Last updated: 8 October 2026
This policy explains what personal data SportsSync processes, on what legal basis, for how long it is kept and who it is shared with. It is written to comply with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Controller: EMBASTIC LABS, S.L.U. Tax ID (NIF): B93828622. Registered address: Avda. Baix Penedès, 16, 43700 El Vendrell (Tarragona), Spain.
Data protection contact: privacy@sportssync.io. General contact: info@sportssync.io.
We have not appointed a Data Protection Officer. Any question about how your data is processed can be sent to the address above.
Account data: email address, name and profile details you give us when you sign up. If you sign in with Google, Google gives us your email, name and profile picture; we never see your Google password.
Sports activity data: GPS tracks (latitude, longitude and altitude), speed, distance, elevation gain, cadence, power, temperature and heart rate, taken from the GPX file you upload or from your Strava account if you choose to connect it.
Content: the videos you upload and the shorts we generate from them, including their thumbnails.
Technical data: IP address, browser type, device information, and usage and error logs.
Billing data: if you subscribe to the Pro plan, Stripe processes your payment details. SportsSync never stores or sees your card number.
Heart rate is data concerning health and therefore a special category of personal data under GDPR Article 9(1), subject to heightened protection.
We only process it if you agree. When you pick a GPX file or a Strava activity that includes heart rate, we ask you explicitly whether to use it in that activity, unless you chose “Always use it” or “Never use it” in Settings. If you agree, we store it with the activity and record when you consented; if not, we remove it before storing anything. The legal basis is your explicit consent under Article 9(2)(a) GDPR.
That consent is voluntary and you can withdraw it at any time from Settings → Heart rate: you can stop using it from now on and delete it from every activity you already have. You can use SportsSync without heart rate; the rest of your data (speed, power, altitude…) is not affected.
Shorts you have already generated have heart rate drawn into the video itself. Withdrawing consent deletes it from our data, but it can't remove it from a video that's already been made: if you don't want it to appear, delete those shorts (and, if you published them on Instagram or YouTube, there too).
We do not use this data to build health profiles, to make automated decisions about you, or share it with third parties for advertising, insurance or risk-scoring purposes.
Performance of a contract (Art. 6(1)(b)): creating and maintaining your account, processing your videos, generating shorts and providing the service you signed up for.
Explicit consent (Art. 9(2)(a)): processing of heart-rate data, as described in the previous section.
Consent (Art. 6(1)(a)): an activity's public page, which only exists if you turn it on and which you can turn off at any time.
Consent (Art. 6(1)(a)): publishing your shorts to Instagram or YouTube, which only happens if you connect those accounts; and sending marketing communications, which only happens if you expressly opt in.
Legitimate interests (Art. 6(1)(f)): platform security, abuse prevention and the technical error logs needed to keep the service running.
Legitimate interest (Art. 6(1)(f)) and Article 21(2) of the Spanish e-commerce act (LSSI): reminder emails about the service you already use (for example, that you haven't generated the short of a synced activity yet). Each includes an unsubscribe link and, if you use it, we stop sending them immediately.
Legal obligation (Art. 6(1)(c)): retention of billing records required by tax and commercial law.
To provide the service: syncing your GPS track to your video, generating the telemetry overlays and rendering the shorts.
To contact you about your account: warnings before your activities expire, confirmations and service notifications.
To share what you choose: if you make an activity public, anyone with the link sees its videos, the route and each video's data. We hide the start and end of the route, where your home usually is (300 metres at each end, or less on very short routes), and don't send heart rate or other sensor data outside the videos' stretches. If the activity comes from Strava, we ask you to confirm explicitly before publishing it. You can stop sharing at any time and the link stops working.
To remind you how to get the most out of the service, at most once per kind of reminder, with an unsubscribe link in every email.
To keep the platform secure and stable and to prevent abuse.
We do not sell your personal data, do not share it with third parties for advertising, and do not use it to train artificial intelligence models.
We run the service with the help of the following providers, each bound by a data processing agreement under GDPR Article 28:
Supabase — database and authentication, including sign-in with Google. Data resides in the eu-central-1 region (Frankfurt, Germany).
Vercel — web application hosting, content delivery network, and aggregate audience and performance measurement (Vercel Analytics and Speed Insights).
Cloudflare — storage (R2) and delivery of videos, shorts and thumbnails from our clips.sportssync.io domain.
Amazon Web Services — video rendering via Lambda functions.
Stripe — payment processing and Pro plan billing.
Resend — transactional email delivery.
Axiom — platform technical and error logs.
Slack — internal alerts to the SportsSync team: they include your email address when you sign up and the text of the feedback you send us from the app.
CARTO — map tiles displayed in the application.
In addition, if you enable them: Strava, Meta (Instagram) and Google (YouTube), described in sections 12, 13 and 14.
The database and authentication system are hosted in the European Union (Frankfurt, Germany).
