I'm building a read-only Strava application (Standard Tier, activity:read_all only, no write scope). It groups an athlete's own activities by distance, every half marathon, every century ride, and shows them side by side so the athlete can see how their performance has changed over time.
That comparison is only meaningful across months and years, so the application caches each authenticated athlete's own activity data locally. Querying live per interaction isn't feasible within the rate limits.
API Policy 6.2 states that Strava Data may not be retained in cache longer than seven days, and 6.4 limits retention to what is necessary for the original purpose. I can't find a carve-out for retaining an athlete's own data for the life of their account with a third-party application.
Two questions:
- May an application retain an authenticated athlete's own activity data for as long as that athlete remains an active user of the application, where the sole purpose is presenting that athlete's own history back to them? If so, is there a technical arrangement you'd expect, for example a deletion window on deauthorization? My application deletes immediately on the deauthorization webhook.
- The application can generate an image summarizing an athlete's own comparison, which the athlete may choose to post publicly. It contains only that athlete's own data, and only that athlete can create it. Is that compatible with the requirement that Strava Data be displayed only to the user it belongs to?
I would rather build to the correct interpretation now than discover it at app review.
