if Apple Health has it), its distance, how long it lasted and how long it was paused, its GPS route (each point with its time and elevation, from which we work out the climb), and the name of the app and device that recorded it (for example Apple Watch). We do not read your heart rate or any other health data in Apple Health, such as calories, steps or sleep, and we never write anything to it. By default we import only workouts recorded on an Apple Watch. Workouts that other apps (for example another running app) saved to Apple Health are imported only if you choose those apps; until you do, the app sends us nothing about them, with one exception: when a workout is deleted from Apple Health, Apple tells the app only its id, not which app recorded it, so the app passes the ids of deleted workouts on to us. We use them only to find an activity that was imported from that workout, and we keep nothing for an id that matches none. We import only workouts you really recorded: we skip ones added by hand in the Health app, indoor ones, very short ones and any without a GPS route, and we never create an activity you did not record. Each imported activity is labelled with where it came from (for example “Apple Health · Apple Watch”). The app keeps no copy of your workouts on your phone. It keeps only what it needs to know where it got to: a bookmark in Apple Health, the ids and end times of workouts still waiting for their route, and how many workouts its last sync imported or skipped.
• Your Apple Health connection — when you connected and agreed to the import, the choices you make then and afterwards (which apps to import from, who sees imported activities, and whether AI descriptions are on for them, section 6), and when the app last synced. We also keep a short import record for each workout the app tells us about: its Apple Health id, when it started, and whether it was imported, skipped (and why, for example “added by hand in Apple Health”) or later deleted. For an imported workout the record also holds when it ended, its distance and the device that recorded it. For a skipped workout the app sends us only its id, when it started and why it was skipped, and that record is all we keep: no route, no distance, no device. The record stops the same workout being imported twice, and an activity you deleted from coming back, and it lets the app show you what was skipped and why.
• Friends data — your public username, and the connections, reactions, blocks, and reports you make in the social feature (see section 4).
• Milestones — the milestones your activities have earned (for example your first 10K, your longest ride or a new country) and what you did with each milestone card in the app: whether it was shown, opened or dismissed, which kinds you asked to see less of, and whether you turned the cards off. We use this only to decide which card to show you on Home. Nobody else sees it.
• Your habits — from your own activities of the last 26 weeks, we work out what you usually do: how many runs, walks and rides you do a week, your usual distance for each, the routes you have done three or more times (with your best time on each) and the days and times of day you usually go out. We do not store these: we work them out each time they are needed, from the activities you already have in Stricca, so they change as soon as you add, edit or delete one. We store only your choices about them: whether they are on or switched off at your request (section 9), when you last reset them, and any route you marked “Not my usual”. Nobody else sees your habits. Your friends never do. Your habits are a summary across your activities; how one activity compares with your earlier runs of the same route is part of that activity’s own description (section 6), not of your habits.
• Strava link — only if you connected Strava before we retired that feature on 9 September 2026: your Strava athlete id, the access keys Strava gave us, and a record of which of your saved routes your Strava activities matched. We no longer import anything. Deleting your account asks Strava to cancel our access and deletes all of this. You can also ask us to remove the link.
• Technical data — strictly-necessary cookies that keep you signed in, protect the sign-in form and limit the free demo (section 10), and — only if you opt in via the cookie banner — usage analytics on the website (see Microsoft Clarity below). We do not set advertising cookies ourselves.
• App diagnostics — the mobile app sends us its own error reports and a small number of events (app opened, run started, a request that failed), together with your device model, OS version and app version. These go to our servers, not to an analytics or crash-reporting company. They can be linked to your account. We use them only to find and fix faults, including a problem you report, and keep them for about 30 days. They are deleted with your account.
• Server records — our servers also record errors and a few events (for example, that a run was saved or imported, with its distance and time). An error record holds what failed: which of our web addresses was called, the error message and where in our code it happened. Some records are linked to your account. We use them only to find and fix faults and keep them for about 30 days. They are deleted with your account.

