Privacy notice

Last updated 6 November 2026.

1. Controller

See the imprint. Contact for privacy questions: privacy@wattout.app.

2. Using the app without an account

The app works fully without an account. Trainer control, recording and FIT export run on your device. No data is sent to wattout. Recordings live in the app's storage on the device and can be deleted there one by one.

3. wattout account

An account is optional. It is created with an e-mail address and a one-time sign-in code, without a password. Its purpose is to make your own sessions available on several devices.

With your explicit consent (purpose "cloud storage") we store on the wattout server:

e-mail address, nickname, time of sign-up, signed-in devices (device model and operating system version, so you can tell your devices apart)
profile: FTP and optionally maximum heart rate, both entered by you; a ride can also raise the maximum heart rate (see below)
training sessions: workout, times, power, cadence, heart rate, derived metrics, subjective rating (RPE, feel), FIT file
FIT files from other devices that you upload (the original, kept until you delete the activity or your account)
consents with date and version

Automatic raise of the maximum heart rate: if an uploaded ride has enough heart rate data and the maximum heart rate measured in it is higher than the value in your profile, the server automatically takes the higher value into your profile. Every change of FTP and maximum heart rate (old and new value, source, time and, where applicable, the ride) is recorded in a change history that is kept until your account is deleted.

Heart rate and training data are health data under Art. 9 GDPR. The legal basis is your consent under Art. 9 (2) (a) GDPR. You can withdraw it at any time by deleting your account: in the app under Settings → Privacy and account, or on the web under wattout.app/app → Settings → Delete account.

Feedback from the app

Signed-in users can send feedback from the app. What is sent: the text and up to three images (re-encoded by the server, which removes location and other metadata). Device and app info (operating system and version, device model, app version and build, language, platform) is included by default; you can switch it off in the feedback screen before sending. Your account ID, nickname and plan are always included, so that we can assign the feedback to you and reply. The e-mail address of your account is set as the reply address; our reply goes to this address. The purpose is to answer your questions and fix bugs. The legal basis is Art. 6 (1) (b) GDPR (contract) or (f) GDPR (legitimate interest in a working app). The server forwards the feedback (text, images, the info above and your account e-mail address as the reply address) by e-mail to the developer mailbox developer@wattout.app and deletes the text, device info and images on the server as soon as the mail is sent; if the mail cannot be sent, or only later (for example when a lot of feedback arrives on one day), the period in section 8 applies. In the developer mailbox the feedback mail is kept as long as needed to handle your feedback and deleted at the latest 12 months after receipt. If you delete your account, we delete your feedback mails earlier on request to privacy@wattout.app.

Diagnostics from the apps

While you are signed in, the wattout apps send a diagnostics report to the wattout server from time to time: when the app starts, when an upload is held back or fails or a ride can no longer be uploaded, periodically, and when you send one yourself. It describes the state of the app's local upload queue, so that we can find and fix upload problems, including rides that never reached the server. What is sent: platform, app version and build, device model, operating system version and language; the reason for the report and when it was created; the number of rides, of rides not yet uploaded and of pending, failed and held-back uploads; for each ride on the device the short ride identifier, the session ID, its state, whether it was finished or aborted, whether it was a simulated ride and its start time, and for each of its upload steps the kind, the state, the number of attempts, the next attempt and the error code of the last error; optionally recent app errors as type, place, error code, time and whether the app had to stop. A report contains no training or health values, no sign-in codes or tokens, no device identifiers or device names and no error texts, and it only lists rides of the signed-in account. Your data export contains your reports.

In addition, for diagnosis, the server notes for each sign-in session and each uploaded ride the platform, app version and build, device model and operating system version of the device that sent it, and its server logs name the account ID of each request and the error code of the answer.

The purpose is to keep the service working and to help you when an upload or a sign-in fails. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a working service). You can object at any time under Art. 21 GDPR by writing to privacy@wattout.app. For how long we keep the reports, see section 8.

