Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Hosting and technical infrastructure

Website and web application (Vercel). The website and the web application are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Upon each visit, Vercel processes the connection data technically required to deliver the service and to ensure operational security (IP address, date and time of access, requested resource, browser and device identifiers) in server log files. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and stable provision of the service. Log files are deleted automatically after a short period. Vercel is certified under the EU-U.S. Data Privacy Framework; in addition, EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR have been concluded.

Database (Supabase). All account, training, and health data are processed in a database operated by Supabase Inc., 970 Toa Payoh North #07-04, Singapore, acting as a processor pursuant to Art. 28 GDPR. The data is stored exclusively in the eu-central-1 region (Frankfurt am Main, Germany). A data processing agreement is in place; EU Standard Contractual Clauses have been concluded for any access from third countries.

Android app. The Android app is distributed via Google Play. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is the independent controller for the download and installation; its privacy policy applies. The app contains no analytics, advertising, or tracking libraries and loads no third-party content. To connect to a smart trainer and a heart rate sensor, the app uses Bluetooth Low Energy and requests the “Nearby devices” permission for this purpose. Up to Android 11, the system requires the location permission for Bluetooth scanning; the app neither reads nor stores any location. Sign-in uses a user account created via 4000watt.app; the session is stored locally on the device and is not included in the Android backup.

Email communication (IONOS). Email mailboxes are operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, as a processor, in data centers located in Germany.

3. Website access and web analytics

Cookies. No cookies are used on the website for analytics or advertising purposes. The web application uses only technically necessary cookies and local storage mechanisms for session management (login). Their use does not require consent pursuant to Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the associated data processing is based on Art. 6(1)(b) GDPR.

Reach measurement (Vercel Web Analytics). Vercel Web Analytics is used to measure website usage in aggregate (visitor numbers, referral sources, pages viewed). The method operates without cookies and without device-based recognition; IP addresses are not stored. No combination with other data and no profiling takes place. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the statistical evaluation of the service's reach.

4. Account, training data, and health data

Registration and account. Use of 4000Watt requires the creation of a user account. The data processed comprises the email address, name, and the details stored in the profile (in particular body weight, FTP value, and maximum heart rate). The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement). Registration is reserved for persons who have reached the age of 18; confirmation of the minimum age is obtained during registration. During registration, optional consent may additionally be given to receiving product information by email; details are set out in Section 7.

Email dispatch log. A log entry is stored for every email sent by 4000Watt, comprising the recipient address, subject, type and time of the message, but not its content. The legal basis is Art. 6(1)(c) GDPR in conjunction with the obligation to be able to demonstrate confirmation of a cancellation (Section 312k(4) of the German Civil Code), and otherwise Art. 6(1)(f) GDPR; the legitimate interest lies in being able to trace dispatch. The entry is retained even after the user account has been deleted – without any link to the account, but still with the recipient address – and is deleted automatically once the third calendar year following dispatch has ended.

Trial register. To prevent the free trial from being claimed repeatedly by registering the same email address again, a marker derived from the email address (HMAC-SHA256 with a secret key) is stored together with the start date whenever a trial or a membership without a payment method begins. The email address itself is not stored for this purpose; the marker cannot be traced back to the address and serves solely to check whether a trial has already begun for an address. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in preventing abuse of free trials. The marker is retained for 24 months from the start of the trial, even after the user account has been deleted, and is then deleted automatically.

Training data. During training sessions, data from connected devices is processed – in particular power output (watts), cadence, and smart trainer control data – together with the metrics calculated from it (in particular training load values). The legal basis is Art. 6(1)(b) GDPR. In addition, the name and type of connected devices and device-related settings (such as the trainer’s mass) are stored with the user account in order to enable reconnection and to make these settings available on all platforms.

Health data (heart rate). Heart rate data – recorded during training, as part of recovery measurements, or from imported activities – constitutes health data within the meaning of Art. 9(1) GDPR. Such data is processed exclusively on the basis of explicit consent pursuant to Art. 9(2)(a) GDPR, which is obtained separately during registration. The processing purposes are limited to the provision of the training features: display and analysis of training sessions, calculation of training load, and derivation of training recommendations. Storage takes place exclusively in the database in Frankfurt am Main referred to in Section 2. The data is neither transferred to third parties nor used for advertising purposes. Consent may be withdrawn at any time with effect for the future in the settings. Without this consent, the heart-rate-based features are unavailable; all other use of the service remains unaffected.

5. Strava Connect

Users may voluntarily connect their Strava account to 4000Watt. Without this connection, no data is exchanged with Strava.

