Privacy Policy
WattLog.pro ("we", "us", "our") runs the wattlog.pro website, the web app at app.wattlog.pro, and the WattLog.pro apps for macOS, iOS and Android (together, the "Service"). This policy explains what data we collect — including location and health-related data — why, who processes it on our behalf, where it is stored, how long we keep it, and your rights.
1. Who is responsible for your data
The controller of your personal data is Andrzej Oblong, a private individual in Poland who runs WattLog.pro as a personal project. You can reach us about anything in this policy at contact@wattlog.pro.
2. Data we collect
Account
- Email address, username and password (stored only as a salted hash) — or, if you sign in with Google or Apple, the identifier and email those services give us.
- Guest accounts: an identifier of the device that created the account, so the account cannot be used from another device.
- Your interface language and, if you arrived from one of our articles, which one (e.g. "blog-ftp").
Athlete profile and health-related data
- Name, age, sex, body weight and its history, bike weight, FTP and its history, maximum heart rate and heart-rate zones.
- Training data recorded or imported for each ride: power, heart rate, cadence, speed, distance and time, plus derived metrics (training load, zones, records), your rating of perceived effort and notes, training plans, and food or drink you log during a ride.
- Heart-rate-variability measurements you choose to take.
Heart rate, heart-rate variability and body weight are data concerning health under the GDPR (Art. 9). We process them only to provide the Service to you and only with your explicit consent (see section 4).
Location data
We collect location data only in these cases:
- GPS rides. When you record a GPS ride in the iOS or Android app, the app records your position, speed and distance for the duration of that ride. On iOS this continues while your phone is locked, so a ride is not cut short when the screen turns off — only while a ride is being recorded; the app does not track your location at any other time.
- Imported activities. Activities you import from Strava (or from GPX or TCX files) may include their GPS track and elevation profile; we store the track to show the map, the elevation and route-based analysis.
- Routes. Routes you upload or save (GPX/TCX) contain the coordinates of the route.
Indoor sessions on a smart trainer record no location. On Android, the operating system may ask for location permission to scan for Bluetooth devices; outside a GPS ride, the app does not use that permission to read your location.
Devices
- The name, type and Bluetooth address or identifier of the trainer and sensors you pair (heart-rate monitor, power meter, cadence sensor), so the apps can reconnect to them.
Connected services
- Strava — if you connect your Strava account: your Strava athlete ID and access tokens (stored encrypted), the activities you import, and the rides you choose to upload.
AI Coach
- If you use the AI Coach: the messages you write and the coach's replies, together with the training data the coach needs to answer (for example your recent load and FTP). If you use the voice coach, the recording of your spoken question.
Contact form
- If you write to us through the form on wattlog.pro: your name, email address, message and language, plus your IP address and browser identifier (user agent), which we keep with the message to deal with spam and abuse.
Account deletion survey
- If you answer the optional “why are you leaving?” question when deleting your account: the reason you pick and any comment you write, plus whether it was a guest account, the platform (web, iOS, Android or desktop), the app language, the account’s age and the number of rides recorded in the app and imported, in rough ranges (e.g. “8–30 days”, “1–5 rides”) and the day of the answer. We store the answer without any link to your account, so it stays after the account is deleted. Please don’t put personal data in the comment.
Technical data
- Server logs with your IP address, browser or app version and the requests made, used for security and troubleshooting. They are rotated automatically and deleted after 30 days.
- An access log of requests to our API: which account made the request and which data it touched, your IP address and browser or app identifier, and — for sign-up, login and password-reset attempts — a shortened form of the email address or username entered (e.g. "jo***@example.com"). It is used to detect misuse of accounts and data, and is deleted after 90 days.
3. How we use your data
- To run the Service: record and analyse your rides, compute zones, FTP, training load and plans, show maps and elevation, and keep your history available across devices.
- To send transactional emails (account confirmation, password reset, account changes, a warning before an unused account is deleted). We do not send marketing email without your explicit consent.
- To keep the Service secure and working: preventing abuse, investigating errors.
We never sell your data, share it with advertisers, show advertising, or use your data to train AI models.
4. Legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service you signed up for | Performance of a contract — Art. 6(1)(b) |
| Processing heart rate, heart-rate variability and body weight | Your explicit consent — Art. 9(2)(a), given when you create an account and agree to this policy, and when you record or import training data. You can withdraw it at any time by deleting that data or your account; this does not affect processing that took place before. |
| Location for GPS rides | Performance of a contract — Art. 6(1)(b); you start each recording yourself and grant location permission on your device |
| Strava connection and AI Coach | Your consent — Art. 6(1)(a), given by connecting Strava or using the Coach; withdrawn by disconnecting or no longer using it |
| Answering messages sent through the contact form | Our legitimate interest in answering you and keeping the form free of spam — Art. 6(1)(f) |
| Learning why riders delete their accounts (optional survey) | Our legitimate interest in improving the Service — Art. 6(1)(f); answering is voluntary and you can delete your account without answering |
| Security, abuse prevention, server logs | Our legitimate interest in a secure, working Service — Art. 6(1)(f) |
5. Who processes your data for us
We use these providers, each bound by a data processing agreement or by its terms as an independent service you choose to connect:
- Amazon Web Services (AWS) — hosting of the Service and its database, backups, file storage and sending of email. Region: us-east-1 (United States). Map tiles are served from AWS in Frankfurt (eu-central-1) and contain no personal data.
- Anthropic — the language model behind the AI Coach (United States). Receives your coach messages and the training data the coach needs, only when you use the Coach.
- ElevenLabs — speech-to-text and text-to-speech for the voice coach. Receives the recording of your spoken question and the text of the coach's reply, only when you use the voice coach.
- Strava — only if you connect your account: we receive the activities you import and send the rides you choose to upload. Strava's own privacy policy applies to data held by Strava.
- Google and Apple — only if you sign in with them, to confirm your identity.
- Google Fonts — the wattlog.pro website loads its fonts from Google, which receives your IP address when you visit the site.
6. Transfers outside the European Economic Area
Our servers are in the United States, and Anthropic and ElevenLabs process data there. These transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses in the provider's data processing terms. You can ask us for a copy of the safeguards that apply.
7. Security
All data travels over HTTPS. The server's disk is encrypted, passwords are stored as salted hashes, and third-party access tokens (such as Strava's) are encrypted in the database. Access to the servers is limited to the operator of the Service.
8. How long we keep your data
- While your account exists we keep your profile and training history so you can use it.
- When you delete your account (in the app's settings), you are signed out at once, your Strava connection is removed, and all your personal data — profile, rides, routes, plans — is permanently deleted within 30 days. Entries about your account in the API access log (below) are kept until their 90 days run out, so misuse can still be investigated.
- Guest accounts never used for a ride are deleted 30 days after they were created.
- Guest accounts with rides (used without signing up) stay signed in for 7 days after their last use; 30 days after that sign-in runs out, they are deleted together with their rides. Create an account if you want to keep them.
- Registered accounts not signed into for 12 months are deleted together with their rides, routes and plans. We email you 30 days before; signing in once keeps the account.
- Contact-form messages are deleted 12 months after they were sent; you can ask us to delete yours sooner.
- Account deletion survey answers are deleted 12 months after they were given. Because an answer is not linked to your account, we can’t find it later to delete it earlier on request.
- The API access log is deleted after 90 days, including entries made by accounts deleted in the meantime.
- Backups of the database are kept for 30 days and then deleted, so deleted data can remain in a backup for up to 30 more days.
9. Your rights
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected (most of it you can edit yourself in the app).
- Erasure — have your data deleted; deleting your account does this.
- Restriction and objection — ask us to limit processing, or object to processing based on our legitimate interest.
- Portability — export your rides as TCX or FIT files from the app, or ask us for your data in a machine-readable format.
- Withdraw consent — at any time, without affecting processing that took place before.
- Complain — to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), or to the authority in the EU country where you live.
To exercise any of these rights, email contact@wattlog.pro. We answer within one month.
10. Cookies and local storage
The apps keep your sign-in and your preferences (such as language and theme) in your browser's or device's local storage. We do not use tracking or advertising cookies, and we do not use analytics services that track you across sites.
11. Children
The Service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
12. Changes to this policy
When we change this policy, we update the date at the top. If a change affects how we use data you have already given us, we will tell you in the app or by email before it takes effect.
13. Contact
Questions about this policy or your data? Email contact@wattlog.pro.