Privacy Policy
Effective date: 23 October 2026
In short
- FitToStrava copies the workouts recorded by your Fitbit device from Google Health to your own Strava account. That is the only thing we use your data for.
- We never see your Google, Fitbit or Strava passwords: you sign in on their official pages.
- Detailed workout data (heart rate, calories per minute, GPS route) is erased from our server about 7 days after it reaches Strava.
- We do not sell your data, we do not use it for advertising and we do not share it with anyone except Strava, at your request.
- You can disconnect FitToStrava at any time and ask us to delete everything we hold about you.
1. Who we are
FitToStrava (www.fittostrava.com) is a free, independent service created and run by Marco Giannì, Italy, who is the data controller for the personal data described in this policy.
You can contact us at fittostrava [at] gmail.com.
FitToStrava is not affiliated with or endorsed by Fitbit, Google or Strava. Fitbit, Google Health and Strava are trademarks of their respective owners.
2. What FitToStrava does
Strava cannot read most workouts recorded by Fitbit devices on its own. FitToStrava fills that gap: after you sign in with Strava and connect Google Health, where Fitbit now keeps your data, it reads your workouts and uploads them to your Strava account with heart rate, duration, distance, calories and, when the workout has one, the GPS route. You can sync workouts by hand from your dashboard or turn on auto-sync, which regularly checks for new workouts and uploads them for you.
Fitbit switches off its old Fitbit Web API on 30 October 2026. Until 28 October 2026 FitToStrava may still read your workouts through it; from that date it reads them only through the Google Health API, as described in this policy.
3. Data we collect
From Strava, when you sign in with Strava
- Your Strava athlete ID, name and profile photo.
- The access and refresh tokens Strava gives us, which let FitToStrava upload activities to your account. We ask Strava only for permission to read your profile (
profile:read_all) and to create activities (activity:write). We cannot read your other Strava activities. - The ID of each activity we upload to Strava for you.
From Google Health, when you connect your Google account
| Permission you grant | What we read | Why |
|---|---|---|
| Activity and fitness (required) |
Your workouts: type, name, start and end time, duration, distance, steps and calories, plus your calories burned per minute during each workout. | To know which workouts to copy and to build the Strava activity. |
| Health metrics and measurements | Your heart rate samples, only for the time span of each workout. | To include the heart rate chart in the Strava activity. |
| Location | The GPS route of workouts recorded with GPS. | To show the route on the Strava map. |
| Basic profile (sign-in) | Your Google account ID, name and profile photo, and the IDs Google Health uses for your account, including your former Fitbit user ID. | To recognise you, match the Google account to your existing FitToStrava account and show your name and photo in the dashboard. |
We also store the access and refresh tokens Google gives us and the list of permissions you granted. We do not read any other Google Health data, such as sleep, weight or body measurements, and we read nothing outside the periods you sync.
Settings you choose
Your auto-sync choice, the activity types you want to sync, your time zone, and any title, sport type or distance you change before an upload.
Technical data
- A session cookie that keeps you signed in (see Cookies and analytics).
- Short technical logs that record which operations ran and whether they succeeded, for example "upload to Strava: OK" or an error code. They are designed not to contain your workout data, tokens or passwords.
- Like every website, our hosting provider records standard access logs, including your IP address, for security and to keep the service running.
- Anonymous daily counters, for example how many workouts were uploaded or how many API errors occurred in a day, which we use to monitor the service. They do not identify you.
4. How we use your data
We use your data only to provide the features you see in FitToStrava:
- reading your workouts from Google Health and showing them in your dashboard;
- uploading the workouts you choose, or all new workouts if you turn on auto-sync, to your Strava account;
- letting you download a workout as a TCX file;
- avoiding duplicate uploads and showing which workouts are already on Strava;
- keeping the service secure and working, for example spotting errors or abuse.
We do not sell your data, use it for advertising, build profiles about you, make automated decisions about you, or use it to train artificial intelligence models.
5. Google user data
The use of information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements.
FitToStrava's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice, this means that data we receive from Google:
- is used only to provide the features described above, which you can see in FitToStrava's interface;
- is transferred only to Strava, to your own account, because you asked FitToStrava to do so, and never to advertising platforms, data brokers or other resellers;
- is never used for advertising of any kind;
- is not read by any person, unless you give us explicit permission to look at a specific workout, for example when you ask for help, or unless it is needed for security or required by law.
