JoyVelo

Legal

PRIVACY POLICY

Last updated: 2026-10-28

1. Who we are

JoyVelo ("we", "us", "our") operates the website joyvelo.com and related services. We're reachable at joyvelo.us@gmail.com.

2. What data we collect

  • Google account data: if you sign in with Google we receive your email address, your display name, your profile picture and Google's user id for you. We ask for nothing else — the OAuth scopes are limited to openid email profile, so we cannot read your Gmail, Drive, Photos, contacts or location. This is the only account data that exists, and it is not stored in a database on our side (see section 4).
  • JoyAnalyze training data: FIT files, power / HR / cadence samples, computed NP/TSS/segment PRs, and recovery scores that you upload live entirely inside your browser. The data is held inlocalStorage under keys likejoyanalyze:activities_v1 and never leaves your device.
  • Newsletter: email address and signup metadata (referrer, IP for spam prevention). Signups go to Resend's JoyVelo Newsletter audience; every email carries an unsubscribe link, and unsubscribing deletes the contact. We never sell or share the list.
  • Usage: anonymized page views via Vercel Analytics and Speed Insights. We do not use third-party tracking cookies.

3. Why we collect it

  • To run the on-device JoyAnalyze activity analyzer.
  • To keep you signed in to joyvelo.com, and to show your name and avatar on the /account page.
  • To send the newsletter you opted into (and nothing else).
  • To improve the site via aggregated, non-identifying analytics.

4. Where your data lives

JoyAnalyze data lives in your browser'slocalStorage; we never see it.

There is no user database. When you sign in with Google, your profile and the OAuth tokens are written into an encrypted, httpOnly session cookie that lives inyour browser. Our servers can read that cookie only on the pages that need to know who you are (/login and /account); we do not write it to any store of ours, and we cannot read it from JavaScript on any page.

Newsletter submissions are handed to Resend (an email delivery service) and stored in its JoyVelo Newsletter audience. Article content is fetched at build time from Sanity (a headless CMS) and re-served from Vercel Edge Network. We may move regions in the future; we'll update this page before doing so.

5. Cookies

We set three strictly-necessary cookies, and nothing else unless you opt in.

  • __Secure-authjs.session-token — keeps you signed in for up to 30 days. httpOnly, Secure, SameSite=Lax.
  • __Host-authjs.csrf-token — protects the sign-in form against cross-site request forgery. Deleted when the browser closes.
  • joyvelo_consent— remembers your cookie choice so we don't ask again. It stores only "analytics: yes/no", no personal data.

Vercel's Speed Insights may set a strictly-necessary cookie on the client; that cookie holds no personal data. Analytics stay off until you accept them in the cookie banner, and you can change your mind at any time.

6. Your rights (GDPR / CCPA)

You can at any time:

  • Access: ask what data we hold about you. On our side that is your newsletter signup (if you subscribed) and nothing else — the Google profile lives in your own browser's cookie, not in a database of ours.
  • Delete your sign-in: use "Sign out" on the /account page, or clear your browser's site data for joyvelo.com.
  • Export: download all your training data as FIT / GPX / JSON from inside JoyAnalyze (it's already on your device).
  • Delete JoyAnalyze data: clear your browser's site data for joyvelo.com.
  • Opt out of newsletter: every email will have an unsubscribe link.

We respond to verified requests within 30 days, in line with GDPR Art. 12.

7. Children

JoyVelo is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has submitted a newsletter signup, contact us and we'll remove the entry within 7 days.

8. Security

We use TLS everywhere and Vercel's edge firewall. Admin routes are gated by a signed session cookie plus a server-side email allowlist — there is no shared secret in the browser. Article publishing goes through Sanity's editor token, never through the public CDN. The Google client secret is stored only as a Vercel server-side environment variable and is never sent to the browser; the session cookie that carries your profile is encrypted (AES-GCM) and signed with a secret we never expose.

9. Changes to this policy

We'll bump the "Last updated" date and post a short summary of changes in the /news feed.

10. Contact

Data Protection Officer: joyvelo.us@gmail.com. EU residents may also contact our representative via the same address.