Privacy Policy

WattLabs (https://app.wattlabs.pl) is a cycling analytics service run by WattLabs, a sole proprietorship registered in Poland. We are the controller of the personal data described here, within the meaning of the EU General Data Protection Regulation (GDPR).

Questions about this policy or your data, and requests to exercise your rights: [email protected]. We have not appointed a data protection officer; this address reaches the person responsible for data protection. Our full registration details are available on request.

This policy applies to everyone who uses WattLabs, wherever they live. We apply the GDPR’s standards to every user.

You sign in with your email address. We send you a one-time sign-in link (a “magic link”) through our email delivery provider, Resend. There is no password. We also use Resend to send waitlist confirmation emails if you request an invite.

To limit abuse, we count sign-in emails per address and per IP address for a short window. These counters live only in server memory and are not stored.

• Account: your email address, your name if you give one, and whether your account is an admin or disabled account.
• Waitlist: the email address you request an invite with, and whether you confirmed it.
• Athlete profile: body mass, resting and maximum heart rate, lactate threshold heart rate, FTP and other dated metrics, aerodynamic and rolling-resistance settings, your bikes (name, mass, crank length, gearing), bike-fit measurements, training seasons, your goals, and notes you or the AI coach record (for example how a session felt).
• Rides: FIT files you upload or we sync for you, and everything we derive from them: per-second records (power, heart rate, cadence, speed, GPS position, altitude, temperature), ride summaries, power curves, training load and the other analytics shown in the app.
• Approximate home area: a median of where your rides start and finish, worked out from your rides and used only to centre maps and to pick the nearest weather station.
• Routes: routes you upload (GPX) or import from Strava for route reconnaissance, and their analysis.
• AI coach conversations you have saved.

If you connect Strava, you authorise us through Strava’s OAuth with the scopes activity:read_all,read_all. We store the access and refresh tokens Strava issues, your Strava athlete id, and the rides (summaries, streams, laps and segment efforts), starred segments and routes we read with them. Strava sends us notifications when your activities change, and we update or remove our copy to match.

You can disconnect at any time from the app. Disconnecting revokes our token at Strava and deletes the connection and every Strava-derived file we hold; rides that also exist as your own FIT files remain, Strava-only rides disappear. If you revoke access on Strava’s side instead, Strava notifies us and, once we confirm the access is really revoked, we delete the same data.

Data from Strava is not shared with other users except through the pooled road index described under Pooled road sections, which carries road facts and no rider identity, and with riding partners you accept (or an administrator connects), as part of your power model (see Who else can see your data). Powered by Strava.

Connecting Garmin Connect is optional. You approve the connection on Garmin’s own sign-in page through the Garmin Connect Developer Program (OAuth), so we never see your Garmin password. Garmin issues us access tokens, which we store encrypted with AES-256-GCM, together with your Garmin user id.

With your permission, we receive from Garmin:

• Activities: your rides, with their summaries and activity files (power, heart rate, cadence, speed, GPS position, altitude, temperature), which we analyse exactly like a FIT file you upload yourself;
• Courses, at your request: when you choose to send a route to your device, we create that course on your Garmin account.

We use Garmin data only to provide WattLabs to you: your dashboard, ride analyses and the features described in this policy. We do not sell it, rent it, use it for advertising, or use it to train AI models. We do not share it with anyone outside the uses listed under Who else can see your data.

You can disconnect Garmin at any time, from the app or from your Garmin Connect account settings. When you do, or when Garmin tells us you have withdrawn your permission, we delete the stored tokens and stop receiving data; ride files that came only from Garmin are deleted, and rides you also uploaded yourself remain.

Until the developer-program connection is available, existing Garmin connections sign in with the Garmin email and password you gave us, the password stored encrypted with AES-256-GCM. When we switch those connections over, we delete the stored passwords.

If you add an intervals.icu API key, we store it encrypted with AES-256-GCM. We use it to download your MyWhoosh rides from intervals.icu, to read your intervals.icu fitness (CTL/ATL), activity loads and planned workouts for the fitness chart, and, when you choose to, to put planned workouts on your intervals.icu calendar.

The AI coach is optional. When you use it, or when it writes a ride debrief or weekly summary for you, we send data about you, together with your messages, to OpenAI through the Vercel AI Gateway. They process it only to produce the coach’s reply. Depending on what you ask, this can include:

• ride names and titles, ride summaries, training load and power analytics;
• per-second ride traces (power, heart rate, cadence, W′ balance, altitude, speed), without GPS coordinates;
• your athlete profile, bikes, goals and coach notes, and your bike-fit log;
• your efforts on Strava segments you starred or pinned;
• the road sections you have ridden (length, grade, your times and pass counts);
• current wind at the weather station nearest your approximate home area.