Import. Once authorization has been granted, 4000Watt retrieves the activities of the last 30 days as well as all future activities of the connected account via the official Strava API. Data categories processed: activity name, sport type, date, duration, distance, heart rate, and power. GPS tracks, segments, and data of other athletes are not retrieved. The imported data serves exclusively to display the respective user's own training history and to calculate that user's training load, and is visible only to that user. The legal basis is consent pursuant to Art. 6(1)(a) GDPR and, with respect to heart rate data, explicit consent pursuant to Art. 9(2)(a) GDPR.

Export. At the user's instigation, completed 4000Watt workouts are automatically transferred to the user's Strava account. Strava, Inc. is the independent controller responsible for the subsequent processing of this data; Strava's privacy policy applies (https://www.strava.com/legal/privacy).

Deletion. If an activity is deleted on Strava, it is also removed from 4000Watt within 48 hours. If the connection is disconnected – in the application or on strava.com under Settings → My Apps – all imported Strava data is deleted immediately and permanently; the user receives a confirmation once the deletion is complete.

4000Watt and Strava act as separate, independent controllers; no joint controllership within the meaning of Art. 26 GDPR exists. Further information: https://4000watt.app/en/strava

6. Payment processing

Paid subscriptions are processed via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland; parent company: Stripe, Inc., USA – certified under the EU-U.S. Data Privacy Framework, supplemented by EU Standard Contractual Clauses). Payment data (in particular card details) is entered by the user directly with Stripe and is at no time transmitted to 4000Watt in full; 4000Watt receives only a payment confirmation and the details required for invoicing. The legal bases are Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (statutory retention obligations).

7. Waitlist, newsletter, and product information

Waitlist. Upon signing up for the waitlist, the email address is processed for the purpose of providing notification of the market launch of 4000Watt and sending product information at irregular intervals. Sign-up follows a double-opt-in procedure: it becomes effective only upon confirmation via the link sent by email; the time and IP address of the confirmation are logged for evidentiary purposes. The legal basis is consent pursuant to Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future via the unsubscribe link contained in every email; the email address is deleted in that case.

Newsletter at registration. During registration, separate and voluntary consent may be given to receiving the 4000Watt newsletter. It contains news, training content and product information relating to 4000Watt. The data processed for this purpose comprises the email address of the user account and the language selected during registration. The legal basis is consent pursuant to Art. 6(1)(a) GDPR.

Voluntary nature. This consent is neither a prerequisite for registration nor a condition of use. Without it, the same user account is created with the same range of functions (Art. 7(4) GDPR). If the checkbox is left unticked, the email address is not processed for information purposes and no record of consent is stored.

Taking effect and record of consent. Consent takes effect only upon confirmation of the email address, which is required in any event to activate the user account. Prior to that confirmation, the address is not used to send product information. For evidentiary purposes, the time consent was given, the language selected, and the version of the text consented to are stored, together with the time of confirmation and, in the event of a withdrawal, the time of that withdrawal. The legal basis for this is Art. 6(1)(c) GDPR in conjunction with the obligation to demonstrate consent under Art. 7(1) GDPR.

Withdrawal. Consent may be withdrawn at any time with effect for the future – via the unsubscribe link contained in every such email or informally by email to support@4000watt.com. Sending then ceases; the user account and its use remain unaffected. The record of the consent given up to that point is retained until deletion of the user account – it demonstrates the lawfulness of the processing carried out until then and would lose that purpose if withdrawal removed it.

8. Contact

When contact is made by email (in particular to support@4000watt.com), the information provided is processed for the purpose of handling the inquiry. The legal basis is Art. 6(1)(b) GDPR where the inquiry relates to a contractual relationship, and otherwise Art. 6(1)(f) GDPR. The correspondence is deleted once the inquiry has been conclusively handled and no statutory retention obligations apply.

9. Contact form

Data submitted through the contact form on 4000watt.app is used solely to process the request.

Data processed: name, email address, subject, message text, language of the request and time of submission.

The legal basis is Art. 6(1)(b) GDPR where the request serves the initiation or performance of a contract. In all other cases Art. 6(1)(f) GDPR applies – the legitimate interest in responding to requests.

Submission is delivered as an email to support@4000watt.com. The sender address is website@send.4000watt.com. Resend (Resend, Inc., San Francisco, USA) acts as processor for delivery. Transfers to the USA are based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The mailbox is operated by 1&1 IONOS SE, Montabaur, Germany.

To prevent automated submissions, the IP address is processed exclusively as a cryptographic hash and deleted after ten minutes. The legal basis is Art. 6(1)(f) GDPR – the legitimate interest in preventing abuse. The IP address is neither transmitted with the message nor stored.

The request is not stored in the 4000Watt database. The message remains in the mailbox and is deleted once the request has been fully processed and no statutory retention obligations apply, at the latest after 24 months.