6. Who we share it with
- Strava, at your request: the workouts you sync, with heart rate, calories, duration, distance and GPS route where available, are uploaded to your Strava account. Once there, they are governed by Strava's privacy policy and by the visibility settings of your Strava account.
- Our hosting provider, Aruba S.p.A. (Italy), which stores the FitToStrava server and database in the European Union and processes data only on our behalf.
- Google, as the source of your data, and for website statistics on our public pages (see Cookies and analytics). Google Analytics never receives your workout or health data.
- Authorities, only if the law requires it.
We share your data with no one else.
7. How long we keep it
| Data | How long |
|---|---|
| Heart rate samples, calories per minute and GPS route of a workout | Erased about 7 days after the workout has been uploaded to Strava. |
| Workouts that are never uploaded to Strava | Erased after 2 to 5 days. |
| A short summary of each uploaded workout (date, time, type, duration, distance, calories, steps, average heart rate and Strava activity ID) | Kept while you have a FitToStrava account, so we never upload the same workout twice and can show your sync history. |
| Your account data, settings and Google and Strava tokens | Kept until you delete your FitToStrava account. |
| Session cookie data on the server | Erased after 30 days without activity. |
| Technical logs and anonymous counters | Technical logs are kept for a short time; anonymous counters do not identify you. |
8. Disconnecting and deleting your data
Stop syncing
Turn off auto-sync in your FitToStrava dashboard. Nothing new will be read or uploaded.
Remove FitToStrava's access
- Google: open myaccount.google.com/connections, choose FitToStrava and remove its access. FitToStrava will no longer be able to read any Google Health data.
- Strava: in Strava, go to Settings → My Apps and revoke FitToStrava. FitToStrava will no longer be able to upload to your account.
Delete everything we hold about you
Write to fittostrava [at] gmail.com from any address and tell us the name shown on your Strava profile; we may ask a simple question to make sure the request comes from you. We will delete your FitToStrava account, settings, tokens and all workout data within 30 days, usually much sooner, and confirm by email. We will also revoke the access tokens Google and Strava gave us.
After deletion we keep only a non-reversible code derived from your Google account ID, which cannot be used to identify you or to read any data. We need it only to count connected accounts against the limit Google sets for apps like FitToStrava.
Workouts already uploaded to Strava stay in your Strava account until you delete them there: they belong to you.
9. Security
- All traffic between your browser, FitToStrava, Google and Strava is encrypted with HTTPS.
- We never ask for or store your passwords: sign-in happens on Google's and Strava's own pages through OAuth.
- Your data is stored in a database that only FitToStrava's own server can reach, and access to the server is limited to the administrator.
- Google and Strava access tokens are kept only on the server, never in your browser.
No online service can promise perfect security. If a data breach affected your personal data, we would inform you and the competent authorities as required by law.
10. Cookies and analytics
- Session cookie (strictly necessary): keeps you signed in to your dashboard. It contains only a random identifier.
- Local storage (strictly necessary): your browser remembers small preferences, such as whether you are signed in, so the right page opens straight away.
- Google Analytics: on our pages we use Google Analytics to count visits, for example pages viewed, approximate country and device type. It uses cookies set by Google and never receives your workout or health data. You can block it with your browser's cookie settings or with the Google Analytics opt-out add-on.
11. Your rights and legal bases
If you are in the European Union, the United Kingdom or another country with similar laws, you have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to its processing, and withdraw your consent at any time. To exercise any of these rights, write to fittostrava [at] gmail.com. You can also lodge a complaint with a data protection authority, such as the Italian Garante per la protezione dei dati personali or the authority where you live.
Our legal bases under the GDPR are:
- your explicit consent for heart rate, calories and other health-related workout data, and for your GPS route. You give it when you connect Google Health and tick the permissions, and you can withdraw it at any time by removing access as explained above;
- providing the service you ask for for your account data, tokens and settings;
- our legitimate interest in keeping the service secure and working, for technical logs and anonymous counters.
12. International transfers
FitToStrava's server and database are in the European Union. Google and Strava are based in the United States: when you connect your accounts, data moves between FitToStrava and those services under their own privacy policies and the safeguards they apply to international transfers.
13. Children
FitToStrava is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has used FitToStrava, contact us and we will delete their data.
14. Changes to this policy
If we change this policy, we will update the effective date at the top. If the changes are significant, for example a new type of data or a new recipient, we will tell you in your FitToStrava dashboard before they apply and, where required, ask for your consent again.
15. Contact
For any question about this policy or your data, write to Marco Giannì at fittostrava [at] gmail.com.