Hi,
We’re a small Danish company (Epic Efforts, epicefforts.com) that turns an athlete’s own activity into a printed poster or apparel. The athlete connects Strava, picks one of their own activities, designs the print and orders it.
We’re on Standard Tier at 10 athletes and submitted the review form in early October, but haven’t heard back. Customers who want to connect are now being turned away, so I’d be grateful if someone could look at our application.
A few details that may help the review:
- Only the connecting athlete’s own data (
activity:read_all,profile:read_all). Nothing is written to Strava, nothing is shared between athletes, no AI training. - Tokens stay server-side, no refresh tokens are stored, and activity data is cached for at most 15 minutes.
- The deauthorization webhook is active and deletes everything tied to the athlete.
- Official “Connect with Strava” button, “Compatible with Strava” and “View on Strava” on the activity.
One question I’d like your guidance on: since a connection is only needed while the athlete designs their print, we revoke our token via /oauth/revoke an hour after connecting, so we hold no standing access to anyone’s account. Is that acceptable to you, or would you prefer we don’t revoke automatically? Happy to change it either way.
Thanks a lot,
Laus Risby, Epic Efforts
laus.risby@epicefforts.com