Name and email address are required in order to answer the request. Without them no reply is possible. Requests can alternatively be sent directly to support@4000watt.com.

10. Support requests

The Support page of the desktop application, the web application, and the Android app allows problems to be reported and ideas to be submitted. Each report receives a ticket number and is stored, linked to the user account, in the database referred to in Section 2.

Data processed: category of the report, description, for connection problems the devices stated (make and model), application version, platform (desktop, web, or Android), for reports from the desktop application the operating system version, language, the email address of the user account as the reply address, time of the report, and the processing status and internal processing notes.

Health information is not required to handle a report. If a description nevertheless contains such information, it is used solely to handle the report and is deleted together with it.

Technical log. Reports from the desktop application – except ideas – automatically include a technical log. It covers the last 15 minutes before the report and the last 15 minutes of the previous use of the application, so that a crash after which the application was restarted can also be traced. It contains connection and application events with their time, such as device searches, device names, dropped connections, control commands sent to the Smart Trainer, page changes within the application, and error messages together with the point in the program code at which they occurred, as well as whether the previous use ended normally. It does not contain power, heart rate, cadence, or weight values, email addresses, credentials, device identifiers, or the computer’s user name; such details are removed before transmission. So that the log survives a crash, the application also stores these already cleaned details on the device while in use; the file is replaced each time the application starts and leaves the device only with a support report. If the application crashes, it also saves a crash report on the device. This report is not transmitted; the log states only its time, file name, and size. The log is stored in a non-public file store of the same processor, likewise in Frankfurt am Main. No log is transmitted from the web application or the Android app.

The report is processed to handle the request and to fix reported faults. The legal basis is Art. 6(1)(b) GDPR where the report concerns the use of 4000Watt under the user agreement, and otherwise Art. 6(1)(f) GDPR; the legitimate interest lies in answering requests and improving the application. The legal basis for the technical log is Art. 6(1)(f) GDPR; the legitimate interest lies in diagnosing and fixing technical faults. Processing of the log may be objected to at any time under Art. 21 GDPR; a message to support@4000watt.com is sufficient. The log of the report concerned is then deleted.

Receipt is confirmed by email to the address of the user account; the confirmation contains the ticket number, category, time, and description. Resend (Resend, Inc., San Francisco, USA) acts as processor for delivery; transfers to the USA are based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Replies to the confirmation go to support@4000watt.com and thus to the mailbox referred to in Section 2.

To prevent abuse, the time of each report is stored per user account for 24 hours; more than five reports per hour are rejected. The legal basis is Art. 6(1)(f) GDPR – the legitimate interest in preventing abuse.

Support requests are stored until the user account is deleted and are deleted with it. Technical logs are deleted automatically 90 days after the report is received, or earlier together with the user account.

11. Storage periods and deletion

Personal data is stored only for as long as necessary for the stated purposes or as required by statutory retention obligations. In detail:

• Account, training, and health data: until deletion of the user account. Account deletion may be initiated at any time in the Account section of the application or by email to support@4000watt.com; details at https://4000watt.app/en/account-deletion. All data is completely deleted within 30 days, except for the invoicing-related data, the trial marker and the email dispatch log listed below.
• Support requests: until deletion of the user account (Section 10).
• Technical logs of support requests: 90 days after the report is received, at the latest upon deletion of the user account (Section 10).
• Strava data: as set out in Section 5 (48 hours or immediately, respectively).
• Invoicing-related data: 10 years pursuant to Section 147 of the German Fiscal Code (AO).
• Trial marker: 24 months from the start of the trial, regardless of whether the user account still exists (Section 4).
• Email dispatch log: until the end of the third calendar year following dispatch, regardless of whether the user account still exists (Section 4).
• Waitlist addresses: until consent is withdrawn.
• Newsletter consent: until withdrawal; the record of the consent given until deletion of the user account.

12. Rights of data subjects

Data subjects have the rights of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR). Processing based on Art. 6(1)(f) GDPR is subject to the right to object under Art. 21 GDPR. Consent given may be withdrawn at any time with effect for the future pursuant to Art. 7(3) GDPR; the lawfulness of processing carried out prior to withdrawal remains unaffected. An email to support@4000watt.com is sufficient to exercise these rights.

Furthermore, pursuant to Art. 77 GDPR, there is a right to lodge a complaint with a data protection supervisory authority. The supervisory authority competent for the controller is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, https://www.ldi.nrw.de.

13. Changes to this privacy policy

This privacy policy will be amended whenever the data processing or the legal situation changes. The version published at https://4000watt.app/datenschutz (German) is authoritative; the current English translation is available at https://4000watt.app/en/privacy.