Privacy Policy
Last updated 1 November 2026
This policy covers the Quiver app, the Quiver screens and the website. It explains what personal data we process, why, how long we keep it and what rights you have.
Controller
Wext AS, org. no. 937 865 252, is the controller. Send questions about privacy to privacy@wext.as.
What we process
| Category | Data | Source |
|---|---|---|
| Account | E-mail address, name and profile picture from sign-in, a user ID, and when the account was created. | You, via Clerk (Google, Apple or e-mail) |
| Strava connection | Strava ID, first name, last name, city and country, access tokens (encrypted), and when we last fetched data. | Strava, after you have granted access |
| Activities and shoes | For each run: title, sport, start time, place name, distance, time, pace, elevation gain, average heart rate, laps and which shoe. For each shoe: name, total distance and whether it is retired. No GPS tracks. | Strava |
| Home and settings | The name of your home, time zone, units, first day of the week, km limit for shoes, and which views you have set up. | You, in the app |
| Screens | Hardware ID, name, model, firmware version, panel type, battery level, signal strength, the Wi-Fi network name (not the password), last seen, and a screen token (stored as a hash). | The screen and the app |
| Purchases | Whether you have Quiver Pro, which subscription, when it renews or ends, and the store's transaction IDs. Linked to your user ID, not your name or e-mail. We never see your card details. | The App Store or Google Play, via RevenueCat |
| E-mail address and which lists you are on, for example news about ready-made screens. | You, when you ask for it | |
| Technical logs | IP address, time, request and error messages. | The app, the screens and the website |
The Wi-Fi password goes from the app directly to the screen over Bluetooth, encrypted, and is stored only on the screen. It never reaches our servers.
Why, and on what legal basis
- Providing the service: account, Strava data, views and screens. Basis: contract (GDPR Art. 6(1)(b)).
- Subscriptions: selling Quiver Pro and checking whether you have it. Basis: contract.
- News by e-mail that you have asked for. Basis: consent (Art. 6(1)(a)). You can unsubscribe in every e-mail.
- Service messages, such as changes to the terms or security notices. Basis: contract.
- Security, troubleshooting and abuse: technical logs. Basis: legitimate interest (Art. 6(1)(f)) in a secure and stable service.
Average heart rate may count as health data. We fetch it only if it exists in Strava, and only to show it with the run. The basis is your explicit consent (Art. 9(2)(a)), which you give when you connect Strava and withdraw by disconnecting.
We do not use the data for advertising, profiling or sale, and we share it with no one but the sub-processors below.
Strava
Quiver works only with Strava. When you connect, we ask Strava for read access to your profile, activities and shoes. Strava data is a cache on our side, in line with Strava's API terms:
- Data from Strava is stored for at most 7 days before it is fetched again or deleted.
- If you delete a run in Strava, it disappears from our side within 48 hours.
- If you disconnect Strava in the app, or revoke access in Strava, we delete runs and shoes immediately.
- The Strava access tokens are encrypted (AES-GCM) in the database.
Strava is an independent controller for what you have stored there. See Strava's privacy policy.
Who processes data for us
We use these sub-processors (processors). They have data processing agreements with us and may only process the data on our instructions.
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd.) | Hosting: API, background jobs, database (Cloud SQL), Secret Manager and Firebase Hosting | EU/EEA (europe-north1, Finland; europe-west1, Belgium). Firebase Hosting serves through Google's global CDN |
| Clerk, Inc. | Sign-in and user accounts | USA |
| Loops (loops.so) | E-mail: service messages and news you have asked for | USA |
| RevenueCat, Inc. | In-app purchases: subscriptions to Quiver Pro through the App Store and Google Play | USA |
More on the transfer mechanisms on the sub-processors page.
When you buy a subscription, you pay Apple or Google. They handle the payment as independent controllers, under their own privacy policies.
Transfers outside the EU/EEA
The database and the service run on Google Cloud in the EU/EEA. Clerk, Loops and RevenueCat are based in the USA. Only what they need is transferred to them: account details to Clerk, e-mail address and list choices to Loops, and your user ID, purchases and device info to RevenueCat. The transfers rely on the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
How long we keep data
- Account, home and settings: until you delete the account.
- Strava data: at most 7 days at a time, and deleted at once when you disconnect.
- Screens: until you remove the screen or delete the account. The screen then forgets the Wi-Fi and token the next time it wakes.
- E-mail lists: until you unsubscribe or delete the account.
- Purchases: kept in RevenueCat, linked only to your user ID. Write to us if you want them deleted.
- Technical logs: at most 30 days.
- Backups of the database: 7 days.
You delete the account in the app. Your Strava connection, runs, shoes, home and screens are then deleted at once, and we delete the account at Clerk and the contact at Loops.
Your rights
You have the right to access, rectification, erasure, restriction and data portability, and to object to processing based on legitimate interest. Consent can be withdrawn at any time. Write to privacy@wext.as and we will reply within 30 days.
If you believe we process data in breach of the rules, you can complain to Datatilsynet (the Norwegian Data Protection Authority). We would appreciate hearing from you first.
Security
- All traffic between the app, the screens and the server goes over HTTPS.
- Strava tokens are encrypted in the database. Screen tokens and codes are stored only as hashes.
- Secrets are kept in Google Secret Manager, and the database is reachable only by the service itself.
- Each screen gets its own token, which can only fetch images for that one screen and stops working when you remove it.
Children
Quiver is not made for children under 13. Strava also has a minimum age.
Changes
If we change this policy materially, we will tell you in the app or by e-mail before the change applies. The date at the top shows when it was last changed.