Privacy Policy
The short version
- Kinolap makes your recap video on your phone. We never receive your videos, your photos or your activities.
- Your activities travel directly from Strava to your phone. Our server only helps the app sign in to Strava, and it stores nothing.
- Your Strava sign-in is kept in your phone’s secure storage. Disconnecting asks Strava to revoke access and deletes Kinolap’s data on the phone right away.
- No ads, no tracking, no analytics, and no Kinolap account. We don’t sell data, and we don’t use it to train AI.
1. Who we are
Kinolap is a mobile app that turns a run or ride into a short vertical recap video. This policy explains how Kinolap (“Kinolap”, “we”, “us”) handles personal data when you use the app and this website. We are responsible for the personal data described in this policy.
Contact: hello@kinolap.app. Use this address for every privacy question or request, including the requests described in section 11.
This policy covers the Kinolap app for iPhone and Android and this website, kinolap.app.
2. What stays on your phone
Most of what Kinolap does happens on your device. We don’t receive the following data:
- Your Strava sign-in. After you connect Strava, the app keeps the access and refresh tokens and your basic Strava profile (athlete ID, first and last name and a link to your profile photo) in the phone’s secure storage (the iOS Keychain or the Android Keystore). Your name and photo link are refreshed from Strava at least every 48 hours and cleared if they can’t be refreshed; the athlete ID and tokens stay until you disconnect. During sign-in it also keeps a one-time check value for up to 10 minutes.
- Your activities. The app downloads your activity list and, when you open an activity, its details and data streams directly from Strava’s API to your phone. The list (summaries such as name, sport, date, distance, duration, elevation gain, place name and a simplified outline of the route) is saved on the phone for at most 48 hours so it opens quickly, and is deleted right away when you disconnect Strava. The detailed data (GPS track, time, distance, elevation, speed, heart rate, cadence, power and temperature) is held in memory only while you work on a video; Kinolap does not save it to storage.
- Your photos. When you add a photo, you pick it in the system photo picker. The app reads only that photo, keeps a resized copy in memory for the editing session and draws it into your video. It is never uploaded.
- Your videos. Kinolap draws, encodes and saves the video on your phone. It is saved to your photo library or handed to the share sheet only when you choose to. We never upload it and never see it. Temporary files from an export are deleted when the export ends, and any copy left in the app’s cache is deleted within 48 hours.
- Settings. Your language, haptics setting and similar preferences are saved on the phone.
Depending on your device settings, your phone’s own backup (for example iCloud or Google backup) may include app data such as settings or the cached activity list. Those backups are governed by Apple’s or Google’s terms. The secure storage that holds your Strava tokens is excluded from Android backups.
3. What reaches our servers
Our server is small on purpose. It has no user database, and no Kinolap accounts exist.
Strava sign-in (token broker)
Strava requires a secret key to finish a sign-in and to renew or revoke access, and that key cannot be put inside an app. So when you connect Strava, when the app renews access (about every six hours of use) and when you disconnect, the app sends our server the one-time authorization code from Strava or your refresh or access token. Our server adds the secret key, forwards the request to Strava and passes Strava’s answer (new tokens and, on first sign-in, your basic profile) back to your phone. It does not store the code, the tokens or the profile, and it does not write them to logs. It never sees your activities.
Music
When you open the music library, the app asks our server for the track list (including any search words or mood you picked) and downloads the tracks you preview or use. The downloaded tracks are cached on your phone.
Technical data in every request
Like any service on the internet, our hosting provider, Cloudflare, receives your IP address, the time, the address requested, your device’s user agent and similar technical data with every request to kinolap.app, including those from the app. This data is used to deliver the service, keep it secure and prevent abuse. Our server’s logs (Cloudflare Workers Logs) record request metadata such as your IP address, the URL requested, the time and the response status, and are deleted automatically after about 3 days. When something goes wrong, our server logs only technical details such as a status or error code (for example an error code from Strava), never the codes, tokens or activity data described above. Cloudflare also processes this data to protect its own network, as described in its privacy policy.
Emails
If you email us, we receive your email address and whatever you write, and use them to reply. Email sent to kinolap.app addresses is forwarded by Cloudflare Email Routing to our mailbox at Google (Gmail).
4. What we don’t do
- We don’t upload, store or look at your videos, photos or activities.
- We don’t show ads and don’t include advertising, tracking or analytics tools in the app or on this website.
- We don’t sell or rent personal data, and we don’t share it for advertising.
- We don’t use your data to train artificial intelligence or machine-learning models, and we don’t feed it to AI tools.
- We don’t build profiles of you or combine your data with data from other sources.
5. Strava
Kinolap is an independent app and is not affiliated with, sponsored or endorsed by Strava. When you connect, Strava asks you to allow Kinolap to read your public profile and your activities, including activities you have made visible only to yourself (Strava’s read and activity:read_all permissions). We need activity access so you can make videos of any of your activities.
- Data from Strava is used only to show you your own activities in the app and to make the videos you ask for. It is shown only to you; what you do with a finished video is your choice.
- Strava data is never stored on our servers. On your phone, the activity list is kept for at most 48 hours, and detailed activity data is not saved.
- We don’t use Strava data for analytics, advertising or AI, and we don’t sell it or combine it with other data.