3. How we use it

• To authenticate you and keep you signed in.
• To send you service emails (see “Emails we send” below).
• To generate, display, and let you save and revisit running routes.
• To record your activities and show your own history, stats, and photos.
• If you connect Apple Health, to import the workouts you choose from it and show them with your other activities, in your stats and in your milestones (section 2) and in your habits (section 2), which only you see. We never use data from Apple Health for advertising, marketing or data mining, never sell it or give it to advertisers or data brokers, and never use it to train AI models.
• To personalise Stricca for you: your habits (section 2) shape the weekly recap, the descriptions of your activities and the route suggestions you get (the suggestions on Home are sized to the usual distance of your latest runs and walks recorded in Stricca, and the route planner can offer the route you usually do from where your pin is), and you can see them on the “Your habits” card on Home. On Home, while your habits are on and you have allowed location, the app sends your current location (rounded to about 100 m) to our server to find a usual route that starts near you, and on Plan it does the same with your pin; we use it only for that answer and do not store or log it. Your habits are always on in the app; you have the right to object to them at any time (section 9).
• To run the optional friends feature — finding people, connecting, and showing your friends the activities you choose to share (section 4).
• To apply your saved preferences.
• To secure the service and prevent abuse.
• To run, monitor and improve the service (see “Running the service” below).

Running the service

A small number of people we authorise to work on Stricca (“our staff”) use internal tools, including a dashboard, to keep the service working and to improve it.

• Statistics. Our staff see counts, totals and averages: for example, how many accounts were created, how many routes were planned, saved and run, how often planning, sign-in or the app failed, and what kinds of route people ask for (a loop or a route to somewhere, how far, flat or hilly). As we add them, they will also see how many people come back from week to week and how long a typical planning session or workout lasts. We work these out from the data in section 2. Statistics do not name anyone. We use them to find faults, to check route quality and to decide what to improve.
• Error reports. Our staff read the app diagnostics and server records described in section 2 to find and fix faults. Some of them are linked to an account.
• Account list. Our staff can see a list of accounts: the email address, the name and username if there are any, when the account was created, roughly when it was last used, and basic activity counts (for example, how many routes it has saved). We use it to check that new people can sign up and get started, to spot fake or abusive accounts, and to answer requests you send us. Only the people who need this list can see it.
• Looking at one account. Only when there is a specific reason does an authorised person look more closely at one account, including the route requests you typed and the error reports linked to it. The reasons are: to answer a request you send us, to fix a problem that affects you, to investigate a security issue, or to act on a report of abuse.

To understand what people ask for, we use the statistics above, not individual requests. We do not track how long any individual person uses Stricca, apart from the optional website analytics in section 6, which run only if you accept them. We do not use your route requests to train AI models. We do not use any of this for advertising, and we do not sell it.

Emails we send

We send only service emails:

• the sign-in codes (app) and sign-in links (website) you ask for;
• one welcome email after you create your account, on how to get started;
• important notices about your account, our terms or this policy.

We do not send newsletters or marketing emails. If we ever want to, we will ask for your consent first, and saying no will not affect your account.

4. Friends & sharing

Stricca has an optional social feature. When you use it, the following applies:

