Privacy — Pixel Watts

1. Controller

Joachim Schuldes
Kanalstr. 16a, 22085 Hamburg, Germany
Email: pixel.watts@atomar.ai

2. The basic principle: an account is required, progress is mirrored

Playing the game requires signing in with an account (see section 4). Without signing in, only the legal pages (Privacy, Terms, Legal notice, Credits) and the public physics transparency page (/physics) are reachable.

The App stores your progress primarily locally in your browser (localStorage) — settings, best times, trophies, training plan and similar progress data. So that this survives a browser reset or a change of device or browser, it is additionally mirrored into your account (see section 4). That is deliberately more than the earlier “profile and leaderboard only”, but it is still not a second-by-second recording of individual rides: the live session of a ride does not leave your browser unless you switch on one of the optional data shares in section 3.

3. Sensor data (Bluetooth / ANT+ / Wi-Fi) & optional telemetry sharing

When you pair a smart trainer, power meter or heart-rate sensor, power, cadence and heart rate are processed in the browser or in the app. Access to Web Bluetooth/USB (in the browser) or Bluetooth (in the iOS app) happens only after you grant it explicitly through the device dialog.

In the iOS app, Wahoo trainers paired over Wi-Fi (DIRCON) additionally use local network discovery (Bonjour/mDNS) to find the trainer on your network. No Wi-Fi SSID is read and no location information is collected or transmitted to us — the connection to the trainer stays a purely device-to-device connection inside your own network.

By default, your raw sensor data (power, cadence, heart rate) does not leave your browser or device. You may additionally switch on telemetry sharing yourself (“Share anonymised telemetry” in Settings) — it is off by default and helps us validate trainer control (target vs. actual power) across different trainer models. When it is on, each ride stores: a time series of target/actual power, cadence, speed, gradient and heart rate (~1 Hz), the trainer/sensor device name, the control protocol (e.g. “BLE FTMS”), FTP and body weight, and the app version — not your name or email address, but the data is visible through your account and therefore attributable to you (a pseudonymous rather than a fully anonymous record). You can switch the sharing off again at any time in Settings; new rides are then no longer transmitted. The legal basis is your consent (Art. 6(1)(a) GDPR).

4. Account & server-side data (Supabase)

For account features we use Supabase (authentication and database, hosted in the EU, Frankfurt/Germany region). Signing in is possible with Google, Sign in with Apple, an emailed magic link or email + password, and is required in order to play. In doing so we process:

Account data: email address and an authentication identifier (for signing in).
Profile: your chosen display/rider name, training-related settings (including body weight and FTP, since both feed the physics and power calculation) and app preferences.
Leaderboards: when you finish a ranked ride while signed in, we store rider name, category, W/kg, FTP, score, time, distance and elevation. These entries are publicly visible (that is what a leaderboard is for). You can switch public participation off at any time in Settings (“ride privately”) — no new entries are then published and existing ones are removed.
Game progress (progress mirroring): unlocked trophies, personal bests and high scores across all game modes, your training plan, bike/device settings, saved custom routes and similar settings and progress data — in each case the most recently changed state per data point, so that it survives a change of device or browser. Individual, second-by-second ride recordings are not included (see section 2).
Optional telemetry (see section 3), if you enabled it.
AI training content (see section 5), if you use it.
Subscription/entitlement status (paid access, trial) — see section 6.

The legal basis is Art. 6(1)(b) GDPR (providing the account and the game’s functions); for the public publication of your leaderboard entry and for the optional telemetry it is your voluntary participation/consent (Art. 6(1)(a) GDPR). You can delete your account and the data belonging to it at any time (see section 11) — that automatically removes the progress mirror, any optional telemetry and the AI logs from section 5 as well.

Google API Services (Limited Use): the use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. From the Google sign-in we process only your email address and an authentication identifier for signing in; this data is not used for advertising and not sold to third parties.

5. AI-generated training content (GEN Neo)

Ride stories, training plans and coaching text are generated by an AI (Anthropic Claude, Anthropic PBC, USA). For that we send to Anthropic: your free-text wish (if you enter one) and — where available and relevant — FTP, body weight, a rough self-reported readiness rating (if you give one), your training preferences and the context of the most recently ridden training-plan slot. Your name, email address and account data are not transmitted. We log the full requests and AI responses server-side (visible only to you and to admins, protected by row-level security) — among other things to fix errors and improve generation. The legal basis is Art. 6(1)(b) GDPR (providing the AI feature, which you actively trigger). The transfer to Anthropic (USA) is based on Standard Contractual Clauses.

