←WWATTS LAB

Effective October 25, 2026

Privacy Policy

01

Scope and principles

This policy explains what personal information Watts Lab collects when providing its services, how it is used, and when it is deleted. It applies to the Watts Lab web service, member accounts, customer support, and the Strava and Intervals.icu connections selected by users.

Watts Lab processes personal information only to the extent necessary to provide its services. We do not sell personal information or use it for personalized advertising. Information independently processed by external services is also subject to those providers' privacy policies.

02

Personal information we process and why

The information below is collected when you enter it or connect an external service, and may also be generated as you use the service.

CategoryInformation processedPurpose
Account and authenticationEmail, display name, Strava profile picture URL, password hash, email verification result, confirmation of minimum age 14 years, records of acknowledging terms and policies, session information, IP address, and browser informationRegistration, login, account identification and account menu display, policy acknowledgment, security, and abuse prevention
Training profileFTP (entered by the user during onboarding or in settings), maximum heart rate, weight, fitness level, goals, and training availabilityPersonalized analysis, workout intensity settings, and training plan generation
Event courseEvent course analysis (distance, elevation gain, gradients, elevation changes, and major climbs), uploaded GPX filename and course map coordinates, and selected Strava route IDCreating training plans tailored to the event course and displaying the course
Raw Strava activitiesActivity ID, name, type, date and time; distance, elevation gain, moving and elapsed time, speed, power and heart rate summaries, cadence, energy, device and equipment information; second-by-second power, heart rate, cadence, speed and elevation; route maps and start/end coordinatesSynchronizing rides, displaying activities and maps, and calculating training records
Intervals.icu completed activitiesActivity ID, Intervals.icu athlete ID, activity title and type, start time (UTC and local), distance, moving and elapsed time, average and maximum power, indoor flag, second-by-second power records, original source, app or device name and file format information, and the activity link; power curves and training metrics calculated from them, and matching with prescribed workoutsRide synchronization, activity display, and calculating training records
Training records and analysisStrava or Intervals.icu activity ID, date, moving time and type; ride-level training metrics (Load, Intensity, and weighted power) and power/heart rate summaries; best power by duration; fitness metrics (CTL, ATL, TSB); training levels by zone; prescribed workout matches and results; RPE, workout difficulty, completion and reasons for stopping; estimated maximum heart rate and VO₂max; recommendations and training plansAssessment of workout performance, fitness and fatigue estimates, adjustment of recommendations, and service improvement
Optional Strava featuresThe training log written to Strava activity descriptions (plan name, week, training phase, workout name and completion, this week's and cumulative completed counts, progress, days until the goal, and the next workout's schedule); saved Strava route lists and selected route files (not stored)Writing training results to Strava activities and choosing saved Strava routes for events when selected by the user
Support and operational recordsSupport email address, subject, and message; access, sync, error, security, and administrator activity logsHandling support requests, maintaining service stability, responding to outages and security incidents, and resolving disputes
Service usage statisticsWhen optional GA4 analytics consent is given: normalized page paths, visit times, external referral sources, device and browser information, and cookie-based visitor and session identifiersGoogle Analytics 4 statistics on page usage, visitors, and referral sources, and service improvement
Browser notificationsPush subscription endpoint and encryption public keys, device and browser information, notification preferences, and delivery and failure logsSending today's workout, effort rating reminders, and all-time power PR notifications to devices you authorize
03

Strava and Intervals.icu connection data

While you keep Strava connected, Watts Lab retrieves the following information through the Strava API within the permissions you grant.

  • Strava athlete ID and profile picture URL
  • Activity summaries including ID, name, type, date and time, distance, elevation gain, moving and elapsed time, speed, power and heart rate summaries, cadence, energy, and device/equipment information
  • Second-by-second power, heart rate, cadence, speed, and elevation
  • Route maps and start/end location coordinates

We do not retrieve information Strava does not provide or you have not authorized, and do not request segment records or second-by-second location coordinates. Strava profile picture URLs are used only to display your picture in the account menu and are deleted within 7 days of collection and periodically retrieved again while connected. We do not store FTP from your Strava profile. Your chosen display name is retained and is not replaced with your Strava name when connecting or reconnecting. Your Strava athlete ID is kept while connected.

Activity summaries, second-by-second records, route maps and coordinates, and exact start times received from Strava are deleted from our database and storage within 7 days of collection. Afterwards, only the activity's Strava ID, date, moving time and type (indoor/outdoor) remain, together with the following training records calculated by Watts Lab, until you disconnect Strava or delete your account.

  • Training load and power/heart rate summaries for each ride
  • Best power by duration
  • Fitness metrics
  • Training levels by zone
  • Prescribed workout matches and performance results

Connected data is used for ride analysis, map display, and training recommendations. Disconnecting Strava in settings stops new collection and deletes imported Strava activities, derived analysis, and generated training plans.

