Privacy policy

1. Controller

The controller of your personal data is the owner of GearWatts (see the legal notice). You can contact us about anything related to your data at [email protected]. General questions go to [email protected] and technical help to [email protected].

GearWatts is a web app, free of charge during its beta, based in Spain and aimed at users in the European Union, that analyses bike rides from cycling-computer files. It is financed by advertising.

2. Data we process

Account

Your e-mail address and the authentication data managed by Firebase Authentication, whether you sign in with an e-mail link or with e-mail and password (passwords are handled by Firebase and are never visible to us in clear text).

Rides

When you upload .fit, .tcx or .gpx files, they are read in your browser. We then store: the original file (compressed); the time series it contains (GPS track, speed, altitude, power, heart rate, cadence, gears, left/right balance, temperature and similar channels); a summary of the ride; and the ANT+ ids and serial numbers of the sensors paired with your device. A GPS track can reveal where you live, work or train, so please treat it as personal data. You can delete rides one by one at any time.

Profile

• Your bikes: name, gearing, wheel size and, optionally, a pixel-art image. That image is generated in your browser from a photo you choose; the photo itself never leaves your browser.
• Your rider name, FTP, maximum heart rate and weight.
• The names you give to climbs.

Connections (optional)

• Garmin: you paste your Garmin Personal API key. We store it encrypted (AES-256-GCM) on the server side and use it only to import your cycling activities.
• Polar AccessLink and Hammerhead: sign-in through OAuth. We store the access tokens encrypted and import only activity files.
• Google Health API: OAuth with read-only permissions for sleep and health metrics.

You can disconnect any of them at any time from your Profile.

Health data (optional)

See section 4.

Sharing

If you ask us, we can grant another GearWatts user read-only access to your rides. There are no public profiles and nothing is published.

Technical data

Like any web service, our hosting and servers process your IP address and basic technical information (browser, date and time, requested address) in order to deliver the site and keep it secure. Logs are kept by Google according to its own retention periods.

3. Purposes and legal bases

• Providing the service you request (account, storing and analysing your rides, profile, imports from the services you connect, sharing you ask for): contract / pre-contractual measures, art. 6.1.b GDPR.
• Health data: your explicit consent, art. 9.2.a GDPR (section 4).
• Security, abuse prevention and fixing errors: our legitimate interest, art. 6.1.f GDPR.
• Replying to your messages: your request and our legitimate interest in answering it.
• Advertising and analytics: your consent, art. 6.1.a GDPR, collected through the consent message described in section 7 and in the cookie policy.
• Legal obligations when applicable, art. 6.1.c GDPR.

We do not sell your data, we do not build profiles beyond the analyses you see in your own account, and we take no automated decisions that produce legal effects on you.

4. Health data

When this feature is available, you can add health data from Google Health, from Garmin or from an Apple Health export (.zip). The data we may store are daily values of: sleep, resting heart rate, heart-rate variability (HRV), blood oxygen saturation (SpO2), respiration, overnight temperature, steps and minutes of other sports. The Apple Health export file is read in your browser and only the daily values are stored.

These data are a special category under art. 9 GDPR. We use them only to show you your own charts and how your health indicators relate to your rides. We do not use them for advertising and we do not share them with anyone, except with our hosting provider acting as processor.

The legal basis is your explicit consent (art. 9.2.a GDPR), which you give when you connect a health source or import the file. You can withdraw it at any time by disconnecting the source or by asking us to delete the data at [email protected]. Withdrawal does not affect the processing carried out before it. Using GearWatts without health data is always possible.

5. Processors and international transfers

We use Google Firebase and Google Cloud as our infrastructure, with Google acting as processor under the Firebase data processing terms:

• Firebase Authentication for sign-in.
• Firestore database in the eur3 multi-region (Europe).
• Cloud Functions in europe-west1 (Belgium), used for the connections with Garmin, Polar, Hammerhead and Google Health.
• Firebase Hosting on Google's global content delivery network.

Google may process some data, for example support or operational data, in the United States or other countries. Such transfers rely on the EU-US Data Privacy Framework, where Google is certified, or on the standard contractual clauses approved by the European Commission.

When you connect Garmin, Polar, Hammerhead or Google Health, the corresponding provider is an independent controller for the data it holds under its own privacy policy. We only receive what you authorise.

6. Third parties contacted by your browser

To show maps and pages, your browser contacts the following services directly. They receive your IP address and the technical data of any web request, and they apply their own policies:

• OpenStreetMap tile servers (map images).
• AWS Terrain Tiles (elevation data).
• PNOA orthophotos of Spain's National Geographic Institute (IGN), only for routes in Spain.
• Google Fonts (typefaces).

The tile requests contain the map area being displayed, which may correspond to the area of your routes.

7. Advertising and analytics

GearWatts is financed by Google AdSense advertising, shown on public content pages and possibly inside the app. In the European Economic Area and the United Kingdom, Google's consent management message (TCF) asks for your consent to personalised ads and cookies. You can change your choice at any time from the "Cookie settings" link in the footer. Your rides and health data are never used to select ads.

The public pages use Google Analytics 4 (Google Ireland Limited) to measure visits, only if you accept it in the cookie notice: visits, pages, approximate country, device and browser, without IP addresses. The app behind sign-in does not use it. Details and how to change your choice are in the cookie policy.

8. Retention

We keep your data while your account exists. Each ride, or each connection, can be deleted by you earlier. At the moment, the account itself cannot be deleted from the app: ask for deletion by e-mail to [email protected] and we will delete the account and its data, and we can send you an export first if you wish. Backups and technical logs kept by Google are deleted according to Google's retention periods. We may keep the minimum information needed to meet legal obligations or to defend legal claims.

9. Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability and to withdraw your consent at any time. To exercise them, write to [email protected]; we may ask you to prove your identity. We will answer within one month.

If you believe that your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the supervisory authority of your country of residence.

10. Minors

GearWatts is not intended for children under 14 (art. 7 of Spanish Organic Law 3/2018, LOPDGDD) and we do not knowingly collect their data. If you think a child has created an account, tell us and we will delete it. Where the law of your country sets a higher age for consent, that age applies.

11. Security

• All traffic goes over HTTPS.
• Garmin keys and Polar and Hammerhead tokens are stored encrypted (AES-256-GCM) and are only used on the server side.
• Database access rules make your data readable only by you and, if you grant it, by the user you share with.
• Files you upload are parsed in your browser, which reduces what travels to our servers.

No system is completely secure. If a breach affects your rights, we will notify you and the authority as required by law.

12. Changes

We may update this policy, for example when we add a feature. The date of the last update is shown at the top of the page. If a change is substantial, we will tell you in the app or by e-mail.