Privacy Policy

BLACK RAM LABS PRIVACY POLICY

Effective Date: 13 August 2026

Black Ram Labs Pty. Ltd. ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your information when you use our applications, websites, and services (the "Service").

By using the Service, you agree to this Policy.

1. Information We Collect

We may collect:

• Personal Information: Name, contact details, email address, billing and purchase information.

• Profile Data: Height, weight, date of birth, gender, fitness preferences.

• Activity & Sensor Data: GPS, route, distance, elevation, speed, cadence, power, heart rate, and other physiological or equipment data.

• Equipment Data: Details of bikes, components, and equipment usage.

• User-Provided Data: Free-form notes, titles, comments, and other entries.

• Social Data: Messages, posts, and activity shared with others.

• Device & Usage Data: Device type, operating system, IP address, app version, feature usage, time zone, and interactions with our products.

2. Strava Integration

2.1. Lift Assisted

Lift Assisted integrates with the Strava API to access your Strava activity data. When you connect your Strava account, the following applies:

Types of data collected from Strava:

• Activity summaries (title, date, distance, moving time, elevation gain, activity type, flagged status)

• Activity GPS streams (latitude, longitude, altitude, distance, velocity) — used temporarily to detect and remove uplift segments, then discarded. Not cached.

• Segment efforts (segment name, elapsed time, grade) — displayed in the app for the selected activity, not cached.

• Athlete profile (first name, last name, profile photo) — used for account creation, stored in the BRL Accounts identity service.

Methods of collection:

• Data is accessed via the Strava API v3 using OAuth 2.0 authentication.

• You must explicitly authorise Lift Assisted in Strava before any data is accessed.

• The following OAuth scopes are requested:

  • read — view your public Strava profile

  • activity:read_all — view all your activities (including private)

  • activity:write — upload cleaned activities to your Strava account

  • profile:read_all — view your full Strava profile

Data retention:

• Activity summary data is cached for a maximum of 7 days (per Strava API Policy) and then automatically deleted.

• GPS streams and segment efforts are not cached — they are fetched on-demand and discarded after processing.

• Processing metadata (uplift count, processing date, outcome, segment IDs) is retained permanently in anonymised form. This metadata does not contain Strava Personal Data — your Strava athlete ID and activity names are not stored in the permanent processing history.

• A registry of Strava athlete IDs is maintained to prevent welcome bonus abuse and preserve processing counts across account deletion and re-creation. The Strava athlete ID is a public numeric identifier visible on your Strava profile page.

How to withdraw consent:

• Disconnect Strava in the Lift Assisted app (Settings → Disconnect Strava)

• Revoke Lift Assisted's access in your Strava account settings at https://www.strava.com/settings/apps

• Deleting your Lift Assisted account (Settings → Delete Account) also revokes Strava access

How to request deletion of your data:

• Use the "Delete Account" option in the Lift Assisted app (Settings → Delete Account), or

• Email contact@ blackramlabs.com with your request

Deletion confirmation:

• When you delete your account, you will see an in-app confirmation screen confirming that all your Strava Data and Personal Data has been permanently deleted or anonymised.

3. How We Use Information

We process your information to:

• Provide, operate, and maintain the Service.

• Plot activity profiles and calculate accurate metrics.

• Provide performance feedback and advanced analytics.

• Measure equipment usage to guide product development.

• Improve our products, services, and user experiences.

• Contribute to the improvement of the physical activity, sports, and wellness industries.

• Conduct analytics, research, and business development.

• Comply with legal obligations.

4. Data Sharing & Disclosure

We may share information as follows:

• With other users: Depending on your privacy settings.

• With service providers: For hosting, analytics, payment processing, and technical support.

• With connected services: If you link your account to a third-party platform (e.g., social media, training apps, fitness devices), we share relevant data with those services per your authorisation. You may revoke connections at any time.

• With other companies in anonymised form: Aggregated or anonymised data may be shared with third parties to help them improve their products, services, or facilities. This data cannot reasonably identify you.