• Your public handle — every account has a username (auto-generated from your name or email; you can change it). Your handle, display name, and avatar are visible to other users so they can add you.
• Being found — by default you can be found in the in-app search by name or handle. You can turn this off in Profile → Friends & privacy (“Find me”), and you’ll no longer appear in search.
• Friend connections — adding a friend is double opt-in: a request must be accepted before you are connected. You can remove, block, or report another user at any time; a block hides you from each other everywhere.
• What a friend can see — when an activity is set to be visible to friends, they see when you did it (date and time), what kind it was (a run, a walk, a pram walk or a ride), the area it started in (its county or region, and country, for example “Aberdeenshire, Scotland”, not the town), its stats (distance, time, pace, climb), a short AI description written for friends (it calls you by your first name, which we take from your profile and fill in ourselves, or “a friend” if your profile has no name we can use: the AI model never sees your name for this description; it says what kind of activity it was, roughly when, the area it started in, whether it was hilly or flat, and, where it applies, that it was your longest yet in that sport or your first activity in a new country, and it may say something encouraging about it; where your friends can see the activity’s stats, it also gives the distance, time, pace (or speed) and climb they show, which we fill in from those stats, and it may note highlights we work out from those stats ourselves, such as a quick pace, a big distance or a long time out: the AI model never sees the figures; it never says how often you do it, how it compares with your other activities, or the places it passed), any note you wrote on it, the photos and short videos you attached to it, and, when map sharing is on (by default for accounts created from 3 October 2026), a privacy-trimmed map of the route. Where the council area or region is named after a town or city (for example Cardiff, Falkirk, Berlin or the Region of Žilina), the area carries that name. They do not see where or when a photo was taken, and photos you took during the activity near your home or in a privacy zone are left out. On an activity whose route map friends can see, they get neither its duration and pace nor your note, and never its exact distance. A video is shown to them as it is, even one filmed near your home, so check what it shows before you share the activity.
• Your home is protected — a map shared with friends is never your raw GPS track. We remove the start and end, mask the area around your home (detected from the run and from any privacy zones you set), and never reveal the exact distance of a mapped run, so a friend cannot work back to your address. For accounts created from 3 October 2026 (UTC), map sharing is on by default: a new activity your friends can see shows them this privacy-trimmed map, with the limits on its stats described above. For accounts created before, it stays off unless you turn it on, and a new run shares its stats with friends you have accepted, but not its route. Either way you can switch it on or off at any time in Friends & privacy.
• Defaults & control — new activities are visible to accepted friends, as described above: with a privacy-trimmed route map when map sharing is on, which it is by default for accounts created from 3 October 2026 (UTC) and is not for accounts created before (activities you import from Apple Health have their own setting, below, and never a map). You can change both in Friends & privacy. An activity takes these defaults when you record it, even if you have no friends yet, so a friend you accept later can see your earlier activities that were recorded as visible to friends. Changing who sees new activities affects only the activities you record afterwards. The route map setting is different. When you switch it off, the map is removed straight away from all your activities, past ones included. When you switch it on in the app from version 1.0.5, we ask whether to also show a privacy-trimmed map on your past activities that friends can already see, or only on new ones. A past activity gets a map only where one can be drawn safely, so not on a route too short to trim or one your home or privacy zones cover. In earlier versions of the app, switching it on affects only new activities. Activities saved before 19 July 2026, when we added friends, stay private.
• Activities imported from Apple Health — are visible to your friends or only to you, as you choose when you connect Apple Health. In the app from version 1.0.7, “Friends” is preselected there the first time you connect, unless you keep your new activities to yourself, and you can pick “Only me” before you connect. You can change that choice later; it applies to the activities imported after you change it. Workouts from before you connected always arrive visible only to you, and every imported activity arrives with its route map off, even if you share the maps of the activities you record in Stricca. A friend who can see an imported activity sees what is listed above for any activity, with a label naming where it came from and the device or app that recorded it (for example “Apple Health · Apple Watch”). It has an AI description only if you turned those on for imported activities (section 6).
• Route links — if you use Share on a route on the website, anyone with the link can open that route without signing in: its name, its whole line on the map including its exact start point, any points you placed on it, its GPX file, the area it starts in (county or region, and country), when you saved it, whether you starred it, and whether and when you marked it as planned. A link preview in another app can show its name, distance, climb and outline. The link works until you delete the route. Recorded activities cannot be shared this way.

Apart from a route link you choose to create (above), this data is shared only with the specific friends you approve, according to your settings. We do not sell it or share it with advertisers. Your habits (section 2) are never shown to your friends or used in what they see.

