Privacy Policy

Effective date: February 26, 2026  ·  Last updated: February 27, 2026

Welcome to VeloWatt. Your privacy is important to us. This Privacy Policy explains what personal data we collect, how we collect it, the legal basis for processing, how we use and share it, how long we keep it, and your rights. Please read this policy carefully before using VeloWatt.

1. Data Controller

VeloWatt is operated by VšĮ "Dviračių kroso CX federacija" (company ID: 306191693), registered at Vilkpėdės 9-37, LT-03157, Vilnius, Lithuania.

Contact: support@velowatt.app

All data you submit to VeloWatt is submitted to VeloWatt and processed by VeloWatt. Strava, Garmin, and other third-party platform providers bear no responsibility or liability for data you submit to or store within VeloWatt, even if that data originated from their platforms.

2. Information We Collect

2.1 Account Data

When you register, we collect:

• Email address — used for authentication, account recovery, and essential service communications
• Name — used for personalization within the app
• Password — hashed using bcrypt before storage; we never store or have access to your plain-text password

2.2 Cycling Performance Data

Data you enter manually or that we calculate from your rides:

• Ride metrics: average power (watts), normalized power, max power, heart rate (avg/max), cadence, speed, distance, elevation gain, duration
• Calculated training metrics: Training Stress Score (TSS), Intensity Factor (IF), Variability Index (VI), Efficiency Factor (EF)
• Fitness tracking: Chronic Training Load (CTL), Acute Training Load (ATL), Training Stress Balance (TSB)
• User settings: Functional Threshold Power (FTP), body weight, resting heart rate, max heart rate

2.3 Strava Data

If you choose to connect your Strava account via OAuth2, we request the following scopes and collect the following data:

• Activity data: Activity name, type, date, duration, distance, elevation, average power, max power, average heart rate, max heart rate, average speed, average cadence, and Strava activity ID
• Athlete profile: Strava athlete ID (numeric identifier only)
• OAuth tokens: Access token and refresh token, stored securely and used solely for syncing your ride data

We access only cycling-type activities (ride, cycling, virtualride, ebikeride, gravelride, mountainbikeride) that include power data. We do not access your Strava social data, segments, routes, photos, followers, or any non-cycling activities. We do not post to, modify, or delete any data on your Strava account. We access only activity summary data — we do not download full activity streams (second-by-second GPS, power, or heart rate data) from Strava.

2.4 Uploaded .FIT Files

If you upload .FIT files from a Garmin, Wahoo, Hammerhead, or other cycling computer:

• The raw .FIT file is processed in memory to extract ride metrics (power, heart rate, cadence, speed, distance, elevation, duration)
• Only the extracted summary metrics are stored in our database
• The raw .FIT file is not retained after processing — it is deleted immediately
• GPS/location data contained in .FIT files is not stored

2.5 AI Coach Conversations

When you use the AI Coach feature:

• Chat messages (your questions and AI responses) are stored in our database to maintain your conversation history
• Training context sent to the AI includes: your FTP, weight, recent ride summaries (title, date, power, TSS), current fitness metrics (CTL, ATL, TSB), and power zones
• Your email address and name are not sent to the AI provider — only anonymized training data and message content

2.6 Technical & Usage Data

• Login timestamps and privacy policy agreement timestamp
• Feature usage data: We collect anonymized page views and feature interactions (e.g., which pages you visit, when you sync rides) to improve our service. This data is stored internally and never shared with third parties
• We do not use third-party analytics services, tracking pixels, or advertising SDKs
• We do not collect device identifiers, IP addresses for tracking, or location data beyond what is in uploaded .FIT files (which is not stored)

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data under the following legal bases:

