Privacy Policy
Ride Analytics is a training-metrics tool for a small cycling club. This page states what data we store about you, why we store it, and for how long — including the heart-rate and power data that is health-adjacent personal data under GDPR Article 9.
What we store, why, and for how long
Original FIT files
We keep the original file you upload (never deleted, never overwritten). Training-metric formulas are revised over time — a new formula, or a corrected FTP entry, has to be recomputed from the original file, not a cached result — so original files are retained indefinitely for as long as your account exists.
1 Hz ride data (including heart rate and power)
Each ride's second-by-second stream — power, heart rate, cadence, speed, altitude, temperature, position — is stored so charts and trends can be shown and recomputed. Heart rate and power readings are processed only on your explicit, distinct consent at signup (GDPR Article 9 special-category health data), and are retained for as long as the corresponding activity exists in your account.
Derived metrics
Normalised power, training stress, efficiency factor, and similar figures computed from your streams are stored so pages load quickly without recomputing on every view. These are recomputed and overwritten whenever the underlying formula or your FTP history changes, and are retained for as long as the source activity exists.
Account identity
Your email address and account approval status are stored for as long as your account exists, so we can authenticate you and control access to your own data.
Where your data is processed
All data is stored and processed in EU regions. We use the following processors, each under a signed Data Processing Agreement:
- Supabase (EU/Frankfurt) — database, file storage, and sign-in.
- Vercel — hosts the web application.
- Inngest — runs background import jobs (e.g. processing a bulk upload); it does not store your ride data itself.
The full register of processing regions and Data Processing Agreement status for every processor above is maintained at docs/data-processors.md in the project repository — that register, not this page, is the source of truth if the two ever appear to disagree.
Lawful basis
Account data and derived metrics are processed under legitimate interest in providing the training-analysis service you signed up for. Heart-rate and power data is processed only on your explicit, opt-in consent, captured as its own distinct checkbox at signup — it is never bundled with a general terms-of-service acceptance, and you cannot create an account without it, since the app cannot function without this data.
Your rights
You can ask to see a copy of everything stored about you, ask us to correct inaccurate data, or ask us to delete your account and all associated files and data. Self-service export and deletion tools are planned; until they ship, email the club admin to request any of these, and we will act on it without undue delay.
Your data is never shown to other club members without your explicit, separate opt-in.