5. Legal bases

• Contract. Most of what we do is needed to provide the service you signed up for: your account, sign-in and sign-in emails, routes, activities, the friends feature and your settings.
• Consent. Where the law requires it, for example optional analytics cookies on the website. You can withdraw consent at any time.
• Explicit consent for Apple Health. Data from Apple Health may count as health data, so we import it only with your explicit consent, which you give on the screen that explains the import before you connect. Sending imported activities to the AI model needs a second, separate consent (section 6), which is off until you turn it on. Imported activities shape what the AI model is told about your habits only if you gave that consent with the wording that mentions your habits (in the app from version 1.0.8). You can withdraw either at any time in the app: turn off AI descriptions for imported activities, or disconnect Apple Health (section 8). Withdrawing does not affect what we did before you withdrew.
• Legitimate interests. We rely on our legitimate interests to:
  • keep Stricca and its users secure and prevent abuse;
  • run, monitor and improve the service with statistics and error reports;
  • give authorised staff the limited access to account details described in section 3;
  • send you one welcome email and important notices about your account;
  • personalise Stricca with your habits (section 2). This is profiling: we analyse your activities to see what you usually do. We use it only to tailor what Stricca shows and says to you; it never leads to a decision that has legal or similarly significant effects on you. It is always on in the app. You have the right to object to it at any time by writing to us: we then switch your habits off for your account (see “Objecting to your habits” in section 9).
  We have weighed these interests against your rights, and we use no more data than we need. You can object at any time by writing to hello@predika.co.uk. You can also ask us for a summary of our assessment.

Profiling. The habits in section 2 are a profile of how you use Stricca. We use it only to personalise what Stricca shows and says to you. We make no decisions about you based solely on automated processing that have legal or similarly significant effects. You can see it and reset it in the app, and object to it at any time by writing to us (section 9).

6. Third parties we share data with

To deliver features, limited data is processed by:

• Microsoft Azure and Microsoft 365 (Microsoft Ireland Operations Ltd) — hosting, database, the AI model (Azure AI Foundry) that interprets your route requests, and our email inbox. The model receives your request, the recent conversation, your route preferences, and the location of your start pin and of any place you select on the map and, unless your habits are switched off at your request (section 9), when you ask for a route in the app without a place, a shape or a distance far from it and a route you have done three or more times starts near your pin (within about 1.5 km), how long it is and how many times you have done it, so that it can offer it to you again. It is never told the route’s name, where it goes, or on which days or at what time you do it. If you ask for your usual route, the planner shows it again as you have done it before: a route you saved, or, for a free run or an Apple Health import, the line your own recording traced, from where you started. Its map line goes to your app, not to the model, which is told only its distance, its climb and how many times you have done it. The same model also writes the short descriptions of your activities and the coach notes in the app (the briefing, the week recap and the Go line). For these it receives your first name, your activities’ stats (distance, time, pace, climb, time of day, how a run compares with your earlier runs of the same route or loop, and whether it was a first for you, such as your longest run yet, your first 10K or your first activity in a new country), the area it started in (county or region, and country) and the named places a run passed, your weekly totals (for example how many runs, walks and rides, how far, and how many photos you took), and the language your device is set to. Unless your habits are switched off at your request, it also receives a short summary of them made of distances and counts only: for the description of an activity, for example “about 3 runs a week”, “usual run about 5 km” or “the 9th time on a regular route”; for the coach’s weekly recap, “3 runs on the same loop this week” and your usual week, for example “about 3 runs a week, usual run about 5 km”, so it can say how the week compares with what you usually do. That summary never includes a route’s name, where your usual routes are, or on which days or at what times you usually go out. (The description of each activity still includes, as above, its area, its time of day and how it compares with your earlier runs of the same route or loop; that is part of the activity’s description, not of your habits, and having your habits switched off does not change it.) For the Go line it receives the weather, air quality and daylight where you are, and the nearest parkrun and how far away it is. Nothing you import from Apple Health reaches the model unless you turn on AI descriptions for imported activities, and it shapes what the model is told about your habits only if you turned them on with the wording that mentions your habits. Until you do, an imported activity gets no AI description, and imported activities are left out of the briefing, the week recap and the comparisons with your earlier activities. See section 7 for where the model runs. Email you send to hello@predika.co.uk, and our safety alerts (see MailerSend below), are received and kept in Microsoft 365 (Exchange Online).
• Zero One Research s. r. o. (Bratislava, Slovak Republic), a company under the same ownership as Predika Ltd — runs Stricca’s web servers, database, photo and video storage and AI model in its Microsoft Azure account, and the internal dashboard our staff use (section 3). Our emails currently come from its address, info@zerooneresearch.ai. It processes this data only on our instructions.
• MailerSend (MailerSend, UAB, Lithuania) — sends our emails (section 3): sign-in codes and links, the welcome email and notices about your account. We share your email address and the content of each email (for a sign-in email, the code or link). Open and click tracking is switched off, so MailerSend does not record whether you open our emails or which links you click. It also carries our safety alerts: when someone reports a user, we email ourselves the reason they wrote, together with the usernames (or display names) and account ids of the person reporting and the person reported, and, if an activity was reported, its id. No email addresses and no location data are included in those alerts.
• OpenStreetMap Foundation — operates the Nominatim server (address and place search) we query, and the map tiles on our website. We send your search terms (for a place you name in the route planner, with a wide area around your start point to search in, never the point itself), and, so we can show the name of the area a saved route or a recorded activity starts in (its county or region, and country), the four corners of the grid square it starts in. The squares are 0.1° of latitude by 0.1° of longitude: about 11 km from north to south, and from west to east up to 11 km, less the further you are from the equator (5 to 7 km in the UK and Ireland). We never send the start point itself, or where in its square it lies. Our server also asks it for the map tiles around a saved route or a recorded activity (with the start and finish left out) to draw the small map pictures in your lists. To draw the map, your browser asks for the area on screen. We do not send your account or identity.
• Esri, Inc. (United States) — the satellite map on our website, only if you switch the website map to Satellite. Your browser then asks Esri for the map area on screen. We do not send your account or identity.
• FOSSGIS e.V. (Germany) — operates the Overpass server our server asks for OpenStreetMap data. After we plan a route, we send the area it covers (with a few hundred metres to spare) to find named landmarks and trails along it. When you ask for a café, restaurant, toilets or a pub, we send your start point (to about 1 m) and ask for places within 4 km of it. When you plan a shape or a word as a route, we send a square 3.6 to 6 km across with your start point at its centre, to find the streets to draw it with. We do not send your account or identity.
• Open-Meteo — weather, daylight and air quality forecasts. For a route we send the location of your start point (to about 10 m); for the Go screen in the app, your current location rounded to about 1 km. We do not send your account or identity.
• Strava, Inc. (United States) — only if your account is still linked to Strava (section 2): we send Strava the access keys it gave us, to check or cancel our access.
• Google LLC and GitHub, Inc. — only if you choose to sign in with them. They receive the data the OAuth flow exposes (your email and basic profile).
• Map providers in the mobile app — the map you see is drawn by Google Maps on Android and Apple Maps on iOS. To draw it they receive the area being displayed, which is the area around your route or your current position. They do not receive your Stricca account.
• Expo (650 Industries, Inc., United States) — delivers over-the-air updates to the mobile app. On launch the app asks Expo whether a newer version exists, sending the platform, the app version and an install identifier. No account data, no location.
• Microsoft Clarity (Microsoft Corporation) — optional usage analytics and session replay, active only if you accept analytics in the cookie banner. Clarity records how you interact with the pages (clicks, scrolls, page structure) to help us improve the product. We have configured it without advertising features. See Microsoft’s privacy statement.

The routing engine (GraphHopper) is self-hosted by us, in our own Microsoft Azure account, in the UK (UK South); route generation is not sent to a third-party routing API.