The following features operate only when you choose them. Other features remain available if you do not use them.

  • Write training results to Strava activities: when enabled in settings, we append a training log to your own matched activity descriptions. It contains the plan name, current/total weeks and training phase, workout name and completion indicator, this week's and cumulative completed/planned counts with progress, days until the goal, and the next workout's date, name and duration, written in Korean or English according to your language setting. Power, FTP and training-load values and links are never written. This requires additional Strava write permission (activity:write). The existing activity description is read when writing but is not stored. Written content may be visible to other Strava users according to that activity's visibility settings. Disabling the feature stops future updates; existing content can be edited or removed directly in Strava.
  • Select an event course from Strava routes: when you select a saved route for an event plan, Watts Lab retrieves your route list and the selected GPX file through the Strava API and sends them to your browser, where course analysis runs. The list and route file are not stored. Only analysis results (distance, elevation gain, gradients, elevation changes, and major climbs) and the Strava route ID are saved with the event goal. Private routes require additional Strava permission (read_all).

Routes and location information are handled as follows.

  • Strava activity route maps and start/end coordinates: deleted with other raw data within 7 days of collection
  • Saved Strava route lists and files: not stored
  • GPX files uploaded as event courses: analyzed in your browser; the original file is not sent to the server. The filename, simplified course coordinates, and analysis results are saved with the event goal to display the course again

If you authorize activity read (ACTIVITY:READ) access when connecting Intervals.icu, or connect with an API key, Watts Lab imports completed cycling activities with measured power (raw_watts) from the Intervals.icu API while the connection remains active. The first import covers the last 90 days; later imports pick up newly uploaded activities. OAuth connections require calendar write (CALENDAR:WRITE) access. Existing connections without activity read access continue to send calendar events only until you reauthorize.

Eligible activities are Ride, VirtualRide, MountainBikeRide or GravelRide records whose source is ZWIFT, or OAUTH_CLIENT with an app or device name. Activities that reached Intervals.icu through Strava, and activities whose source cannot be confirmed, are not imported. Only time (time) and power (raw_watts) are requested and stored as second-by-second records; heart rate, cadence, location records and original files are not stored. File format is kept as metadata only. Intervals.icu activities do not change the FTP you set or your FTP mode (auto or manual).

Disconnecting Intervals.icu in Settings stops activity imports and calendar transfers and deletes the stored connection details, imported Intervals.icu activities and second-by-second records, and the power curves, training metrics and workout matches calculated from those activities. Training plans are not deleted; only matches with those activities and their evidence stored in plans are removed. Activities imported from Strava and your Strava connection are kept, but training metrics that combine multiple activities are recalculated from the remaining records and may change.

If you connected with OAuth, disconnecting asks Intervals.icu to revoke the app's access; if that request fails, the disconnection is not completed and you need to try again. If you connected with an API key, Watts Lab only deletes the stored key, so revoke the key in your Intervals.icu settings if you no longer want it to be usable.

04

Retention and deletion

Personal information is retained for as long as necessary to fulfill its purpose and then deleted without delay.

The rule of deleting raw Strava records within 7 days applies only to Strava records, not to raw Intervals.icu records.

InformationRetention period
Account and profileUntil you delete your account or request deletion of the information
Raw Strava activities (summaries, second-by-second records, route maps and coordinates, and exact start times)Deleted within 7 days of collection
Training records, analysis, and training plansUntil Strava disconnection, account deletion, or a request to delete the information. After raw Strava data is deleted, only the Strava ID, date, moving time, activity type, and values calculated from them remain
Strava athlete ID and connection permissionsUntil Strava disconnection or account deletion
Raw Intervals.icu activities (activity summaries, second-by-second power records)Until Intervals.icu is disconnected, the account is deleted, or deletion is requested
Intervals.icu athlete ID and authorization detailsUntil Intervals.icu is disconnected or the account is deleted
Training records and analysis results calculated from Intervals.icu activitiesUntil Intervals.icu is disconnected, the account is deleted, or deletion is requested. Disconnecting does not delete training plans; only matches with those activities and the evidence from them stored in plans are removed, and metrics that combine multiple activities are recalculated from the remaining records
Saved Strava route lists and filesNot stored
GA4 user and event dataAs set in the connected GA4 property's data retention settings. Aggregate reports may be retained separately from these settings.
Raw first-party visit analytics collected before the transition90 days from collection
Daily first-party visit aggregates created before the transition13 months
Cookie preference record180 days from your selection, or until deleted in your browser
Browser push subscriptionsUntil you disable notifications on the device or delete your account
Browser push delivery and failure logs30 days after delivery or final failure
Customer support messages1 year after the request is closed
Access and security logsUp to 2 years
Records of acknowledgment of terms and policies and the granting or revocation of external accessUp to 3 years
BackupsDeleted through backup rotation within 30 days after deletion

Where retention is required by law or necessary to respond to disputes or security incidents, only the relevant information is stored separately with restricted access. Electronic files are deleted using methods that make recovery difficult.

