Privacy policy

Data controller: Gerardas Nadieždinas, operating RideFree under the watthack.com brand. Contact info@watthack.com for privacy questions or data requests.

Your rides on your device

Workout settings, FTP, saved rides and device reconnection preferences are stored locally in your browser or app. Reconnection preferences include Bluetooth device identifiers, names and device types. The website uses localStorage for preferences, privacy choices and its Strava connection credential, sessionStorage for its temporary reporting token, and IndexedDB for saved rides. Necessary storage supports the features you request; optional reporting is disabled until you choose to enable it. Recorded rides may contain power, cadence, heart rate, speed, estimated distance, timestamps and trainer/controller information. Normal workout use does not require a RideFree account. RideFree does not record GPS routes or use HealthKit.

Delete rides through the workout archive. Clearing browser storage or removing the app can remove locally stored rides; export a copy before doing so. Local records do not automatically sync between devices.

Bluetooth and background use

Bluetooth is used to connect the trainer, optional heart rate monitor and optional compatible controllers. Bluetooth notifications can continue an already-started ride in the background. Your device controls these permissions. Picture in Picture displays workout metrics outside the main app.

Optional Strava connection

If you choose Connect to Strava, Strava asks you to authorize activity uploads. RideFree receives your Strava athlete identifier, display name and OAuth credentials. The server stores encrypted OAuth tokens, their expiration and a hashed device connection credential. On iPhone, the local connection credential is stored in Keychain; the website stores it in browser storage.

A ride is sent only when you press Send to Strava. Its FIT data, including any recorded heart rate and fitness measurements, passes through our server to Strava. The RideFree Strava service does not store the full uploaded FIT file as a ride archive. It retains upload/activity identifiers, processing status, timestamps and limited error information to check processing and avoid duplicate uploads.

Disconnect this device deletes that server-side connection and its OAuth credentials. Upload-status records may remain; contact us to request their deletion. Disconnecting does not delete the activity from Strava. You can also revoke RideFree in Strava settings and delete activities there. Strava processes uploaded information under its privacy policy.

Optional website statistics and feedback

The website offers a separate, optional usage-statistics choice. These records are pseudonymous, not guaranteed anonymous. If enabled, it sends visit and action/error types, a temporary session identifier, product families, browser/OS details, approximate country and an optional owner-test label. It does not attach ride files, power, heart rate, cadence or full device names to these statistics. Reporting and feedback cleanup targets 90 days and runs when a new reporting session starts; records can remain longer between sessions. Reporting credentials expire after 24 hours, independently of record retention. Turn optional statistics off in Privacy settings to stop future reporting. This does not delete past records; contact us to request deletion. The service also uses daily IP-derived hashes for connection rate limits, with expired limits removed during session cleanup.

Voluntary website feedback sends your typed message and basic browser/OS information to the RideFree owner. Please do not include passwords, personal contact details or health data in feedback. The native app does not include the website's optional statistics or feedback interface.

Service providers and security

Hosting and network providers process technical request information to deliver and protect the website and Strava service. Connection-attempt limits use hashed identifiers. Runtime credentials are kept on the server rather than in the app's public code. The inspected deployment uses OpenAI Sites and Cloudflare Workers/D1. Provider request logs, contractual processor identities, processing locations and international-transfer arrangements need confirmation by the operator. No assurance about their retention or transfer safeguards is made here. The separate authenticated reporting service can use a secure, HTTP-only session cookie; the public website reporting client uses a bearer token rather than that cookie.

We do not use advertising trackers, sell ride data, or use workout measurements for advertising. Exporting or sharing a file is your choice and sends it to the destination you select.

Control and contact

You can decline optional statistics, revoke Bluetooth permissions, disconnect Strava and delete locally saved rides. For server-held data, contact info@watthack.com with enough information to identify your connection or upload, such as your Strava athlete identifier. Never send passwords or access tokens. We may need to verify a request before deleting or disclosing records.

Depending on applicable law, you may request access, correction, deletion, restriction or portability of personal data, object to relevant processing, withdraw consent for optional statistics, and complain to a data protection supervisory authority. Withdrawing consent does not change the lawfulness of earlier processing. These rights may have legal limitations.

Processing information still under review: any additional operator contact particulars required by applicable law, documented legal bases for hosting/security, feedback and Strava processing, and the treatment of health-related uploads still require confirmation. This draft is not a claim that GDPR requirements are fully satisfied.

We update this page when data handling changes. The date above identifies the current policy.

RideFree · watthack.com · info@watthack.com