Some of the processors listed in the previous section process data in the United States: Vercel, Amazon Web Services (rendering runs in the us-east-1 region), Stripe, Resend, Axiom, Slack and Cloudflare. In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission and, where the provider is certified, on the EU-US Data Privacy Framework.
You can request a copy of the safeguards in place by writing to privacy@sportssync.io.
Activities and their videos: on the free plan, 30 days from creation. On the Pro plan, for as long as the subscription is active; once it ends, 30 days from the end of the last paid period. After that they are deleted automatically from our storage, along with the shorts generated from them. We email you before it happens.
Uploaded videos that are never linked to an activity: 2 days, after which they are deleted automatically.
Heart rate: for as long as the activity exists and you don't withdraw your consent; if you withdraw it in Settings, we delete it from all your activities and from your shorts' data. Shorts already generated have it drawn into the video: to remove it from there, delete them.
Data imported from Strava: for as long as you keep the activity. If you disconnect Strava, we delete the imported route and telemetry from all your activities and confirm it by email; if you delete an activity on Strava, we delete its imported route and telemetry here.
If your Pro plan ends, during the 30 days after the end of the last paid period you can download and delete anything you want, but not create new activities or shorts. When the period ends everything is deleted at once. If you reactivate Pro before then, nothing is lost.
Account data: for as long as the account is active. If you delete your account, it is erased immediately along with your videos, shorts and third-party connections.
Billing data: for the periods required by applicable tax and commercial law.
Technical and error logs: 30 days, after which they are deleted automatically.
We encrypt data in transit using TLS and at rest. Access tokens for third-party services are stored encrypted with AES-256-GCM.
Database access is restricted by row-level security policies, so each user can only reach their own data.
No system is infallible. Should a security breach occur that poses a high risk to your rights and freedoms, we will notify you without undue delay in accordance with GDPR Article 34.
You may exercise the rights of access, rectification, erasure, restriction of processing, portability and objection, and withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise them, write to privacy@sportssync.io. We will respond within one month of receiving your request, extendable under the terms of GDPR Article 12(3).
You can delete your account and all its data yourself at any time from the Settings screen, without writing to us.
If you believe we have not handled your request properly, you have the right to lodge a complaint with the Spanish Data Protection Agency: https://www.aepd.es
We use strictly necessary cookies for authentication and to remember your preferences. If you arrive through a personal link we sent you, that link's identifier travels in the page address itself (not in a cookie) and, if you sign up from there, we record on your account which link you came from. See our Cookie Policy for details.
We measure audience and site performance in aggregate using Vercel Analytics and Vercel Speed Insights. Per their provider's documentation, neither uses cookies or persistent identifiers stored on your device.
We do not use advertising or cross-site tracking cookies.
When you connect your Strava account, SportsSync gets read-only access to your activities, GPS streams, heart rate, power, cadence, temperature, speed and elevation through the Strava API. We store your OAuth tokens (access and refresh) encrypted at rest with AES-256-GCM and use them only to import the activities you explicitly select. Imported data is stored with the activity you link it to and treated as your personal data under this policy; heart rate only with your consent (section 3). We only show it to you, unless you make the activity public after confirming explicitly. If you revoke SportsSync's access, from your Strava account settings (https://www.strava.com/settings/apps) or from SportsSync's settings screen, we delete the tokens and the data imported from Strava and email you a confirmation; if you delete an activity on Strava, we delete its imported route and telemetry here. Use of Strava data is subject to Strava's Terms of Service and Privacy Policy.
When you connect your Instagram account, SportsSync uses the Instagram Business Login API to obtain a limited-scope access token that allows publishing Reels to your account on your behalf. We store your access token encrypted at rest (AES-256-GCM) and your Instagram username. We do not read your Instagram posts, messages, followers, or any other account data — the connection is used exclusively to publish content you explicitly initiate from SportsSync. You can disconnect your Instagram account at any time from the SportsSync settings page, which immediately deletes the stored token. You can also revoke access from your Instagram settings (Settings → Website permissions → Apps and websites). Use of Instagram data is subject to Meta's Terms of Service (https://www.facebook.com/terms) and Privacy Policy (https://www.facebook.com/privacy/policy). SportsSync is an independent product and is not affiliated with, endorsed, or sponsored by Meta or Instagram.
If you connect your YouTube account, SportsSync uses the YouTube API Services to upload shorts to your channel on your behalf.
By using this feature you agree to the YouTube Terms of Service: https://www.youtube.com/t/terms
Google's handling of your data is governed by its Privacy Policy: https://policies.google.com/privacy
You can revoke SportsSync's access to your Google account at any time at https://myaccount.google.com/permissions or by disconnecting it from the SportsSync Settings screen, which deletes the stored token.
We store your access token encrypted at rest and use it only to publish the shorts you ask us to. We do not read your watch history, your subscriptions or any other account data.
For any question about this policy or about how your data is processed, write to us at privacy@sportssync.io.