Privacy Policy

Last updated: 17 October 2026

This Privacy Policy explains how FrameItOrDidntHappen (“we”, “us”), the operator of FrameItOrDidntHappen (the “Service”), collects and uses your information when you use it to turn a route into poster artwork.

Information we collect

• Strava account data. With your permission (via Strava OAuth), we access your name and the activities you choose to frame, including the GPS route, distance, moving time, pace, elevation, and, where available, heart rate and calories.
• A copy of your activity list. So your activities load quickly and stay available between visits, we store the list Strava gives us: each activity's name, sport, date, route and stats. It is kept in step with Strava while you stay connected, and deleted when you disconnect (see “Data retention”).
• Authentication tokens. We store the Strava access and refresh tokens needed to fetch your activities on your behalf.
• Order data. When you buy a poster, payment is processed by Stripe; we store an order record, your email address, and a download token so we can email you the link and let you re-download it later. If you order a print, we also store the delivery address you provide, so we can print and post it, and we pass it to our carrier to make the delivery (see “Sharing and third parties”). If you choose delivery by hand in Rotterdam, we also store the phone number you give us, used only to arrange that delivery; it is not passed to a carrier. We never receive or store your card details.
• GPX files. If you upload a GPX file, we read the route in it, and any name, date and times it carries, to draw your poster. The file is held on our server for up to 12 hours so you can keep working on it, then discarded. If you add the poster to your basket, its route is kept with that order like any other (see “Data retention”).
• Gifts. If you buy a gift, or we send one to someone, we store the recipient's email address and any message, with the gift code, so we can email them the gift and let them redeem it. We use the address only for that.
• Messages. If you write to us through the contact form, we receive your name, email address, message and any photos you attach, by email. We use them only to answer you.
• Technical data. A session cookie keeps you signed in. We do not use advertising or cross-site tracking cookies.

How we use your information

We use your information only to operate the Service: to fetch the activity you select, render your poster, deliver your download, post any print you order, and provide support.

Legal bases (where GDPR applies)

We rely on your consent (connecting Strava), on performance of a contract (fulfilling your order, including a gift), and on our legitimate interest in answering messages you send us.

Sharing and third parties

We do not sell your personal data. We share it only with the providers needed to run the Service:

• Strava. The source of your activity data.
• Stripe. Payment processing.
• Cloudflare R2. Storage of your generated poster files.
• Resend (resend.com). Sending your order confirmation, download link and delivery updates by email.
• PostNL (Netherlands). Delivery of prints. To post your parcel we pass PostNL the delivery name and address you gave us, your email address so they can send you delivery updates, the parcel's weight, and our own order reference. PostNL keeps its own record of the shipment under its own privacy statement. Nothing is sent to PostNL for a digital file.
• Print&Bind (printenbind.nl, Netherlands). Printing of posters ordered as prints. We send Print&Bind the print file of each poster, which shows what you put on it (your route, and any name, date or text you typed). We do not send them your name, email address or delivery address: our print orders are addressed to us, and we pack and post your order ourselves. Nothing is sent to Print&Bind for a digital file.
• Railway. Application hosting and the database where order records and Strava tokens are stored.
• Cloudflare. DNS, content delivery, and email routing for our contact addresses.
• Our email provider. The mailbox our contact and order addresses deliver to, where your messages to us arrive.
• OpenStreetMap Foundation (Nominatim, United Kingdom). To print the town your route starts in, we send Nominatim the start point rounded to about 100 m. Nothing else about you or the activity is sent.

Stripe, Cloudflare, Railway and Resend are US companies, as is our email provider, and some of your data may be processed in the United States. Where it leaves the European Economic Area, the transfer relies on the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's standard contractual clauses. The United Kingdom, where Nominatim is run, is covered by an adequacy decision of the European Commission.

Data retention

We keep your Strava tokens and our copy of your activity list while your account is connected; you can disconnect at any time. When you revoke our access from your Strava settings, Strava tells us, and we delete your name, your tokens and every stored activity, automatically and without you having to ask. Digital files you have already bought are not affected: they stay yours to download. A purchased digital file stays available to download for 1 month after purchase; after that the stored file is deleted and the download link stops working, so please save your poster within that window. A print does not include the digital file; the print file we generate in order to print your order is deleted on the same 1 month schedule, along with the postage label we made for your parcel. Order records themselves (including any delivery address you provided for a print) are retained for as long as applicable law requires (in the Netherlands, generally seven years for tax and accounting purposes), after which they are deleted or anonymised. Delivery details we hand to our carrier are also held by the carrier under its own retention policy, which we cannot delete on your behalf.

Your rights and choices

You may request access to, correction of, or deletion of your data, and you may object to or ask us to restrict how we use it, or ask for a copy in a portable form, by contacting contact@frameitordidnthappen.com. You can revoke FrameItOrDidntHappen's access to Strava at any time from strava.com/settings/apps.

If you think we have handled your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. We would rather hear from you first, so we can put it right.

Security

Data is transmitted over HTTPS and tokens are stored securely. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

Changes to this policy

We may update this policy; we will revise the “last updated” date above when we do.

Contact

Questions? Contact us at contact@frameitordidnthappen.com.