7. International transfers

Your account and everything in it is stored in Azure North Europe (Republic of Ireland). Some processing happens elsewhere:

• The routing engine runs in Azure UK South (United Kingdom). It receives the points of your route, not your account.
• The AI model is set up in Sweden on a Microsoft Azure “global” deployment. Microsoft may process each request in any region where it runs the model, including outside the UK and the EEA (for example, in the United States).
• Our internal dashboard (section 3) runs in Azure West Europe (the Netherlands). It shows account details to authorised staff but does not store them.
• These services are based in the United States: Google Maps (Android app), Apple Maps (iOS app), Expo (app update checks), Esri (the website’s satellite map, only if you switch to it), Microsoft Clarity (website, only if you accept analytics), Google or GitHub if you sign in with them, and Strava if your account is still linked to it.

Where your data is processed outside the UK or the EEA, we rely on an adequacy decision or UK adequacy regulations (such as the EU–US Data Privacy Framework and its UK Extension, where the company is certified), or on standard contractual clauses: the European Commission’s clauses, with the UK Addendum for UK data, or the UK International Data Transfer Agreement.

8. Retention

• Account, profile, saved routes, chat history: kept for the life of your account. You can clear chat history at any time from the chat panel, and delete your entire account (with all data) from your profile page.
• Your usual route in the chat: a reply in which the planner offered or showed your usual route (section 6) is kept in your chat like any other reply (above). For a route it showed again, the chat keeps only a reference to that route (not its map line): the map is shown from the route itself, and goes when that route is deleted, or, for a free run or an Apple Health import, when the last activity on it is (if you ran it again, deleting your first run of it keeps the line, as the route of the later runs). Stricca refuses to make a recorded line, or a long stretch of it from either end, public by link; a saved route that copies one stays private for good, even after the recording is deleted.
• Milestones (section 2): kept for the life of your account and deleted with it.
• Your habits (section 2): not stored. They are worked out from your activities when needed, so an activity you delete is gone from them at once. Your choices about them (on or off, when you last reset them, routes marked “Not my usual”) are kept for the life of your account and deleted with it. A description or coach note written before you deleted an activity is not rewritten, so it can still mention it.
• Activities imported from Apple Health (section 2): kept until you delete the activity, disconnect Apple Health or delete your account. When you disconnect, the app stops reading Apple Health straight away and asks whether to delete the activities it imported. Deleting is the default, and activities you added photos, videos or a note to are listed separately so you can keep those. Stricca cannot switch off its own access to Apple Health, so the app also tells you how to do that in the Health app or your iPhone’s Settings. If you delete a workout in Apple Health, the activity it became is hidden, and you can restore it for 30 days before we delete it; if you had added photos, videos or a note to it, we keep it and ask you instead.
• Your Apple Health connection and the import record (section 2): kept for the life of your account, also after you disconnect: the import record so that an activity you deleted is not imported again, and the connection so that we can show when you gave and withdrew consent. Both are deleted with your account.
• Route records and ratings (section 2): kept for the life of your account and deleted with it. When you clear your chat history, we also delete the copy of your request text in these records. The rest of each record (distances, climb, surface, whether planning worked) stays, without your words, until you delete your account.
• The free demo route (planned without signing in): the copy of your request in its record, and in any rating, is deleted automatically after about 90 days. The rest (the measurements, the rating and the rough start area) is kept with no account and no text attached, to measure route quality.
• Messages sent without signing in are not saved to an account. So the planner can follow on from its own question, the last two exchanges that produced no route (what you typed and the planner’s replies, not your start point) are held in server memory, tied to the demo cookie (section 10) and the open page. They are used for up to 1 hour after your last message, then discarded, and deleted as soon as a route is produced or your free turns are used up.
• Verification tokens (used by the email sign-in flow): a sign-in code in the app is valid for 10 minutes and is replaced when you request another; a sign-in link from the website is valid for 24 hours, and asking for another link does not cancel it. Each is deleted the moment you use it, and expired ones are swept the next time a code is requested in the app. Deleting your account removes any outstanding code or link for your address.
• Server logs (request timestamps, IPs, response codes): retained for up to 30 days for security and abuse monitoring, then rotated.
• Consent records: kept for the life of your account and deleted with it. We do not retain them afterwards.
• Welcome email: we keep when we handled it and whether it was sent (or skipped or failed), so we never send it twice. It is deleted with your account.
• App diagnostics and server records (see section 2): about 30 days, then deleted automatically. Deleting your account removes the ones linked to it immediately.
• Backups: our database is backed up automatically and each backup is kept for 7 days. Something you delete can stay in a backup until that backup expires.

