Commuta is operated by Commuta Ltd, the data controller responsible for your information. Commuta Ltd is registered in England and Wales (company no. 17094056). For any privacy question or request, contact rob@commuta.cc. We process your data on two legal bases: your consent (to connect your Strava account) and our legitimate interest in running the platform and calculating your C-Coins.

Your name, email address, date of birth, body weight and activity data pulled from Strava — distance, duration, sport type, speed, elevation gain, GPS route, and heart rate and power where available.

To calculate your Commuta active-travel metrics and C-Coins, display your personal and crew dashboards and operate the service. Where you take part through an employer or other sponsoring organisation (an “organisation”), we may also use your route-matched commuting distance to produce an aggregate emissions report for that organisation — see “Taking part through an organisation” below.

We never sell your data and never use it for marketing. To run the service we rely on a few trusted providers, each receiving only what it needs: our hosting and database provider, where your data is held; our email provider, which receives your email address to send you emails such as login links; our maps provider, which powers the maps you use to register routes (when a map loads, your browser connects to it and it receives your device's IP address); and our weather provider, which supplies the resilience-bonus weather and receives only a location and time, with no name or identifier attached.

Apart from the aggregate reporting described below, we don't share your data with anyone else.

Securely on encrypted servers hosted in the European Union (Frankfurt, Germany). Where data moves between the UK and the EU, that transfer relies on the UK and EU data-adequacy arrangements.

Some crews may take part through an employer or other sponsoring organisation — for example a company, club, charity or foundation. That organisation may receive a periodic report of the emissions avoided by its members' active commuting.

The organisation sees totals only — combined distance, number of journeys, emissions avoided, and how many people took part. It does not see your individual journeys, your registered routes, your GPS traces, your activity names or times, your C-Coins, or any figure that can be attributed to you. No figures are shown at all until at least five members are taking part, so a small group cannot be read back to individuals.

Separately from that reporting, other members of your crew can see your name and C-Coins totals on the in-app leaderboard. You can turn that off at any time in your profile settings, and doing so removes you from the leaderboard other members see. If in future an organisation wishes to display a leaderboard outside the Commuta app — on an intranet page, for example — we will tell you before that happens and you will be able to opt out.

The organisation cannot request your personal data from us, and we will not provide it. Commuta Ltd remains the data controller; the organisation is a recipient of aggregate statistics only.

Taking part is voluntary. Choosing not to join, or leaving at any time, has no bearing on your employment or your membership of the organisation, and is not reported to it.

Administrator access. As set out below, named Commuta administrators can read activity data to verify C-Coins accuracy. Where a crew is run through an organisation, a Commuta administrator may also be an employee or colleague within that organisation. That access is used only for data-integrity checks and is never shared with the organisation or used for any employment or membership purpose.

If you leave the organisation, your Commuta account remains yours. Your commuting stops being included in that organisation's reporting from the date you leave the crew, and you can continue using Commuta or ask us to delete your data as set out below.

We keep your data for as long as your account is active. If you ask us to delete it, we delete your personal data within 30 days and confirm once it's done. If you disconnect Commuta from Strava, we keep your account for 7 days in case you reconnect, then delete your personal data and confirm once it's done.

If you delete an activity in Strava, that change is reflected in Commuta promptly — within 48 hours.

Aggregate reports already provided to an organisation contain no personal data and are not recalled when an individual's data is deleted.

You can request a copy of the data we hold, ask us to delete or correct it, or withdraw your consent at any time — email rob@commuta.cc. You can also revoke Commuta's access directly in Strava (Settings → My Apps). We action requests promptly and confirm in writing once a deletion is complete. You also have the right to complain to your data protection regulator — in the UK, the Information Commissioner's Office (ICO).

Commuta accesses your Strava data via Strava's official API, under the permissions you grant during authorisation. Strava is an independent data controller of the data it holds — see Strava's Privacy Policy, which governs Strava's own processing and takes precedence for Strava-held data. Strava may also monitor and collect usage data about API activity and use it for its own business purposes. You can revoke Commuta's access at any time in Strava → Settings → My Apps. Activities within a Strava privacy zone will not include GPS data and cannot receive the weather resilience bonus.

Named Commuta administrators have read access to your activity data solely for data-integrity verification and C-Coins accuracy. This access is limited to named administrators only and is not used for any other purpose. Where a crew is run through an organisation, see “Taking part through an organisation” above for what this means in practice.

Commuta uses a small number of essential cookies to keep you logged in and remember your preferences, such as your crew-leaderboard visibility. We don't use advertising or third-party tracking cookies.