Data	Legal Basis	Purpose
Account data (email, name, password)	Contract performance (Art. 6(1)(b))	Necessary to create and maintain your account and provide the service
Cycling performance data	Contract performance (Art. 6(1)(b))	Core service functionality — analytics, metrics, training tracking
Strava data	Consent (Art. 6(1)(a))	You explicitly authorize Strava access via OAuth; you can withdraw at any time
.FIT file data	Consent (Art. 6(1)(a))	You explicitly choose to upload files; extracted metrics stored under contract performance
AI Coach conversations	Consent (Art. 6(1)(a))	You choose to use the AI Coach; messages processed by third-party AI provider
Heart rate data	Explicit consent (Art. 9(2)(a))	Health-related data processed only with your explicit consent for training analytics
Technical/usage data	Legitimate interest (Art. 6(1)(f))	Service security, fraud prevention, platform improvement

Health data: Heart rate data is classified as health data under GDPR Article 9. We process this data only with your explicit consent, provided when you agree to this Privacy Policy, connect Strava, or upload .FIT files containing heart rate data. This data is used exclusively for calculating training metrics and providing AI coaching insights. We do not use health data for advertising, profiling, or any purpose unrelated to your cycling analytics.

4. How We Use Your Data

We use your personal data exclusively for the following purposes:

• Provide the core service: cycling analytics, training metrics (TSS, NP, IF, CTL, ATL, TSB), power zone calculations, FTP estimation, and performance tracking
• AI Coach: provide personalized training advice by sending anonymized training context to Anthropic's Claude API (see Section 5)
• Strava sync: import and display your cycling activities from Strava
• .FIT import: parse uploaded files and extract ride metrics
• Account management: authentication, password recovery, and service communications
• Service improvement: fix bugs, improve features, and ensure platform security

We do not use your data for advertising, marketing to third parties, user profiling for non-service purposes, building user profiles for sale, or any purpose not described in this policy.

5. AI Coach, Strava Data & AI Usage

5.1 AI Coach Processing

The AI Coach is powered by Anthropic's Claude API. When you send a message to the AI Coach, the following data is transmitted to Anthropic's servers for processing:

• Your chat message and recent conversation history (up to 20 previous messages)
• Training context: your FTP, weight, current CTL/ATL/TSB values, power zones, and summaries of your recent rides (title, date, power, duration, TSS)

We do not send your email address, name, or any directly identifying information to Anthropic. Anthropic processes this data under their Privacy Policy and Terms of Service. Anthropic's API usage policy states that API inputs and outputs are not used to train their models.

5.2 Strava Data & Artificial Intelligence

When you use the AI Coach, VeloWatt may include summary-level training metrics (such as CTL, ATL, TSB, and ride summaries) derived from your Strava activities as real-time context for generating personalized coaching responses. This is a real-time coaching interaction — equivalent to a human coach reviewing your training log — and does not constitute AI model training, development, or data mining. The AI provider (Anthropic) does not retain, store, or use this contextual data beyond generating the immediate response.

This usage is consistent with Strava's API Agreement, which permits coaching platforms focused on providing feedback to individual users about their own data and performance.

5.3 Third-Party AI Safeguards

Anthropic, our AI provider, maintains the following protections that provide equal or greater protection of user data:

• API inputs and outputs are not used to train Anthropic's models
• Data is processed in accordance with Anthropic's Privacy Policy and applicable data protection laws
• Anthropic maintains commercially reasonable security measures to protect data in transit and at rest

6. Data Sharing & Third Parties

We do not sell your personal data. We do not share your data with third parties for marketing, advertising, or data brokerage purposes. Your data is shared only with the following service providers, each of which provides equal or greater protection of your data as described in this policy:

Provider	Purpose	Data Shared	Safeguards
Anthropic (USA)	AI Coach responses	Anonymized training context + chat messages (no email/name)	API data not used for model training; governed by Anthropic Privacy Policy
Strava (USA)	Ride synchronization	OAuth tokens (to retrieve your activities)	Strava OAuth2; you control access; governed by Strava Privacy Policy
Railway (USA)	Infrastructure hosting	All application data (stored on their servers)	Data processing agreement; encrypted storage; SOC 2 compliant infrastructure

We do not share data with any other third parties, analytics services, advertising networks, or data brokers.

