Privacy at Tom’s Gear Lab

What stays on your device

Event Calendar, Goals and some tool settings use your browser’s local storage.

Ride Card activity files and photos are read in your browser to make the image; they are not uploaded to our account database.

You can clear browser data or download a backup before changing devices. A downloaded or published Ride Card is under your control.

Your account

You can register for a public Tom’s Gear Lab account. Clerk provides authentication and verifies your sign-in. When you choose to create your Tom’s Gear Lab account, we assign a separate account ID to keep your calendar and goals separate from other riders. A verified email address is used if you choose optional email updates.

We record the first and most recent dates on which your signed-in account uses its account area; this helps us count accounts, manage the service and assess use. These counts begin when that feature starts and cannot reconstruct earlier sign-ins.

Your goals, events, event preparation plans, race day checklists, warm-up plans, bike setups, season targets and home postcode may be saved in the site’s account database so you can use them on another device. The site checks for a different device copy before replacing it.

The optional About my riding area can also save your date of birth, rider weight, riding disciplines and rider type. Date of birth distinguishes younger riders in tools and may later help with event categories; weight is used only where a cycling calculation needs it. Disciplines help you choose Event Finder filters. You can leave, edit or clear each field.

We use this information to provide the account features you request.

Optional email updates

Signing in does not subscribe you. Adults may choose occasional Tom’s Gear Lab news and cycling tool updates in My account.

We store the signed-in email, your choice, the wording version and the date of the choice. You can unsubscribe in My account.

Optional update emails are not currently being sent. An unsubscribe link will be arranged before any update emails are sent. We do not add sign-in emails to this list without an explicit choice or share subscriber addresses with prospective sponsors.

Connecting Strava

Strava is optional and is not open for general public connection. Connection access is controlled separately; registering for a Tom’s Gear Lab account does not connect Strava. For authorised connections, we store the tokens needed to access rides you allow Strava to share, and limited cached ride summaries so the account can show highlights and help you set goals. These may include ride names, dates, distance, climbing, speed, recorded power and segment results. We do not receive your Strava password. Private “Only You” activities are not available under the current connection permission.

Disconnect in My account to revoke the connection and remove its tokens and information received or derived from Strava, including historic Strava information held here.

Strava-filled goal measurements and activity links are removed; independently entered goals, targets, events, results and notes are preserved. This does not delete your Tom’s Gear Lab account.

Strava may monitor API usage to operate its platform and enforce its developer terms.

Weather & kit planner

When you request a forecast using a Great Britain postcode, we send it to Postcodes.io to find an approximate location.

For Northern Ireland you can choose a town instead; this uses an approximate town centre location and does not send a postcode to Postcodes.io.

For rides outside the UK, we send the town or place and country you enter to Geoapify to show matching locations. We then send the resulting coordinates to the Met Office Weather DataHub for an hourly forecast of the starting area.

Weather searches are not automatically saved to your account.

If you explicitly save a kit recommendation, its original clothing, explanations, ride date/time and timezone, duration, conditions and broad outward postcode (when available) are retained as a snapshot. Full postcodes and coordinates are not saved in kit history.

Guest history stays on this device and is never automatically imported into an account.

When you explicitly save recommendations and feedback while signed in, account Kit History makes them available across your signed-in devices. Device-only guest records stay separate and are not automatically copied into an account.

You may keep up to 20 recommendations without automatic replacement or age expiry.

To stop old requests restoring deleted items, each account or device history can use up to 200 recommendation references and 500 feedback references, including removed items. Removing an item can free a place in the 20 saved recommendations, but does not free an identity place. If an identity limit is reached, further creation stops; we do not silently replace records or recycle removed identities.

No automatic age expiry applies to saved recommendations or their removal references.

Removing a recommendation also removes its linked feedback; clearing feedback leaves recommendations intact. Removing feedback clears its response content; removing a recommendation clears its saved outfit and forecast snapshot as well.

We retain the minimal owner and record references, revision and removal metadata needed to prevent old requests restoring removed information. These retained references do not contain the removed snapshot, rating or comment.

Optional comments are limited to 500 plain-text characters. Mixed feedback and comments are for review only.

Account deletion includes saved kit and feedback records, using the existing owner-operated deletion procedure. Browser data removal deletes device history.

If you are signed in, your optional home postcode can fill the form; you can change it for that request. Your temperature preference remains on this device.

Simple kit feedback remains on this device when signed out; when signed in, new feedback is saved to your account so later suggestions can reflect it across devices.

Legacy feedback includes a broad kit level, a cold/right/hot rating and its original date, without invented ride information. Saved-recommendation feedback may also include a Mixed rating and an optional comment. Only eligible cold/right/hot responses enter the existing bounded personalisation rules.

You can clear saved feedback in My account. New forecast requests refresh the suggestion; opening a saved snapshot never fetches or recalculates its old forecast. Postcodes.io processes Great Britain postcode lookups, Geoapify processes international place searches, and the Met Office processes the coordinates needed for the forecast, under their respective privacy information.