• For legal reasons: When required by law or to protect rights, safety, or security.

We do not sell your personal data to advertisers. We do not use Strava Data for targeted advertising, AI training, or licensing to third parties.

5. Subprocessors

We use the following subprocessors to process data (including Strava Data) on our behalf:

Subprocessor Purpose Processing location

Google Cloud Platform (Firestore) Data storage (user data, activity cache, OAuth tokens) Multi-region (global)

Google Cloud Secret Manager Secret storage (API credentials) Multi-region

Google Cloud Functions Compute (API calls, activity processing) Region-specific

Google Cloud Tasks Async task queue (activity hydration, retries) Region-specific

We do not use any third-party analytics, AI training, or data brokerage services that process your Strava Data. We will update this list if new subprocessors are added. You may request a current list at any time by contacting contact@ blackramlabs.com.

6. Strava Usage Data

Strava may monitor and collect Usage Data related to our services use of the Strava API and may use such Usage Data for any business purpose, internal or external, including providing enhancements to the Strava API or the Strava Platform, providing developer or user support, ensuring compliance with the Strava API Agreement, or otherwise. This includes data about API calls made by our services on your behalf, such as request timestamps, endpoints accessed, and response status codes.

7. Data Storage & Transfers

• Data is stored securely on cloud servers, which may be located outside your country.

• For users in the EEA, data transfers are safeguarded in compliance with GDPR.

• Backup systems may retain deleted data for up to 90 days before being overwritten.

8. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access personal data we hold.

• Request correction or deletion.

• Object to or restrict processing.

• Request portability of your data.

• Withdraw consent at any time.

To exercise these rights, contact us at contact@ blackramlabs.com.

9. Account Deletion & Retention

When you delete your Black Ram Labs account:

• Your Strava OAuth tokens are revoked and deleted.

• Your Strava athlete ID is removed from all processing records.

• Your Strava activity cache (summary data) is permanently deleted.

• Your flagged activities list is permanently deleted.

• Your processed activity records are anonymised (your user ID is replaced with an anonymised marker; processing metadata such as uplift counts, segment IDs, and outcomes is retained for analytics and detection quality improvement).

• Your BRL Account profile (email, display name, photo) is anonymised.

• Your Firebase Authentication user is deleted.

• You will see an in-app confirmation screen confirming that deletion was completed.

Data we retain after account deletion:

• Anonymised processing metadata (no user-identifiable information)

• Strava athlete registry (public athlete ID only, no PII — used to prevent welcome bonus abuse and preserve processing counts if you re-create your account)

• Reports you have submitted (see section 10 below)

• Backup copies (up to 90 days before deletion)

Strava Data is deleted within 30 days of your request, and in most cases immediately. If you also want your data deleted from Strava, you must separately request deletion from Strava.

If you re-create your account with the same Strava account, your previous processing history (anonymised) remains, and your total rides processed count is preserved.

10. Reports & User-Submitted Content

If you submit a report (e.g., false positive, missed uplift) through the app:

• Your report is stored indefinitely, even after you delete your account.

• Reports do not contain Strava Data. They contain your internal user ID (an anonymous identifier), the Strava activity ID (a public identifier), the report type, and any notes you choose to write.

• Do not include personal information in your report notes. Report notes are stored permanently for bug-fixing and feature improvement purposes.

• You may request deletion of your reports at any time by contacting contact@ blackramlabs.com.

11. Children's Privacy

The Service is not directed to children under 16. If we learn that we have collected personal data from a child without parental consent, we will delete it promptly.

12. Security

We use reasonable technical and organisational measures (including encryption in transit and at rest) to protect your information. However, no system is completely secure.

13. Third-Party Services

The Service may link to or integrate with third-party services or devices. Their use of your data is governed by their own privacy policies.

14. Changes to This Policy

We may update this Privacy Policy periodically. Significant changes will be communicated via the Service or email.

15. Contact Us

Black Ram Labs Pty. Ltd.
contact@ blackramlabs.com
13B Madden Way,
Brentwood, WA, 6153
Australia