7. Data Storage & Security

• Passwords: Hashed using bcrypt with salt — we cannot read your password
• Authentication: Signed JWT tokens with 72-hour expiration
• Transport: All data transmitted over HTTPS (TLS 1.2+)
• Database: PostgreSQL hosted on Railway with encrypted storage, access restricted to application processes only
• Strava tokens: Stored in the database, used only for ride synchronization, automatically refreshed via OAuth2
• .FIT files: Processed in server memory only, never written to persistent storage
• Access control: Role-based access; admin functions require separate authentication

8. Data Retention

We retain your data only for as long as necessary for the purposes described in this policy:

Data Type	Retention Period	Deletion Trigger
Account data	Duration of account	Account deletion by user or admin
Ride/cycling data	Duration of account	Account deletion or individual ride deletion by user
AI Coach messages	Duration of account	User clears chat history (in-app) or account deletion
Strava OAuth tokens	Until disconnected	User disconnects Strava or account deletion
.FIT file contents	Not retained	Deleted immediately after metric extraction
Login/usage timestamps	Duration of account	Account deletion

When you delete your account (via the in-app "Delete Account" option or by contacting us), all associated data — including rides, coach messages, Strava tokens, and settings — is permanently and irreversibly deleted from our database. Deletion is executed immediately upon request; backups that may contain your data are purged within 30 days.

9. Your Rights

9.1 GDPR Rights (EU/EEA Users)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of Access (Art. 15): Request a copy of all personal data we hold about you
• Right to Rectification (Art. 16): Correct inaccurate personal data via your Settings page or by contacting us
• Right to Erasure (Art. 17): Delete your account and all associated data using the "Delete Account" feature in Settings, or by contacting us
• Right to Restriction (Art. 18): Request that we restrict processing of your data in certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format (JSON)
• Right to Object (Art. 21): Object to processing based on legitimate interest
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent for any consent-based processing at any time, without affecting the lawfulness of processing before withdrawal

9.2 How to Exercise Your Rights

• Delete your account: Use the "Delete Account" button in Settings within the app (permanently deletes all data)
• Clear AI Coach history: Use the "Clear history" button in the AI Coach section
• Disconnect Strava: Revoke VeloWatt's access in your Strava Settings → My Apps
• Update your data: Edit your name, FTP, weight, and other settings in the Settings page
• Data export, access requests, or other rights: Contact support@velowatt.app

We will respond to all rights requests within 30 days. If we need additional time (up to 60 days for complex requests), we will notify you within the initial 30-day period.

9.3 Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority. For users in Lithuania:

State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija — VDAI)
Website: https://vdai.lrv.lt
Email: ada@ada.lt
Phone: +370 5 271 2804
Address: L. Sapiegos g. 17, 10312 Vilnius, Lithuania

EU/EEA users may also contact the supervisory authority in their country of residence.

10. Consent & Withdrawal

By creating an account and agreeing to this Privacy Policy, you consent to the collection and processing of your data as described herein. For specific data processing activities based on consent (Strava connection, .FIT uploads, AI Coach usage), you provide consent at the time of each action.

Withdrawing consent:

• Strava data: Disconnect Strava in your Strava settings or contact us. Previously synced ride data will remain in your account unless you also delete those rides or your account.
• AI Coach: Stop using the AI Coach at any time. Clear your chat history using the in-app button. Previously processed messages cannot be "unprocessed" from Anthropic's systems but are governed by Anthropic's data retention policies.
• .FIT uploads: Stop uploading files at any time. Previously extracted metrics remain unless you delete those rides or your account.
• All data: Delete your account to withdraw all consent and permanently remove all data.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

11. Cookies & Local Storage

VeloWatt uses only essential, strictly necessary browser storage:

• localStorage: Stores your JWT authentication token (key: vw_token) to keep you logged in between sessions
• No tracking cookies, no third-party cookies, no analytics cookies, no advertising cookies
• No third-party analytics (no Google Analytics, no Meta Pixel, no Mixpanel, etc.)
• No advertising SDKs or tracking pixels

Because we use only essential storage required for the service to function, no cookie consent banner is required under the ePrivacy Directive. You can clear your browser localStorage at any time, which will log you out of VeloWatt.

