Korra & Strava

Scope: activity:read only — never activity:read_all. We read the athlete's own activities so they show up in their Korra history next to activities from Apple Health and manual entries. Nothing else is requested.

Only in surfaces that the owner alone can see:

• My activities— the athlete's private list, where each imported activity carries an "Imported via Strava" badge.
• Activity detail — distance, moving time, pace, elevation, heart rate and laps for that single activity, with a View on Strava link back to the original activity on Strava.
• Account settings — the connect / disconnect control.

Korra has social features. None of them can read Strava data. This is enforced in the database layer: every query behind a surface another athlete can see filters out Strava-sourced activities. A Strava activity is invisible to anyone except its owner, by construction — not by convention.

• Public feed and any post visible to other athletes
• Rankings and community leaderboards
• Duels and their scoreboards
• Communities, groups and collective challenges
• Another athlete's profile as seen by a visitor
• Athlete-to-athlete comparisons

Imported Strava activities also cannot be published to the feed at all — the API rejects the attempt at the source, rather than relying on a read-time filter.

An athlete can put their own activity onto their own event photo and export it — finish time, pace, splits and the GPS route — to post wherever they like. That image always carries the official "Powered by Strava"mark, added by the renderer whenever the data came from Strava, so attribution can't be lost by editing or by picking a different layout. The map itself also credits Mapbox and OpenStreetMap.

This is the athlete exporting their own data with proper attribution — never another athlete's data, and never a Korra surface showing Strava data to a third party.

Strava data is a living mirror, not an archive. A scheduled job runs every 6 hours and deletes every Strava-sourced record whose local copy is older than 7 days. That deletion is pure database work — it never depends on an API call, so the 7-day ceiling can never be missed because of rate limits. Richer per-activity detail (laps, splits, zones) is cached with the same 7-day ceiling and re-fetched on demand when the athlete opens the activity.

Long-term history in Korra comes from Apple Health and manual entries — never from a permanent copy of Strava data.

The athlete can disconnect from inside the app at any time, or revoke access on Strava. Either way we receive the deauthorization webhook and immediately delete the OAuth tokens and every activity imported from Strava — in seconds, far inside the 30-day requirement. Activity deletions and privacy changes arrive by webhook and are reflected right away.

• Strava data is neverused in any AI or ML feature — not for training, not for embeddings, not for retrieval, not at inference time. Korra's AI features read only non-Strava activities.
• Strava data is never processed for analytics, insights or aggregate statistics — not even anonymized or de-identified.
• Strava data is never sold, shared with third parties, or routed through any intermediary platform. We never charge for it.

• Webhooks first. Activity create, update and delete events, plus deauthorization, arrive by webhook. We do not poll for new activities.
• On-demand reads. The athlete can trigger an import; detailed data is fetched only when they open that activity.
• Budgeted refresh. The refresh that keeps the 7-day mirror alive runs only for athletes who actually have live data, is capped per run, and prioritizes what is closest to expiring — so API usage scales with active athletes, not with the number of connected accounts.
• Idempotent. Imports are deduplicated by a unique Strava activity id; tokens are refreshed only when they expire.

We use the official "Connect with Strava" button, the "Powered by Strava" mark, and a "View on Strava" link on every imported activity, per the Strava Brand Guidelines. Korra is not affiliated with, endorsed by, or sponsored by Strava.

Privacy policy: korra.app.br/privacidade. For anything about this integration, including Strava Developer Program review questions, write to fotofacil@palmasnet.com.br.