Push notifications

If you are signed in and allow notifications in the app, the app registers its push token (a Firebase Cloud Messaging device token) with the wattout server. We store the token, the platform (iOS or Android), a coarse device label ("iPhone/iPad" or "Android"), a random installation ID of the app, and the times of registration, last use and, where applicable, deactivation. The purpose is to send you reminders for planned workouts and notices from the Coach (for example a finished plan proposal). Notifications are delivered through Google's Firebase Cloud Messaging and, on iPhone and iPad, additionally through Apple's push service; these providers receive the token and the content of the notification (title, text and, for a workout reminder, the time and structure of the workout). The legal basis is Art. 6 (1) (b) GDPR (the reminders you switch on in the app). You can switch the reminders off in the app and forbid notifications in your device settings; we then send nothing.

When you sign out in the app, the token is deactivated and no longer used; the same happens if Google or Apple reject it as invalid (for example after an uninstall) or the app reports a new token. A deactivated token stays on the server, unused, until you delete your account; it is deleted for good with the account (see section 8).

Cost of AI calls

For every call to the language model that the Coach makes for your account (a new plan, an adjustment, the feedback after a ride), the server stores one record: the time, the purpose (plan, adjustment or ride feedback), the outcome of the call, the model used, the number of tokens processed and the cost charged by the provider. The record contains no training or health values and no text, only these operating figures. The purpose is cost control: each account has a budget for AI calls; once it is used up, the Coach plans with fixed rules instead of the model, and nothing fails. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in limiting the cost of the service); you can object under Art. 21 GDPR by e-mail to privacy@wattout.app. The records are deleted with your account and are part of your data export.

4. Further purposes, only with separate consent

Recovery data: import of sleep, resting heart rate, HRV and body weight from Apple Health or Google Health Connect (see section 5), for the last 30 days and going forward. Body weight is not a recovery or readiness signal here, only extra context for the Coach.
Completed workouts: import of workouts you recorded elsewhere, for the last 30 days and going forward (date, sport, duration, heart rate, power, load), from Apple Health or Google Health Connect, so the Coach knows your training history. A consent of its own, separate from recovery data.
Coach with an external language model: a pseudonymised extract is sent to a language model provider so the Coach can plan: your training figures (FTP, maximum heart rate, goal, availability, experience and, if you entered it, the age band), your recent rides (duration, intensity, RPE, feel, Pain, completion of the ride) and your plan adherence (how many planned sessions you recently rode or skipped) and, if you connected them, your recovery data (sleep duration, resting heart rate and HRV including the deviation from your normal value, and, if available, your body weight purely for context) plus the date, sport, duration and load of your completed workouts from other sources. This includes health data under Art. 9 GDPR; it goes to the provider only with this consent. No raw recordings, no name, no e-mail address, no IP address, no free text. We use Anthropic (Claude) for this and, if Anthropic is unavailable, OpenRouter; both are based in the USA; the transfer there relies on your explicit consent (Art. 49 (1) (a) GDPR) and the providers' data processing terms. The providers are contractually barred from training their models on the data and keep it for at most 30 days to detect abuse; after that it is deleted. Without this consent the Coach cannot be set up. After every ride from your Coach plan the Coach also writes you a short feedback: for this, that ride's key figures (target accuracy, power, blocks completed, RPE, feel), your last four weeks (number and duration of rides, plan adherence) and your next planned sessions (date, type, duration, without their names) go pseudonymised to the same provider, without heart rate values. The feedback is stored with the ride, deleted with the ride or your account, and is part of your data export.
Sharing with others: in wattout Connected, the live values you choose per session (progress, relative power, Pain, cadence, heart rate, absolute power) are shown to the other riders of that session while it runs, and the ride summary afterwards. Heart rate and absolute power are off unless you switch them on.

The app reads recovery data and completed workouts only after the respective consent and your permission in Apple Health or Google Health Connect. You can withdraw either consent at any time in the app under Settings → Privacy and account.

