OpenRadlr

Privacy policy

This policy covers this website (openradlr.com) and the official OpenRadlr server (app.openradlr.com). Servers run by other people are their responsibility.

Who is responsible

[Full name, address, email: as in the imprint]

The short version

This website

The website is static. When you open it, the web server processes your IP address, the requested page, time, browser and referrer to deliver the page and to protect against abuse. These logs are rotated and deleted after a short time (at most about 30 MB of logs are kept).

We count visits with a self-hosted instance of Plausible Analytics. Plausible uses no cookies and stores no personal data; IP addresses are only used to build a daily changing hash and are not stored. We see totals such as page views, referrers and countries.

The app

In your browser: your name, weight, FTP, settings and known Bluetooth devices are saved in your browser’s local storage. Ride photos and the ride summary stay in the open tab until you download them. You can delete the stored data by clearing the site’s data in your browser.

On the server, while you ride: your name, weight, power, speed, position on the route and chat messages are processed in memory, so that other riders can see you and the physics can work. Other riders see your name, position and power. Nothing of this is written to disk; it is gone when you leave or the server restarts. Server logs (IP address, time, errors) are rotated after a few days.

Bluetooth devices (trainer, heart rate strap, controller) connect directly to your browser. Their readings are processed as above; heart rate stays in your browser.

Strava (optional)

If you press Connect with Strava, Strava asks for your consent and sends the server a token, your Strava ID and name. The token is kept in memory to upload your rides and is gone after a server restart. When you upload a ride, the ride file (time, power, speed, cadence, heart rate, elevation, positions in the virtual world) goes to Strava; from then on Strava’s privacy policy applies. You can revoke access at any time in your Strava settings.

We process data to provide the service you request (Art. 6(1)(b) GDPR), on the basis of our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR) and, for Strava, with your consent (Art. 6(1)(a) GDPR).

Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, to data portability and to lodge a complaint with a supervisory authority. Because we keep almost nothing, most requests are answered by “we no longer have it”. Write to the address in the imprint.