Stsezhka

Appearance

Strava API review package ​

This is the operational submission runbook for increasing BikeTrack's Strava athlete capacity or rate limits. The canonical product, legal, engineering, and agent requirements are in STRAVA_COMPLIANCE_2026.md.

Evidence labels in the canonical document apply here. Unchecked boxes are VERIFY — DASHBOARD/PRODUCTION, not statements of current compliance.

Do not submit before the app has reached its self-service 10-athlete capacity and has evidence of real demand. Strava states that increases are discretionary, are not guaranteed, and have no fixed review SLA.

The 2026 API Policy defines Standard Tier levels of up to 10 and up to 9,999 registered users; Extended Access Tier generally applies at 10,000 or more users. Use the honest intended-user forecast instead of labeling every beyond-10 request as Extended Access.

Public URLs ​

The Cloud Run app, Privacy, Terms, Data Deletion, and Support URLs returned HTTP 200 during verification on 2026-07-24. The webhook returned the expected HTTP 400 without challenge parameters.

Use one consistent origin in the Dashboard, form, screenshots, and legal pages. The stsezhka.com custom domain resolved publicly with valid HTTPS and the public paths above were re-verified on 2026-07-24.

Form answers ​

Status: VERIFY — CURRENT FORM/DASHBOARD. Field names, required attachments, and eligibility can change. Re-open the current Developer Program form and API Settings Dashboard immediately before submission.

Complete the fields in Strava's developer review form as follows. Items in angle brackets need an owner decision or a value from the Strava dashboard.

  • First name: <legal first name>
  • Last name: <legal last name>
  • Email: <monitored support or owner email>
  • Company name: <legal entity, or "Independent developer">
  • API application name: BikeTrack
  • Client ID: <STRAVA_CLIENT_ID from the Strava API dashboard>
  • Additional application IDs: None
  • Current number of authenticated users: enter the real value; submit only when it is at least 10
  • Intended number of authenticated users: <honest 12-month forecast>
  • Requested athlete capacity: <capacity justified by the 12-month forecast>
  • Requested rate limits: <calculated need, or "current limits are sufficient">
  • Support URL: https://stsezhka.com/support

Suggested application description — DRAFT; NOT STRAVA-APPROVED:

BikeTrack is a bicycle route-planning and maintenance application. With explicit OAuth consent, it imports only the authenticated athlete's cycling activities and bicycle gear to update that athlete's private bike and component maintenance records. Its independent map and route planner do not depend on Strava Data. BikeTrack uses signed webhooks instead of activity polling, encrypts OAuth tokens at rest, reads Strava quota headers, throttles history backfills, limits raw Strava API cache retention to seven days, and deletes Strava-originated and derived personal data when the athlete disconnects or revokes access. It does not display another athlete's data; reproduce Strava social, leaderboard, or training features; sell or advertise against Strava Data; or send Strava Data or derivatives to AI or machine-learning systems.

Use this text only after every statement is backed by production evidence. Only select the agreement, API Policy, and Brand Guidelines confirmation boxes after the production verification checklist below has passed.

Screenshots required by the form ​

Confirmed Strava requirement: include screenshots of every place Strava Data is shown and the Connect with Strava button. The numbered list below is BikeTrack's proposed evidence package, not a Strava-published ten-file specification. Verify the current form's upload fields and limits.

Capture every screen where Strava data or Strava branding is shown. Use a seeded review account without private names, precise home locations, tokens, or client secrets.

  1. Sign-in dialog showing the official Connect with Strava button at 48 px, consent disclosure, and policy links.
  2. The Strava OAuth authorization screen showing the requested scopes.
  3. Garage before connection, showing the official connect button.
  4. Garage Strava connection panel after connection.
  5. Bike mapping step for imported Strava gear.
  6. Pending activity inbox.
  7. Activity history.
  8. Route extraction result for a Strava activity.
  9. Disconnect confirmation and the data-deletion confirmation message.
  10. Privacy Policy, Terms, Data Deletion, and Support pages.

Name the files 01-auth-dialog.png through 10-support.png and attach them to the review form in the same order. Use only synthetic review data; do not expose a real name, precise home location, token, authorization code, client secret, or private activity.

Status: BIKETRACK CONTROL. Strava does not publish this as a fixed review rubric. Prepare it so every statement in the form can be verified without a follow-up:

  • Client ID, legal owner, production URL, and store links if applicable;
  • current connected-athlete count, growth evidence, waiting list, and honest 12-month forecast;
  • requested athlete capacity and a calculation of reads/writes per athlete, including initial backfill and steady-state webhook traffic;
  • exact endpoints and scopes used, with a one-line purpose for each;
  • a data-flow diagram from Strava through backend, storage, subprocessors, and owner-only UI, including the explicit boundary preventing AI access;
  • a field-level retention schedule and disconnect/deletion procedure;
  • current subprocessor list with roles and processing locations;
  • links to Privacy, Terms, Data Deletion, and private Support;
  • a seeded demo account or short walkthrough video plus all required screenshots;
  • a signed owner statement that Strava Data and derivatives are not sent to AI, intermediaries, advertising, cross-user analytics, or third parties.

Do not include secrets, tokens, production payloads, or another athlete's data in this package.

Production verification ​

  • [ ] The Strava dashboard is upgraded to the self-service 10-athlete tier.
  • [ ] Ten real testers have successfully completed OAuth.
  • [ ] The dashboard and database both show 10 connected athletes.
  • [ ] OAuth asks only for read,activity:read_all.
  • [ ] The accepting developer or authorized legal representative is at least 18.
  • [ ] The applicable Standard Tier Strava subscription is active and confirmed in the current Dashboard.
  • [x] The production webhook subscription points to /webhooks/strava.
  • [ ] Webhook verification succeeds, and create/update/delete/revoke events return an HTTP 2xx response quickly.
  • [ ] Valid webhook POSTs are acknowledged in less than two seconds and are processed by a durable retry worker that survives instance termination.
  • [ ] A deleted Strava activity removes its imported activity, route, and applied wear without changing unrelated data.
  • [ ] Disconnect revokes access and returns a timestamped local-deletion confirmation.
  • [ ] The data inventory proves that raw activity and webhook payload cache is removed within seven days and all governed derivatives are deleted on disconnect/revocation.
  • [ ] Automated evidence proves that no Strava Data or derivative can reach Gemini, another AI client, an agent, analytics, advertising, or a public share.
  • [x] All public policy and support URLs return HTTP 200 without authentication.
  • [ ] Support includes a private monitored contact for account, privacy, and deletion requests.
  • [ ] BikeTrack/Stsezhka naming and ownership are consistent or clearly explained across the app, docs, domain, legal pages, Dashboard, and form.
  • [ ] The official Strava button is shown at its required size and is not modified.
  • [ ] Any link to source data uses View on Strava and the current Brand Guidelines.
  • [ ] Any displayed Garmin-sourced information has the attribution required by Garmin.
  • [ ] The screenshots above match the deployed version.

Webhook operations ​

The commands read credentials from apps/api/.env; never paste secrets into the shell history.

bash
cd apps/api
pnpm strava:webhook:list
pnpm strava:webhook:create
pnpm strava:webhook:delete <subscription-id>

Only one webhook subscription is allowed per Strava API application. The create command is idempotent for the configured callback URL.

References ​