We do not send your email address or your Strava, Garmin or intervals.icu credentials. We do not use your data to train AI models, and the API terms of the provider we use do not allow it to train its models on the data we send.

We fetch weather observations from public IMGW (Polish Institute of Meteorology and Water Management) stations and forecasts from Open-Meteo for locations of your rides and routes. We download OpenStreetMap road data (through Geofabrik extracts and the Overpass API) to match your rides to roads. None of these requests carries your identity.

Maps in the app load OpenStreetMap tiles in your browser, and route reconnaissance can embed Google Street View; those providers see your IP address and the map area you view.

The Courses page pools every rider’s map-matched rides into a shared index of road sections (length, surface, gradient, median speed and power, how many times and when it was last ridden, and the delay at junctions and where riders ease off). Every signed-in rider sees this index. It contains road facts only: no rider id, name, ride or home location leaves the server with it.

• Riding partners: another rider becomes your partner when one of you invites the other in the app and the other accepts, or when our administrators connect two riders at their request. A partner then sees, for the two-up, draft and head-to-head tools, your name, sex, body mass, power curve, CP/W′ model and whether you have an aerodynamic fit, and you see theirs. Either of you can remove the partnership. When you invite someone, we store the email address you enter, even if they have no account yet, and the person you invite sees your name and email address with the invitation.
• Support: our administrators can open a read-only view of your dashboard to investigate problems, and can disable, reprocess or delete accounts.
• Processors: a few service providers process data on our behalf, under contract and only on our instructions: OVHcloud (servers and storage), Cloudflare (network delivery and protection; it sees your IP address and requests), Resend (sign-in email), and OpenAI through the Vercel AI Gateway (the AI coach, when you use it).
• Legal requests: we disclose data to authorities only when the law requires it.
• We do not sell your personal data, share it for cross-context behavioural advertising, or use advertising trackers.

• All traffic to WattLabs is encrypted in transit (HTTPS/TLS).
• Access tokens, API keys and passwords for connected services are encrypted at rest with AES-256-GCM.
• Every rider’s files are kept apart, and the app serves you only your own data and what a partner you accepted shares; only our administrators can see more, for support, as described above.
• Servers accept administrative access by key only, are firewalled, and receive security updates automatically.
• If a breach puts your data at risk, we will notify you and the supervisory authority as the GDPR requires.

We only use cookies, and similar browser storage (localStorage) for preferences and unsent drafts, that the service needs. We do not use analytics or advertising cookies.

• Sign-in: a session token (a signed JWT) and the short-lived CSRF and callback cookies used while you sign in.
• Preferences: your light/dark theme, your chosen view, and dashboard filters (date range, indoor/outdoor, power-meter-only).
• Strava connect: a random state value, kept for 10 minutes, that protects the Strava authorisation step.

Our servers log requests and background jobs (for example sync and processing progress and errors) to keep the service running and to fix problems. Logs can include your user id, email address and IP address.

Your data is stored on servers in the European Union (OVHcloud data centres). Some of the providers above (OpenAI, Vercel, Cloudflare and Resend) are based in the United States and may process data there; where they do, the transfer is covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

We process your data to provide the service you signed up for (performance of a contract, GDPR Art. 6(1)(b)), to keep it secure and working (legitimate interests, Art. 6(1)(f)), and, for connecting third-party accounts and using the AI coach, because you chose to (consent, Art. 6(1)(a), which you can withdraw by disconnecting or not using the feature).

Heart rate, body mass and similar measurements can be health data. We process them only because you explicitly chose to upload or connect them (explicit consent, Art. 9(2)(a)), and only to show you your own analytics. You can withdraw that consent at any time by disconnecting the source or asking us to delete your account.

We keep your data until your account is deleted. There is no self-service deletion yet: email [email protected] and we will delete your account, your profile and every file we hold for you. Your contribution to the pooled road index drops out the next time it is rebuilt. Strava and Garmin data is deleted sooner when you disconnect that service, as described above. Server logs are kept for a limited time and then deleted.

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to our processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing done before;
• complain to a data protection supervisory authority: in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority where you live.

To exercise any of these, email [email protected]. We reply within one month and do not charge for it.

If you live outside the EU, for example in the United States, you have these same rights with us. California residents can also ask what personal information we collect, use and disclose, and ask us to delete or correct it; we will not treat you differently for doing so. We do not sell or share personal information as the California Consumer Privacy Act defines those terms.

WattLabs is not meant for children under 16, and we do not knowingly collect their data. If you believe a child has given us data, email [email protected] and we will delete it.

We will update this page and its effective date when what we do with your data changes and, for significant changes, tell you by email or in the app.