05

Disclosure to third parties and external connections

Watts Lab does not provide personal information to third parties without your consent or a legal basis. When you select an external integration, the following information is transmitted at your request to provide the feature.

ServiceInformation transmitted and purposeTiming and retention
Strava, Inc.Identifiers for account connection, permission renewal/revocation, and activity/saved-route retrievalEncrypted communication during connection, synchronization, or route selection; subject to Strava policies
Strava, Inc. (training result updates)When enabled, writes the plan name, current/total weeks and training phase, workout name and completion indicator, this week's and cumulative completed/planned counts with progress, days until the goal, and the next workout's date, name and duration to your matched activity descriptionsSent over encrypted communication for each matched activity. Remains on Strava until you edit or delete it there; subject to Strava policies and the activity's visibility settings
Intervals.icuCalendar write: athlete ID, workout dates, titles, descriptions and ZWO files sent to the calendar. Activity read: athlete ID and activity IDs used to look up completed activities and second-by-second power records. A request to revoke the app's access when an OAuth connection is disconnected.Encrypted communication during schedule sync, activity lookups and disconnection; until disconnection or as specified by the provider's policies.
OpenStreetMapIP address, browser information, and displayed map area included in map tile requestsRequested directly by your browser when you view a map; subject to the provider's policies
Browser push provider for your deviceDelivery using encrypted notification titles and content and the subscription endpointSent when you allow notifications; subject to the policies of the relevant provider, such as Google, Apple, Mozilla, or Microsoft
06

Service providers and international transfers

Watts Lab entrusts the providers below with tasks needed to operate the service. We manage contracts and operations so that these providers process personal information securely.

TaskProviderProcessing locationInformation and retention
Web application and Redis operationsAmazon Web Services (AWS Lightsail)Seoul, Republic of Korea (ap-northeast-2)Account, activity, analysis, and operational information; retention periods in Section 4
Managed PostgreSQL storage, queries, and backupsNeon, LLC (Neon PostgreSQL)Singapore (ap-southeast-1)Account, activity, training, analysis, policy, and operational information; retention periods in Section 4 and up to 30 days for backups
Storage of activity time-series objects and database backupsCloudflare R2Countries determined by operational contracts and settingsEncrypted second-by-second Strava activity records are deleted within 7 days of collection, second-by-second Intervals.icu activity records are kept for the period in Article 4 (until disconnection, account deletion, or a deletion request), and encrypted database backups are kept for up to 30 days
Running training plan generation jobsGoogle (Google Cloud Run)Seoul, South Korea (asia-northeast3)Training profiles, goals, and records required for plan generation; processed during the job, with generated results stored in the service database
Authentication and support email deliveryThe email delivery service used by the operatorCountries determined by operational contracts and settingsRecipient email address, display name, and email content; retention periods in Section 4
Browser push deliveryThe push provider designated by the device's browserCountries determined by the provider and device settingsEncrypted notification content and subscription endpoint; until delivery is complete or for the period specified by the provider's policies
Optional visit analyticsGoogle (Google Analytics 4)International processing under Google's data processing termsVisit information such as page paths, referral sources, device information, and cookie identifiers; subject to the GA4 property's retention settings and Google's processing terms

International transfers to Neon take place over TLS-encrypted connections during service use, activity synchronization, analysis, and account management to provide the database functionality needed to fulfill the service agreement. You can stop future transfers by deleting your account, but account-based services cannot be provided if you refuse international transfers. Backup copies of deleted information are removed through rotation within 30 days.

If GA4 is connected and you consent to visit analytics, visit information is sent from your browser to Google. Communication information, including your IP address, is also sent to Google during Google tag requests. Rejecting or withdrawing analytics consent in Cookie Settings stops future analytics transmissions without affecting the core service. For information on Google's processing, see Google's partner-site data information.

If a service provider or processing country changes, we will notify you through this policy. Where separate consent is required, we will obtain it before the change takes effect.

07

Rights of users and legal representatives

You may request access to or export of your personal information, correction, deletion, restriction of processing, or account deletion. Submit your request through Settings or Contact support. After confirming that you are the account holder or an authorized representative, we will process the request in accordance with applicable law and inform you of the outcome.

  • Account and profile changes and session termination: Settings
  • Stop new Strava collection and delete connected data: disconnect in the external connections section of Settings
  • Stop Intervals.icu activity imports and delete imported records: disconnect in the external connections section of Settings (this also stops calendar transfers). If you connected with an API key, revoke the key in your Intervals.icu settings
  • Stop writing training results to Strava: disable the feature under external connections in settings
  • Export, correct, delete, or restrict processing of personal information: Contact support
  • Delete your account: Settings, in the Account section

If a legal representative or authorized person makes a request, we may ask for documentation confirming their authority.

