Legal & Compliance
Privacy Policy
Last Updated: October 31, 2026 · Version 3.1
At ErgVerse (accessible at ergverse.com), your athletic privacy, telemetry integrity, and data ownership are core to our mission. This Privacy Policy details how we handle information when you connect Concept2 ergs, participate in virtual racing worlds, and sync workouts with third-party fitness platforms.
1. Data Controller
The data controller responsible for the processing of personal data under this Privacy Policy is the ErgVerse operational team. For any questions, data subject access requests, or deletion inquiries, contact us directly at [email protected].
2. The Information We Collect
ErgVerse collects and processes only the minimal data necessary to deliver real-time virtual racing, training physics, and performance analysis:
- Concept2 PM5 Telemetry: When connecting via Web Bluetooth (BLE), we read real-time metrics including elapsed time, distance, pace (/500m), stroke rate (SPM), watts, drive length, and heart rate (if an HR monitor is paired to your PM5).
- Athlete Profile: Chosen display name, 3-letter country/nationality code for race standings, and racing division.
- Biometric Data (Optional): Height and weight settings used exclusively to calculate realistic avatar visual scaling and physiological drag physics. Under GDPR Article 9, biometric data is processed only with your explicit consent and is restricted to your private profile.
- Workout Records: Summary statistics (total time, distance, average pace, average watts, split breakdown) saved locally to browser IndexedDB and optionally synchronized to your Supabase athlete cloud account.
3. Real-Time Multiplayer Telemetry Broadcast
When you enter an open multiplayer session (such as "Just Ski" or "Just Row") or participate in scheduled heats and private challenge duels:
- Broadcasted Data: Your chosen display name, 3-letter country code, current track/lane, visual course distance, speed (m/s), wattage, and stroke rate (SPM) are transmitted live over encrypted WebSockets to other active racers currently connected to that room.
- No Sensitive Personal Info: Your email address, exact location/IP, and private biometric parameters (height and weight) are never broadcast to multiplayer peers.
- Private Sessions: If you wish to train without broadcasting telemetry to others, you can select Single Player mode or disconnect from multiplayer at any time in the settings menu.
4. Legal Bases for Processing (GDPR Article 6 & 9)
We process your personal and athletic data under the following lawful bases:
- Performance of a Contract (Art. 6(1)(b) GDPR): Providing virtual courses, synchronizing race timing, calculating drafting slipstream physics, and logging workouts.
- Explicit Consent (Art. 6(1)(a) & Art. 9(2)(a) GDPR): For processing optional biometric metrics (height and weight) and voluntary workout synchronization to third-party fitness platforms (Concept2 Logbook, Strava).
- Legitimate Interests (Art. 6(1)(f) GDPR): Protecting leaderboard integrity against automated spam, anti-cheat enforcement, and defending edge infrastructure against DDoS attacks.
5. Sub-processors & External Service Providers
To operate our zero-install web application and secure cloud infrastructure, we partner with the following vetted service providers:
| Provider |
Purpose |
Location |
| Cloudflare, Inc. |
Hosting, Global CDN, Edge Functions (/api/*), DDoS protection, and SSL termination |
Global / USA (EU Standard Contractual Clauses) |
| Supabase, Inc. |
User Authentication, PostgreSQL database, and Realtime WebSocket telemetry |
Frankfurt, Germany (AWS EU Region) |
| Concept2, Inc. |
Voluntary workout sync via official Concept2 Online Logbook API |
Morrisville, Vermont, USA |
| Strava, Inc. |
Voluntary activity export (.FIT binary upload via Strava API v3) |
San Francisco, California, USA |
| jsDelivr (ProspectOne) |
Delivery of pinned open-source browser libraries (Three.js rendering engine, Supabase JS) with Subresource Integrity |
Global CDN / Poland (EU) |
| Google LLC (Google Fonts) |
Web typography stylesheets (Space Grotesk, Inter). Visitor IP addresses are processed in transit by Google CDN to deliver font assets |
Global / USA |
6. Concept2 Online Logbook & Strava Integrations
- Concept2 Logbook: Linking requires a signed-in ErgVerse account and uses OAuth2 authorization codes or a personal access token you provide. Authorization credentials are encrypted on our backend and restricted to server-side sync requests, while this browser keeps only connection status metadata. When a workout is synced manually or automatically while connected, ErgVerse sends only the workout summary and split data required by Concept2 (date, erg type, distance, elapsed time, weight class, average watts, stroke rate, heart rate, and splits). Disconnect in ErgVerse to remove your stored Concept2 credentials and clear this browser's connection state. ErgVerse never sees or stores your Concept2 password.
- Strava: Linking requires a signed-in ErgVerse account and OAuth authorization (
read,activity:write). Authorization and refresh tokens are encrypted on our backend and used server-side to upload workouts, while this browser stores only connection status metadata. When a workout is uploaded manually or automatically while connected, ErgVerse sends only a .FIT activity file containing your workout telemetry and summary title. Upload status and activity identifiers are held in memory during your session, while the browser workout queue stores only a completion marker, credential fingerprint, and retry status. Disconnect in ErgVerse to revoke access with Strava, delete your stored Strava server credentials, and clear this browser's Strava sync metadata (without deleting your ErgVerse or Concept2 workout logs). If you remove ErgVerse in your Strava account settings, Strava notifies our webhook endpoint to delete your stored Strava server credentials automatically. Disconnecting on one device does not clear offline browser data on other devices. To request access to or deletion of Strava-derived data, contact [email protected]. We will explain any steps needed on your devices and confirm completed deletion in writing.
- Strava may monitor, collect and use data about ErgVerse's use of its API for purposes including operating and improving its services, support and compliance.
7. Data Retention & In-App Deletion
ErgVerse operates on a local-first architecture. Your workout logs are stored in your device's browser database (IndexedDB).
- Local Data: You can clear your local workout history, integration status, and profile at any time by clearing your browser data or using the in-app Reset tool in the settings dialog.
- Cloud Account Data: If you created an account, your cloud profile and synchronized workouts are retained as long as your account is active.
- Data Erasure Requests: To request deletion of your account, cloud workout history, or integration data, email [email protected] with the subject "Data Erasure Request". We will respond to your request and explain any steps needed to remove data stored on your devices.
8. Contact & Inquiries
For privacy questions, data subject requests, or technical inquiries regarding telemetry security, contact us at [email protected].