- Disconnect Strava (in the app’s Settings) asks Strava to revoke Kinolap’s access and deletes the tokens and every cached activity from your phone at once. If you revoke access from Strava’s side instead (strava.com/settings/apps), the app deletes its local data the next time it contacts Strava.
- Your profile photo is loaded directly from Strava’s servers.
Strava handles your data under its own terms and privacy policy: strava.com/legal/privacy.
6. Location and heart-rate data
GPS tracks are location data, and heart rate can be health data. Many privacy laws treat both as sensitive. Kinolap processes them on your phone, at your request, only to draw the video you are making. They never reach our servers.
A recap can show where you started and finished. Because Kinolap asks for activity:read_all, the data it receives includes the parts of your route inside your Strava privacy zones, so the route in your video can show places you normally hide, such as your home. Check the video before you share it, and remove the route Widget or choose another activity if you prefer.
7. Why we process data
Where laws such as the GDPR, the UK GDPR or the Vietnamese Law on Personal Data Protection require a legal basis, we rely on:
- Providing the service you ask for (performance of our Terms of Use): the Strava sign-in broker and the music library.
- Legitimate interests in running a secure and reliable service: technical request data and security logs, and answering your emails.
- Your consent, where the law requires it for sensitive data: you give it when you connect Strava and choose an activity, and you can withdraw it at any time by disconnecting Strava.
- Legal obligations, where a law requires us to keep or disclose information.
8. Who else is involved
- Cloudflare, Inc. hosts kinolap.app and our server functions, processes technical request data on our behalf, and forwards email sent to kinolap.app addresses (Cloudflare privacy policy).
- Strava, Inc. provides your activities. Your phone connects to Strava directly, and Strava acts under its own privacy policy.
- Apple and Google distribute the app. If you share a video with another app (for example Instagram or TikTok), that service’s terms apply to what you share.
- Google provides the Gmail mailbox where the emails you send us are stored (Google privacy policy).
- Authorities, if a valid legal request requires it. We hold very little that could be disclosed.
We don’t use any other service providers that receive personal data.
9. International transfers
Our providers may handle your data outside the country where you live, including in the United States. Cloudflare runs a global network, so requests and emails may be processed in its data centres in many countries; Google stores our mailbox in its data centres; and when you choose to connect Strava, data is exchanged with Strava, Inc. in the United States at your request. These transfers go to these providers under their terms, including their data processing terms and standard contractual clauses (such as the European Commission’s) where they apply.
10. How long data is kept
| Data | Where | How long |
|---|---|---|
| Strava tokens and basic profile | Your phone (secure storage) | Until you disconnect, Strava revokes access, or you delete the app |
| Activity list (summaries) | Your phone | At most 48 hours; deleted at once when you disconnect |
| Detailed activity data (GPS, heart rate and other streams) | Your phone’s memory | Only while you edit; not saved by Kinolap |
| Photos you add | Your phone’s memory | For the editing session; your original stays in your library |
| Finished videos | Where you save or share them | Under your control |
| Music tracks | Your phone (cache) | Until the cache makes room for newer tracks or you delete the app |
| Sign-in codes and tokens passing through our server | Our server | Not stored; only in memory while the request is handled |
| Technical request data and logs | Cloudflare | About 3 days, then deleted automatically |
| Your emails to us | Our mailbox (Gmail, forwarded by Cloudflare) | As long as needed to answer you and follow up; deleted within 24 months of our last exchange |
11. Your choices and rights
Because your data lives on your phone, you control most of it directly:
- Disconnect Strava in Settings to revoke access and delete Kinolap’s data on the phone at once.
- Delete the app to remove everything it saved on the phone.
- Revoke access on Strava at strava.com/settings/apps.
- Delete videos from your photo library or wherever you shared them.
Depending on where you live, you may also have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, to withdraw consent, and to complain to a data protection authority. California residents may ask what personal information we collect and may limit the use of sensitive personal information; we don’t sell or share personal information, and we use sensitive data only to provide the features you ask for. To make a request, email hello@kinolap.app. We hold almost no personal data on our side, so most requests can be answered quickly. We won’t treat you differently for using your rights.
12. Children
Kinolap is not directed at children. You must be at least 13 years old, and old enough in your country to agree to this processing yourself (for example 16 in some EU countries), to use the app. Strava sets its own age requirements for its accounts. If you believe a child has sent us personal data, contact us and we will delete it.
13. Security
Strava tokens are kept in the phone’s secure storage. All connections to kinolap.app and to Strava are encrypted (HTTPS only). Strava’s secret key stays on our server and is never included in the app. Our server keeps no database of user data, so there is very little on our side that could leak. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
14. This website
kinolap.app is a static website. It sets no cookies, runs no scripts, and loads no analytics, trackers or third-party content; its fonts and images are served from kinolap.app itself. Cloudflare processes the technical request data described in section 3.
15. New features
If we add paid features, other activity sources (such as Apple Health, Health Connect or file import), accounts, crash reporting or analytics, we will update this policy before they launch and ask for your consent where the law requires it. If we offer paid features, purchases are processed by Apple or Google; we would receive only the purchase status needed to unlock them, never your payment details.
16. Changes to this policy
We will post any change on this page and update the date at the top. If a change materially affects how we handle your data, we will also tell you in the app before it takes effect.
17. Contact
Please send any question about this policy, and every privacy request, to hello@kinolap.app.
A Vietnamese translation of this policy is available at kinolap.app/vi/privacy. If the two versions differ, this English version prevails.