08

Cookies, analytics, safeguards, and children

Cookies are small pieces of text sent by websites to your browser and stored on your device. Watts Lab uses cookies and browser storage as described below to keep you signed in, protect external connections, remember your cookie preferences, and provide optional visit analytics.

CategoryPurpose and information processedRetention and choice
Essential authentication cookiesMaintaining sign-in sessions, preventing OAuth request tampering, and administrator securityFor the browser session or until the authentication or connection purpose ends · Always used
Cookie preference recordwatts_lab_ga4_consent stores your choice to allow or reject visit analytics180 days · Required to remember your choice
GA4 analytics cookies_ga, _ga_* and similar cookies distinguish visitors and sessions and generate page usage statisticsUsed only with optional consent · Cookies are set to 180 days and may be renewed on visits. Data retention follows the GA4 property's settings.

Visit analytics uses the Google Analytics 4 Google tag and analytics cookies. The Google tag loads only after you consent to visit analytics, and first-party visit statistics collection is discontinued. Names, email addresses, member IDs, and workout records such as power, heart rate, and GPS data are not sent as GA4 analytics fields. Query strings and individual record identifiers in page URLs are removed or generalized. Google signals and advertising personalization are not used. If Do Not Track (DNT) or Global Privacy Control (GPC) is enabled in your browser, analytics tags are not used regardless of consent.

You can choose 'Accept all' or 'Reject optional cookies' in the first-visit banner, and change your choice at any time through 'Cookie settings' in the landing page footer. Rejecting or withdrawing consent does not restrict core features such as sign-in or training analysis. Information sent to Google before withdrawal is managed under GA4's retention settings and Google's processing terms. Previous consent to first-party visit analytics is not treated as GA4 consent; a new choice is requested.

You can also block or delete cookies in your browser under Settings → Privacy and security → Cookies and site data. Blocking essential authentication cookies may limit sign-in and external connections.

We apply safeguards including password hashing, encryption in transit, access restrictions, administrator MFA, audit logs, private object storage, and backup management.

Watts Lab is available only to users aged 14 or older. The date of birth entered at registration is used temporarily to verify age; the original value is not stored.

09

Privacy inquiries and policy changes

Privacy matters are handled by Watts Lab Privacy Team. For requests concerning access to or deletion of personal information, or privacy incidents, contact admin.wattslab@gmail.com or use Contact support. You may also seek advice from the Personal Information Infringement Report Center (118, without an area code) or the Personal Information Dispute Mediation Committee.

This policy takes effect on October 25, 2026. This Intervals.icu activity-import revision is published and takes effect with the feature deployment, without 7 days of advance notice. Significant changes to information processed, purposes, retention, external disclosure, international transfers, or user rights are generally announced in the service or by email at least 7 days before taking effect. Significant changes unfavorable to users are generally announced 30 days in advance, and separate consent is obtained when required.

Previous versions will be retained with a change history so that they remain available for review.

10

Revision history

The main changes effective October 25, 2026 are as follows.

  • Added activity read access to the Intervals.icu connection so that completed cycling activities with power records, uploaded to Intervals.icu from other apps or devices, are imported. Activities that came through Strava are not imported, and second-by-second records are stored as time and power only. Records imported from Intervals.icu are kept until disconnection, account deletion, or a deletion request, and the rule of deleting raw Strava records within 7 days continues to apply to Strava records only.

Previous policy applied from October 19, 2026 through October 24, 2026.

The main changes effective October 19, 2026 are as follows.

  • The training log written by ‘Write training results to Strava activities’ now also includes this week's completed count, progress, and the next workout's date, name and duration, and is written in English for members who use English.

Previous policy applied from October 12, 2026 through October 18, 2026.

The main changes effective October 12, 2026 are as follows.

  • Retention of Strava activity summaries, second-by-second records, route maps and coordinates, and exact start times was reduced from up to 3 years after collection to deletion within 7 days. Afterwards, only the Strava ID, date, moving time, and activity type remain with derived training records until Strava disconnection or account deletion.
  • Strava profile picture URLs are retained only for account menu display for up to 7 days after collection. Strava profile FTP is not stored, and display names are not replaced with Strava names. Segment records and second-by-second location coordinates are not retrieved.
  • Users enter FTP directly during onboarding or in settings.
  • Optional training result updates to Strava activities and Strava route selection for event plans were added, with details of information sent to Strava at the user's request.
  • Handling of event course analysis and uploaded GPX files was specified.
  • Google Cloud processing for training plan generation was added, and Cloudflare R2 processing was updated to include database backup storage.

Previous policy applied from September 23, 2026 through October 11, 2026.

© 2026 Watts LabTerms of ServiceCookie settings