12. International Data Transfers

Your data may be transferred to and processed in the United States by our service providers:

• Railway (hosting) — USA
• Anthropic (AI processing) — USA
• Strava (ride sync) — USA

These transfers are necessary for the performance of our contract with you (GDPR Article 49(1)(b)) and are made with your explicit consent (GDPR Article 49(1)(a)). Each provider maintains commercially reasonable security measures and is bound by their respective privacy policies and terms of service, which provide protections consistent with GDPR requirements.

13. Children's Privacy

VeloWatt is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will promptly delete such data and the associated account. If you are a parent or guardian and believe your child has provided personal data to VeloWatt, please contact us at support@velowatt.app.

14. Third-Party Platform Disclaimers

14.1 Strava

VeloWatt is an independent application and is not affiliated with, endorsed by, or officially connected to Strava, Inc. All data you submit to VeloWatt is submitted to and processed by VeloWatt alone. Strava bears no responsibility or liability for data stored within VeloWatt. VeloWatt's use of the Strava API is governed by the Strava API Agreement. VeloWatt complies with Strava's data display requirements: your Strava activity data is displayed only to you and is not shared with other VeloWatt users.

14.2 Garmin

VeloWatt can process .FIT files exported from Garmin devices. VeloWatt is not affiliated with, endorsed by, or officially connected to Garmin Ltd. or its subsidiaries. All data extracted from Garmin .FIT files is submitted to and processed by VeloWatt alone. Garmin bears no responsibility or liability for data stored within VeloWatt.

14.3 Anthropic

The AI Coach feature uses Anthropic's Claude API. Anthropic processes data according to its own Privacy Policy. VeloWatt is not affiliated with Anthropic. Anthropic bears no responsibility for the coaching advice generated through VeloWatt.

15. Data Minimization

In accordance with GDPR Article 5(1)(c), we collect only the minimum data necessary to provide our service:

• We do not collect GPS/location data (not stored from .FIT files; not requested from Strava)
• We do not collect social data, photos, or comments from Strava
• We do not collect device identifiers or advertising IDs
• We do not collect data about other apps installed on your device
• We request only the minimum Strava OAuth scopes needed for ride synchronization

16. Account Deletion

You can delete your account and all associated data at any time:

• In-app: Go to Settings → scroll down → tap "Delete Account" → confirm
• By email: Send a deletion request to support@velowatt.app from your registered email address

Account deletion permanently and irreversibly removes:

• Your account (email, name, password hash, settings)
• All ride data and training metrics
• All AI Coach conversation history
• Strava OAuth tokens and connection
• All calculated metrics (CTL, ATL, TSB, power zones)

After deletion, we retain no personal data. Any data previously sent to Anthropic for AI Coach processing is governed by Anthropic's data retention policies. We recommend also revoking VeloWatt's access in your Strava Settings after deleting your account.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes:

• We will update the "Last updated" date at the top of this page
• We will notify you through the app (you may be asked to re-agree to the updated policy)
• For material changes affecting your data or rights, we will provide at least 14 days' notice before the changes take effect

Your continued use of VeloWatt after being notified of changes constitutes acceptance. If you do not agree, you may delete your account at any time.

18. Contact

For any privacy-related questions, data requests, rights requests, or concerns:

Email: support@velowatt.app
Operator: VšĮ "Dviračių kroso CX federacija" (ID: 306191693), Vilkpėdės 9-37, LT-03157, Vilnius, Lithuania
Response time: Within 30 days of receiving your request

← Back to VeloWatt