Privacy policy

Last updated: October 19, 2026.

Data we use

You can merge GPX files without a Strava account. File parsing and route merging run in your browser. When you authorize Strava, we use its API to retrieve your athlete ID, activity names, sport types, dates, distances, durations, route coordinates, elevation, timestamps and source device names. We use this data to display your own activities and prepare a merge that you request.

When you choose Upload to Strava, we send the merged GPX file, activity name, sport type and the description you reviewed to Strava. If you select the optional feed setting, we also ask Strava to remove the original activities from home feeds. This does not delete them or change their privacy settings.

Browser storage and retention

Local GPX activities can remain in this browser's local storage until you remove them or clear app data. Strava activities, source routes and merges derived from them stay in browser memory, are tied to your connected athlete ID and expire within 24 hours. Reloading or closing the tab clears that memory. Browser storage is not encrypted by this app. Use a private device for sensitive routes.

Sign-in uses an encrypted session cookie that contains Strava access and refresh tokens. The app server handles OAuth authentication, token refresh and connection revocation. We do not maintain a server database of your activity routes. Hosting infrastructure can process request metadata such as IP addresses and request times.

Withdraw access and delete data

Select Disconnect and delete data on the dashboard. After Strava confirms revocation, we clear this app's activities, routes and merge data in this browser, then sign you out. A written confirmation appears on the home page. If revocation fails, we show an error so you can retry.

You can also revoke access in Strava settings. A disconnected or expired session clears cached Strava data when this app next runs. You can clear this site's browser storage yourself. For deletion requests or help, email support@combine.run. Copies that you downloaded and activities you uploaded to Strava are under your control and must be deleted there.

Service providers

Vercel hosts the website and API routes. Google Maps displays route previews and receives the information needed to show the map, including route coordinates and your network request metadata. Strava processes sign-in and API requests. These providers can process information in countries outside your country of residence under their own terms and privacy policies.

Google Analytics loads only if you choose to allow optional analytics. It receives limited site navigation and interaction events, not Strava activity data, athlete IDs, GPS coordinates, route names, distances or upload descriptions. You can change your choice in the analytics control. Your choice is stored in this browser. Analytics runs in an isolated frame with cookie storage denied. It uses cookie-free measurement and does not receive a persistent client ID from this app.

Use restrictions and ownership

Your Strava data remains yours. Strava and its licensors retain their rights in Strava's platform and API materials. We do not sell Strava data, use it for advertising or send it to AI systems. We do not use Strava data to train, evaluate or operate AI models, or for product analytics. The app does not display ads.

Strava may monitor and collect usage data and use it for business purposes, including API and platform improvements, developer and user support, and checking compliance with its API Agreement. This statement describes Strava's usage data practices under section 6.5 of the Strava API Policy.

The Strava Privacy Policy governs Strava's processing and controls if it conflicts with this policy. See also the Google Privacy Policy and Vercel Privacy Policy.

Your choices and contact

You can use local GPX merging without connecting Strava or allowing analytics. Contact support@combine.run to ask about access, correction or deletion of personal data, or to raise a privacy concern. Depending on your location, you may also have a right to complain to your data protection authority.

We update this page when these practices change. We request a new authorization before accessing new categories of Strava data.