5. Health platforms: Apple Health and Google Health Connect

The app reads from Apple Health (HealthKit) on iPhone and iPad and from Google Health Connect on Android, only after your consent (section 4) and with your explicit permission for each data type, for the last 30 days and then going forward. The app works without these permissions.

Recovery: sleep duration, resting heart rate and heart rate variability, as daily values, to judge how ready you are for a hard session.
Completed workouts recorded by your watch or bike computer: duration, heart rate and power, so they count in your training history. wattout never assembles workouts from loose samples.
Body weight: as a daily value, purely as context for the Coach, never as a recovery or readiness signal.
Body data: otherwise none. wattout does not read height, date of birth or any other body measurement.

What leaves your device: only daily aggregates (for example hours of sleep, resting heart rate, HRV of the day, body weight) and per-ride summaries (duration, average and maximum power and heart rate, load), stored under the respective purpose ("recovery data" or "completed workouts") on the wattout server. Raw samples stay on the device. Health data is only used for the training features described here, never for advertising, never sold, never shared with third parties except as described under purpose 4 (Coach, pseudonymised, only with your consent). You can revoke the permissions at any time in the Health app or in Google Health Connect; wattout then stops reading and deletes the imported values on request or with the account.

Optionally, wattout can write your indoor rides to Apple Health or Google Health Connect, so that they appear in your activity overview. This is a separate permission that you grant or refuse independently.

Once you have switched writing on on a device, that device also catches up rides you rode afterwards on another device (for example on the Apple TV, which cannot write to Apple Health itself); you write older rides yourself from the ride if you want them there. So that no ride appears twice and a ride can show where it is already stored, the wattout server keeps: which of your signed-in devices have writing switched on (Apple Health or Google Health Connect, the kind of device iPhone, iPad or Android, and since when), and per ride and platform whether and when it was written, is being taken over by a device right now or was turned off for that ride, with the kind of device. No health values are part of this. It belongs to the training cloud and is part of your data export. A ride's status is deleted with the ride; a device's entry when it switches writing off, after a sign-out it no longer counts and is deleted with the device's sign-in; all of it at the latest with your account.

Apple Health data is never used for advertising or marketing and is not disclosed to third parties, in line with Apple's HealthKit requirements. Google Health Connect data is used in line with Google's Health Connect permissions policy; wattout does not use it to determine or infer sensitive information beyond the training purpose.

6. Premium subscription via the App Store and Google Play

Currently there are no purchases: in the introductory phase all Premium features are free for everyone until 28 February 2027, and nothing is billed. This section describes how we would process data if we offer subscriptions in the future; we will tell you in good time beforehand.

If Premium (the Coach) becomes paid in the future, it will not be sold by wattout but through Apple's App Store or Google Play. Apple (Apple Distribution International) or Google would sell it, bill it and process your payment data as an independent controller under its own privacy notices. wattout never sees your payment method or billing details.

What the wattout server would then store per subscription: the platform (Apple or Google), the product and, for Google, the plan (base plan), the status of the subscription and its state in the store, whether it is a test purchase, whether it is a trial, whether it renews automatically, the times of purchase, expiry and, where applicable, revocation or refund, the last event for it, and Apple's transaction ID or, for Google, the order number and the purchase token. The purchase token is a proof of entitlement from Google; it is only on the server and is not part of your data export.

Google: the server queries the purchase status through the Google Play Developer API. Google reports changes (renewal, cancellation, payment problem, refund) through Google Cloud Pub/Sub as a push message to api.wattout.app. The purchase is linked to your wattout account through a pseudonymous account reference (no e-mail address).
Apple: the server verifies the transactions signed by Apple and receives the App Store Server Notifications from Apple.

The legal basis is Art. 6 (1) (b) GDPR (contract): without this data wattout cannot tell whether your Premium subscription applies.

Retention: the subscription rows stay as long as your account exists. The Google purchase token is removed 30 days after the subscription has ended for good (period in section 8). Coach data is kept for 3 days after Premium ends; during a payment problem (grace period, account hold, pause) it is kept as long as the problem lasts, but at most until about 79 days after the last paid day.