Tool usage counts

We count broad Fuel Planner, Speed & Time Calculator and Weather & Kit Planner actions in daily totals to learn whether the tool helps riders. We count tool opens, calculator modes and results, comparison and pacing use, saved calculation actions, completed fuel plans, fuel additions and broad activity types. We also count kit feedback ratings by broad clothing level to flag patterns for review; this does not automatically change advice for other riders.

We do not save a rider or device identifier, entered weight, age, fuel names or individual plans, postcode or coordinates in these counts.

These totals are used to improve the tool; we may later describe aggregate use when assessing partnerships.

We do not use these counts for advertising or individual profiling. You can object without affecting the tool.

Protecting the service

When abuse controls are active, we use the network address supplied by our hosting provider to limit excessive requests to weather and tool services. We turn it into a short-lived, secret-keyed code for a ten-minute period.

The address itself is not saved in this control or used in our tool usage totals. Old codes are removed as traffic continues. Hosting providers may also process network information under their own security practices.

Contact and service providers

If you send a contact form, the details you submit go to Formspree, our contact-form provider, so we can respond.

The website is hosted by Cloudflare, with account riding information stored in its D1 database. Independent sign-in is provided by Clerk, which verifies your identity. Tom’s Gear Lab uses a separate account ID to keep your saved riding information linked to you.

These providers process information under their own privacy policies. Provider security logs and any recovery copies may have separate retention and erasure arrangements from live account records.

Following an external link, such as Google Maps or Instagram, takes you to that service. We do not sell rider information or use it for targeted advertising.

Removing kit feedback

Removing account kit feedback removes its content from future recommendations. Minimal record identifiers may remain to prevent old requests restoring removed feedback; full account deletion removes those too. Saved kit recommendations remain until you remove them.

Removing a recommendation also removes its linked feedback; clearing feedback alone keeps saved recommendations.

How long we keep it

Browser data stays until you clear it or your browser removes it. Account riding data and saved kit feedback remain until you remove them using the available controls or ask us to remove them. No automatic inactivity-deletion period is currently configured for this information.

Strava tokens remain while you authorise the connection. Strava information and derived measurements are transient caches retained for at most seven days from retrieval, including saved Strava-filled fields; updating a cache does not extend the lifetime of older Season Power information.

We remove expired records with scheduled physical cleanup and do not serve expired data.

Disconnecting or revoking permission removes Strava information and tokens.

Deleting or making a Strava activity unavailable removes its linked information after the provider notification is processed, normally within an hour and no later than 48 hours when the notification service is operating.

Independently imported activity files are processed on your device, separately from Strava.

Contact messages are kept only as needed to handle the enquiry and associated records. Ask us if you want details about a particular message.

Your choices and rights

You can use the Fuel Planner without an account or profile. It does not save your entered plan to an account in this phase. You can use many tools without an account or Strava.

You can disconnect Strava and request a copy, correction or deletion of account information through the privacy contact form.

There is no self-service account deletion yet.

To delete your full account, contact us; we verify the request, remove account data, sign-in mapping, pending connection attempts, Strava tokens, derived information and relevant caches, and delete the Clerk identity.

Deleting a Clerk identity alone does not remove your saved riding data.

We confirm completion in writing, promptly and within 30 days for Strava data.

Clear browser copies and any backups or images you control separately.

You can also raise a concern with the UK Information Commissioner’s Office. Riders under 18 can contact us with a parent or trusted adult if they prefer. We will explain any request in clear language.

This notice covers the public Tom’s Gear Lab service at tomsgearlab.com and the separate development and testing service at test.tomsgearlab.com. Production accounts are separate from TEST accounts; TEST account information is not automatically transferred to Production.

Optional website analytics

If you accept analytics, Google Analytics 4 helps us understand public page visits, broad tool use and clicks to official event sources. Google uses analytics identifiers/cookies, including _ga, and receives technical information such as browser and network information. This is not completely anonymous.

We load no Google analytics script or measurement request before your explicit choice. Rejecting analytics does not affect tools, accounts or Strava. Change your choice through Analytics settings in the footer. Withdrawal stops future collection and clears analytics cookies within our control; it does not erase information already sent to Google.

Our analytics code excludes private account/authentication pages, entered rider details, measurements, precise locations, saved plans and comments. Page URLs are stripped of personal query values and fragments; campaign labels and event parameters use a fixed approved vocabulary. Advertising features, Google Signals and cross-domain tracking are not enabled by this integration.

Google processes analytics data under its privacy information, which explains international processing and safeguards. Google’s property settings govern event/user data retention; you can ask us for the current selected period. Aggregate reports have separate retention rules. Your analytics choice stays on this browser until you change it or clear browser storage, separately from account-data and first-party usage-count choices.