9. Your rights

You have the right to access, rectify, erase, restrict, object to, and port your data. You can complain to the UK Information Commissioner’s Office (ico.org.uk); EU/EEA users may also complain to their local data protection authority. You can exercise the main rights directly:

• Access & portability — export your data as JSON from your profile page, including your milestones, your habits as they are when you export, and your choices about them, and the activities you imported from Apple Health with the device or app each came from and the import record (section 2). The photo and video files themselves are not inside it (it lists the photos you took during your activities, and your videos); you can open them from each activity.
• Erasure — delete your account (and all associated data) from your profile page.
• Rectification — edit your preferences any time, or contact us.
• Withdrawing consent — disconnect Apple Health, or turn off AI descriptions for imported activities, in the iPhone app at any time (sections 5 and 8).
• Your habits — see them on the “Your habits” card on Home in the app (tap it for the full list). They are always on in the app. “Reset” starts them again from today. “Not my usual” stops a route being treated as one of your usual routes (it stays on your screen, marked). Neither changes how the description of each activity compares it with your earlier runs of the same route (section 6). Your habits are also in your export.
• Objecting to your habits — you have the right to object at any time to our working out your habits (section 5). To object, write to hello@predika.co.uk. We then switch your habits off for your account, as soon as we can and within one month at the latest, and they stop within a few minutes of our doing so: we stop working them out for you, the AI model no longer receives the summary of them (section 6), the route planner no longer offers your usual route, and the suggestions on Home use the distance you set in your profile. The description of each activity still compares it with your earlier runs of the same route (section 6). Switching them off deletes nothing: your habits are not stored (section 2), and your activities stay as they are. Home then shows that your habits are off, and you can turn them back on there if you change your mind.

10. Cookies

We use strictly-necessary cookies to keep you signed in and to protect the sign-in form. When you first open the website, it asks our server whether you are signed in, and our sign-in system (Auth.js) sets two security cookies: __Host-authjs.csrf-token, which protects the sign-in and sign-out forms, and __Secure-authjs.callback-url, which remembers the page of our website to take you to after you sign in. Both last until you close your browser. When you sign in, we set your session cookie, __Secure-authjs.session-token, which keeps you signed in for about 30 days after you last used the website, or until you sign out. If you sign in with Google or GitHub, one more security cookie, __Secure-authjs.pkce.code_verifier, is set for up to 15 minutes to protect that sign-in. If you use the route planner without signing in, we also set a strictly-necessary cookie, stricca_demo_used, for 24 hours. It holds a random identifier and a count of your free turns, so that we can limit the free demo and let the planner follow on from its own question (section 8). If — and only if — you accept analytics in the cookie banner, Microsoft Clarity additionally sets its own cookies to distinguish sessions: _clck and _clsk on our site, and cookies on Microsoft’s own domain, which can recognise your browser on other sites too. Microsoft lists them in its Clarity cookie documentation. We do not set advertising cookies ourselves. To withdraw analytics consent, clear this site’s stored data in your browser (the banner will ask again), or contact us.

The website also keeps a few things in your browser’s local storage. They stay on your device and are not sent to us: your cookie banner choice, light or dark mode, which routes you have already rated (so it does not ask again), and your weekly planning streak with the names of the highlight places your routes passed. Clearing this site’s stored data in your browser removes them.

11. Changes

We may update this policy; the “last updated” date will change accordingly. If a change affects how we use your personal data, we will tell you by email before we start using it in the new way.

12. Children

Stricca is not intended for users under the age of 13. We do not knowingly collect personal data from children under 13. If you are between 13 and 17, you may use Stricca only with the consent of a parent or legal guardian. If you believe we have collected data from a child under 13 in error, please contact us and we will delete it promptly.

13. Contact

Questions or requests: hello@predika.co.uk.