6. Paid subscription & payment (Apple / LemonSqueezy)

New accounts get 14 days of full access to try it out. Optional paid subscriptions are sold on two separate paths, and we see no full payment data on either:

iOS app: as an Apple In-App Purchase. Billing runs through your Apple ID; we receive only the subscription status, by way of our payment service provider RevenueCat (RevenueCat Inc., USA), in order to unlock your account.
Web: through LemonSqueezy as Merchant of Record. Payment processing (card details, billing address, tax) happens at LemonSqueezy; we receive only the order/subscription status.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and (c) (retention under tax and commercial law). The privacy notices of Apple, RevenueCat and LemonSqueezy respectively apply. Transfers to the USA are based on Standard Contractual Clauses.

One free trial per person. So that the trial cannot simply be taken again by deleting the account and signing up afresh, we keep a small separate record of which addresses have already had one. It does not contain your address: we store a keyed hash of it (HMAC-SHA256 under a secret held on the server and never in the database), plus the date. That record deliberately carries no link to your account, because it has to outlive the deletion it exists to notice — so deleting your account removes everything else, and leaves behind an entry that cannot be read back as an address. It is deleted after 12 months. Legal basis is our legitimate interest in not giving the same person unlimited free trials (Art. 6(1)(f) GDPR), and it is the exception to erasure that Art. 17(3) allows. It is used for nothing else — not for advertising, not for recognising you, not for contacting you.

7. Newsletter (optional)

You may optionally subscribe to a newsletter. We then store your consent (newsletter_consent) alongside your account. The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future. Without consent we send no newsletter.

8. Technical data (hosting)

When the website is called up, our host (Vercel Inc., USA — transfer based on Standard Contractual Clauses) processes technically necessary data such as IP address, browser and operating system in server logs (legal basis Art. 6(1)(f) GDPR, legitimate interest in secure operation). These logs are held by the host for a short, rolling period — currently around a day on our plan — and are then deleted automatically; we do not archive them and do not combine them with your account data. The account and game database (Supabase), by contrast, is hosted in the EU.

9. Optional Strava & Intervals.icu connection

If you connect Strava, only the ride files you upload are transmitted to Strava (Art. 6(1)(a) GDPR, consent). If you instead (or additionally) connect Intervals.icu, you enter an API key in Settings. By default that key stays on your device: it is passed at runtime to our upload proxy and from there directly to Intervals.icu, and it is stripped out of the cloud backup described in section 2. Because that means entering it again on each device, you may switch on “Sync my Intervals.icu key across devices” in Settings — then, and only then, is it stored with your account, so a new device is already connected. It is off unless you turn it on (Art. 6(1)(a) GDPR, consent), and switching it off removes it from the backup again. In either case you can disconnect at any time; with no active connection, no transmission takes place.

10. No third-party advertising, no tracking

We run no advertising. The roadside boards you ride past carry our own game modes — Outride Arcade, the interval quiz, sprint mode, the track builder — the way a football game lines its pitch with its own name. They are signposts to what else the app can do, plus a prompt about the paid tiers, and they appear in every version, including a paid one. No third party buys space, nothing is personalised, and nothing about you decides which board you see.

Accordingly there are no tracking cookies, no fingerprinting, no profiling and no ad networks or data brokers receiving anything. No analytics cookies are in use either. Should an external advertising or analytics network ever be integrated, we will — where required — obtain your consent beforehand via a consent banner and update this policy first.

11. Your rights (Art. 15–22 GDPR)

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can exercise these yourself in Settings: “Export data (JSON)” (portability), “Delete all local data” and “Delete account & cloud data” — the last of which permanently deletes your account and all server-side data (profile, leaderboard entries, mirrored progress, optional telemetry, AI logs, subscription record — Art. 17 GDPR). A request to the email address above is equally sufficient. Complaints go to the competent supervisory authority (for Hamburg: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).

12. Language

This English text is provided for convenience. In case of any discrepancy, the German version at /datenschutz is the authoritative one.