Privacy policy

This policy explains what personal data the Wattz app and the wattz.cc website process, why, who else is involved, and what you can do about it. It follows the Swiss Federal Act on Data Protection (FADP) and, for people in the European Union and the EEA, the General Data Protection Regulation (GDPR).

In short

• No advertising, no ad tracking, no analytics and no crash-reporting tools in the app.On this website, nothing is measured without your consent.
• Your rides, profile and plan are stored on our server so that the app can keep them for you.
• The GPX files you import stay on your phone.
• You can erase everything from the app at any time, in a few taps.
• We never sell your data.

Who is responsible

For anything about your data: support@wattz.cc.

Riding without signing up

When you tap Get started, the app creates a guest account for you: no email, no name, no password. It gives your rides and settings a place on our server from the very first ride, which is why starting needs an internet connection. You can turn it into a full account later (email, Apple or Google) without losing anything.

Signing out of a guest account does not erase what it stored on our server, but you can no longer reach it. To delete it, use Settings › Account › Erase my data before you sign out.

What we process, and why

Your account

Your email address and a password, which our authentication provider stores only in hashed form. If you sign in with Apple or Google, we receive the identifier and email address they share, and your name if you allow it (Google may also share your profile picture). This lets you sign in and find your data on any device.

Your profile

Optional: first name, last name, profile photo and country. Profile photos are kept in a public storage space: anyone who has the exact link to the image can view it. Leave the photo out if you prefer.

Your training profile

Sex, height, weight, FTP and fitness level. They set your targets, your power zones and your watts per kilo; sex is used only to pick the right W/kg reference ranges.

Your rides

For each ride, a summary (duration, distance, elevation, power, cadence, average heart rate, TSS, IF, calories, time in zone, the session or route ridden) and the second-by-second recording (power, cadence, heart rate, speed, distance, and altitude when the route has one). The recording holds no GPS position. They power your reports, stats, badges and plans.

Heart rate is health data. It is recorded only if you pair a heart-rate sensor, and used only to analyse your rides. By pairing one you agree to this; you can delete any ride, or all your data, at any time.

Plans, badges and settings

Your training plan, the badges you earn, your language and display preferences, your reminder settings and the notifications the app shows you.

Your subscription

If you subscribe to Premium: the product, its price and currency, its status and its dates, as the App Store or Google Play reports them. Payment happens with Apple or Google; we never see your card or payment details.

Notifications

If you turn on reminders: your device's push token, its platform and its name, so that we can reach it.

The route builder

The number of routes you build each day (Premium), to keep the service within its limits.

Support

When you write to us, your email and what it contains. A message sent from the app also includes the app version, your phone's system and your account identifier, so that we can find the problem.

What stays on your phone

Imported GPX routes and their original files, the workouts you build, your saved routes, your reminder settings, the photos for your share cards, and rides waiting for a connection before they upload. Your login session is kept in encrypted storage on the device.

Permissions on your phone

All optional, asked only when a feature needs them:

• Bluetooth: connect your smart trainer and your heart-rate, power, cadence and speed sensors.
• Location, while you use the app and only in the route builder: centre the map on where you are. Your position is never sent to us or stored.
• Camera: take the post-ride photo for your share card.
• Photos: choose a profile picture, through your phone's own picker.
• Notifications: your training reminders.
• Files: open the GPX files you import.

The services we rely on

These providers process data for us, only for the purpose described, under contract:

• Supabase (database, sign-in, file storage and server functions). Our database is hosted in Zurich, Switzerland.
• RevenueCat (United States): manages subscriptions and checks purchases with Apple and Google. It receives your account identifier and your purchase history.
• Apple and Google: payments through the App Store and Google Play, and sign-in if you choose it, under their own privacy policies.
• Mapbox (United States): maps and terrain. Showing a map loads its tiles from Mapbox, which then sees your IP address and the area shown. When you import a route, its starting point is sent to Mapbox to name the place, and the addresses you search in the route builder go to Mapbox too. Mapbox's own usage data collection is switched off in the app.
• GraphHopper (Germany): turns the points you place in the route builder into a route on real roads.
• Open-Meteo (Switzerland), when weather and elevation are available in the app: a route's start point, rounded to about one kilometre, for the wind forecast; and a route's coordinates when its GPX file has no altitude.
• Expo (United States): delivers push notifications, with their content and your device's push token.
• Infomaniak (Switzerland): hosts this website.

Some of these providers are in the United States. Those transfers rely on the safeguards Swiss and European law require, such as the Data Privacy Framework or the European Commission's standard contractual clauses.

Legal bases

For people under the GDPR, we rely on:

• the performance of our contract with you, to run the app, your account, your rides and your subscription;
• your consent, for heart-rate data, notifications, location and the camera, which you can withdraw at any time;
• our legitimate interest, to keep the service secure, within its limits, and to answer you.

How long we keep it

As long as your account exists. When you delete it from the app (Settings › Account › Delete my account, or Erase my data as a guest), everything we hold for you is deleted: your profile, training profile, rides and their recordings, plans, badges, settings and photos. Deleting your account does not cancel a subscription: cancel it in your App Store or Google Play account. Support emails are kept as long as needed to handle your request.

Your rights

You can at any time:

• ask what data we hold about you, and get a copy;
• correct it, most of it directly in the app;
• have it erased, in the app or by writing to us;
• take your rides elsewhere: each one exports as a FIT file;
• object to a processing, or withdraw your consent.

Write to support@wattz.cc; we answer within 30 days. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, with your local data protection authority.

Security

Data travels encrypted (HTTPS). On our server, database rules let each account reach only its own data. On your phone, your session is stored encrypted.

Children

Wattz is not meant for children under 16. If you think a child has given us personal data, write to us and we will delete it.

This website

wattz.cc asks for your consent before measuring anything. The categories are:

• Strictly necessary: they remember your consent choice, stored in your browser. Never sent to a server.
• Statistics: Google Analytics 4, the site's traffic (pages viewed, device, country), kept for 14 months at most.
• Marketing: ad platforms (Google Ads, Meta, LinkedIn…), to measure the visits and requests that come from our ads and to show you our ads on those platforms. Cookies kept for 13 months at most.

These tools are managed by Google Tag Manager (Google LLC, United States / Google Ireland Limited, Ireland), loaded on every page with consent denied by default (Google's consent mode). Until you accept, no measurement or advertising cookie is set: Google's tags only send technical signals with no cookie or lasting identifier, which allow an overall statistical estimate, and the other platforms stay blocked. Your IP address reaches Google during these exchanges; Google may process it outside Switzerland, with the safeguards the law requires. Each tool only works fully for the category you accepted, and withdrawing your consent deletes its cookies. Change your choice at any time with the Cookies link at the bottom of the page or the floating cookie button. Like every web host, Infomaniak also keeps technical access logs for security, for a short time.

Changes

When this policy changes, we update this page and its date. Significant changes will be announced in the app.