Deletion: when you delete your account, we also remove the subscription data. On deletion the server cancels a running Google Play subscription at Google so that it does not renew. wattout cannot cancel an Apple subscription: cancel it yourself beforehand in your Apple subscriptions ("Manage subscription"), otherwise it keeps running. The app and the web app point this out before you delete.

Test purchases: purchases in Apple's and Google's test or sandbox environments are recorded as well. They unlock Premium only for allow-listed test accounts.

7. Hosting and recipients

The wattout server runs at Hetzner Online GmbH in a data centre in the EU. Sign-in codes are sent by e-mail through the controller's mail provider. On your request the server sends the FIT file of a ride as an attachment through the same mail provider to your account's e-mail address, never to any other address. Nothing is stored for this beyond the ride's stored recording, only the sending order as a background task (see retention). Feedback from the app also goes by e-mail through this mail provider to the developer mailbox developer@wattout.app. Push notifications are delivered through Firebase Cloud Messaging (Google) and, on iPhone and iPad, Apple's push service (see section 3). There is no tracking, no advertising and no transfer to third parties for advertising.

8. Retention

Account data and sessions stay stored until you delete your account. We delete everything else after these periods, automatically unless stated otherwise:

Sign-in code requests: 24 hours after the request (the code itself is valid for 10 minutes).
Protection against duplicate requests: 7 days after receipt.
Completed background tasks (for example sending mail, uploads): 30 days after completion.
Failed background tasks, without personal content: 90 days after completion.
Sign-in sessions of your devices: 7 days after they expire.
Sign-in requests from a TV (device name, the TV's IP address for the rate limit, the codes only as irreversible hashes): 1 hour after the request (the code itself is valid for 10 minutes).
Data exports for download: 24 hours after creation.
Feedback from the app on the server: text, device info and images are deleted immediately after the mail has been sent. If the mail cannot be sent, or only later, they stay on the server for at most 7 days after receipt; the same period applies to the receipt data without content (for the rate limit).
Feedback mails in the developer mailbox developer@wattout.app: as long as needed to handle your feedback, at the latest 12 months after receipt (deleted by hand).
Push token: until you delete your account (deactivated and no longer used after a sign-out).
Records of AI calls (time, purpose, model, tokens, cost): until you delete your account.
Diagnostics reports from the apps: 30 days after receipt.
Server logs (no training or health data, only technical events with a short ride identifier and the account ID for support): 14 days.
Encrypted backups: 14 days on the server, 30 days at most overall.
If subscriptions are offered: Google purchase token of an ended subscription: 30 days after the subscription has ended for good (the other subscription details stay as long as your account exists).
If subscriptions are offered: Coach data after Premium ends: 3 days; during a payment problem (grace period, account hold, pause) at most until about 79 days after the last paid day.
Proof of your consents after an account deletion (purpose, version and time only, no email address): 3 years after the end of the year of deletion.

When you delete your account, we remove the account, profile, sessions, recordings, plans, devices, diagnostics reports, push tokens, the records of AI calls and your profile picture. On the server, only the account ID with the time of deletion and the proof of consent above remain, plus server logs that name your account ID until they are deleted after the period above. Feedback mails you sent earlier are not deleted automatically with the account: they stay in the developer mailbox for the period above; write to privacy@wattout.app if you want them deleted sooner. The account ID is kept in a deletion register so that deleted accounts are deleted again after a restore from a backup. In wattout Connected, other participants keep their own rides; you appear there as "deleted account".

9. Your rights

Access, rectification, erasure, restriction, data portability and objection under Art. 15 to 21 GDPR, and the right to lodge a complaint with a supervisory authority. You export and delete your data in the app under Settings → Privacy and account. You can also delete your account on the web under wattout.app/app → Settings; the steps are on the page Delete your account. For everything else: privacy@wattout.app.