Your privacy

Last updated October 29, 2026

Everycol is a service of Composure Labs, providing virtual cycling games, route rides and workouts. Composure Labs is responsible for the personal information Everycol collects to operate this service. Contact support@everycol.com about privacy or your data.

Information we collect and why

• Account information: your name, email, date of birth, country, sign-in details and account preferences support authentication, account security, age eligibility and your rider profile. Passwords are stored as hashes.
• Riding and training: your chosen rider name and appearance, training settings, saved workouts and ride recordings. Recordings can include timestamps, duration, distance, speed, power, cadence, heart rate when available, and positions along a virtual route. We collect measurements from the trainer or sensor you connect through your browser.
• Maps and routes: searches, route points and uploaded GPX files let us build routes. Your browser asks permission before using your device location to center a map. Route coordinates describe the route you create or ride virtually, and may reveal a location you choose.
• Support: messages you send, the app screen you send them from and, when signed in, your account email help us respond. Tell us your preferred reply address and contact preferences. Do not send passwords, access tokens or unnecessary health information.
• Technical information: service requests, security records, browser/device information, app usage events and diagnostic errors help operate and protect Everycol and identify reliability problems.

What other riders can see

Live games share your public rider alias, appearance, position and gameplay information with other participants, including power-to-weight output (W/kg) and cues needed to display the ride or game. Your heart-rate readings, weight and FTP fields are not sent to other riders. Shared performance values can still allow inferences about you: for example, power and W/kg together can be used to estimate weight. Your account email, birthday and private account names are not part of the player profile. Published real-world routes are public; the route builder does not offer private routes. Personal recording history is restricted to your account.

Connecting Strava is optional

When you choose Connect with Strava and approve access on Strava, we use Strava's OAuth and API to receive your athlete ID and name, authorization tokens, granted permissions, and upload identifiers, status and errors. Tokens are encrypted on the server. We use this information to identify your connected account, maintain authorization and upload your recordings. This integration does not import your Strava activity history.

You can manage automatic sharing before connecting or later in Profile → Account & security → Strava. When enabled, newly saved hardware rides, games and workouts are submitted automatically. Connecting does not bulk-upload older recordings. You can also choose a manual upload. Demo recordings are excluded.

Uploads send the activity title, an Everycol session description, timing, distance, speed, power, cadence and available heart-rate measurements. Real World and Hybrid route rides can include route latitude, longitude and elevation. All are classified as virtual indoor rides. Photos, videos and private recording notes are not uploaded by this integration. Strava's activity visibility settings apply to the resulting activity.

You may turn off automatic sharing, disconnect in Everycol, or revoke authorization in Strava's connected-app settings. Disconnecting stops this Everycol account's future uploads; it is not a request to delete all stored information. See retention and data requests below. Removing an activity from Everycol does not remove an already uploaded Strava activity.

Strava may collect information about use of its API and use that information for its business purposes, including service improvements, support and compliance. Strava independently controls information it receives under its Privacy Policy. This policy does not change or override Strava's policy; Strava's policy controls in the event of a conflict.

Service providers and international processing

Cloudflare hosts Everycol, stores server data and delivers account emails. For analytics, we use PostHog's US-hosted service, which receives the information described below when analytics is enabled. Feedback is sent to our Notion workspace with the message, app screen and signed-in email. Map services, including OpenFreeMap, Esri, OpenStreetMap search services and the providers named in our credits, receive map requests, searches or route-area requests needed for the features you use. A provider contacted directly by your browser also receives normal network information such as your IP address.

Providers may process information outside your country. You can request information about the providers, processing locations and applicable transfer safeguards by contacting us. We do not sell your personal information.

Browser storage and analytics

Cookies keep you signed in. Browser storage holds preferences, account-separated ride recordings and locally generated highlights. Photos and videos stay in that browser unless you download or share them yourself. Clearing site storage removes local copies and may sign you out; it does not delete server records.

When analytics is enabled for the service, collection starts when you open the app, including before signing in. PostHog uses local browser storage to keep an analytics identifier across visits. Signing in associates events with an internal account identifier. PostHog receives browser/device/session information, page categories, limited Everycol lifecycle events, aggregate rendering timings and diagnostic errors. Diagnostics are filtered to remove email addresses, URL query strings and common credential patterns.

PostHog also receives your IP address and uses it to estimate your location, which can include country, region, city, postal code, time zone, latitude and longitude. These coordinates are an approximate location derived from your network address. This location information can be associated with your analytics events and account identifier. Our current analytics configuration does not enable IP-address anonymization.

We do not enable session replay or DOM autocapture. We configure analytics to exclude raw sensor samples, device and route coordinates, route contents, account profile fields, media and Strava account or upload data. The approximate location described above is added by PostHog from IP information. Public Privacy, Terms and Help pages do not load analytics. There is currently no in-app analytics opt-out control. You can contact support@everycol.com with analytics questions or requests about your data and processing choices.

Retention and deletion

Account records and private ride history remain available while you use Everycol, subject to an account or data-deletion request. Strava profile and upload metadata currently have no automatic time-based expiry. Disconnecting removes this account's Strava link and removes credentials when no Everycol account still uses them; upload records can remain. A received Strava revocation notification removes the connected athlete's credentials, profile and provider upload references. Independently recorded Everycol rides remain saved.

You can request deletion of your account, Strava-related data or other personal information at support@everycol.com. We may need to verify the requester's identity. We will confirm in writing when the requested deletion is complete and explain any information that must be retained and why. Public routes may remain after account deletion with the account detached. Let us know if your request includes a public route, support message or data in another system. Local browser copies require clearing that browser's Everycol site storage. Contact Strava separately to delete data held by Strava.

Your choices and rights

Where applicable, you may request access, a copy, correction, deletion, restriction or portability of personal information, object to processing, or withdraw consent for optional processing. Withdrawal does not affect processing already lawfully completed. You may also complain to your local data-protection authority. Request these rights through Help & data requests; there is no need to connect Strava to use Everycol.

We use information necessary to provide the service you request, to meet legal obligations, and for legitimate interests in security, support and reliability where applicable. Optional connections and disclosures rely on the permissions and consent required for those features. Account and security emails are service messages; providing an email is not an agreement to receive marketing.

Age and policy changes

Everycol accounts require users to be at least 16. Contact us if you believe an underage account has been created. We may update this policy as the service changes and will update the date above. Changes to the information requested through Strava will be explained before requesting any additional authorization.