Effective October 19, 2026 through October 24, 2026

Privacy Policy

This is the previous policy, which applied through October 24, 2026. View the current policy

Scope and principles

This policy explains what personal information Watts Lab collects when providing its services, how it is used, and when it is deleted. It applies to the Watts Lab web service, member accounts, customer support, and the Strava and Intervals.icu connections selected by users.

Watts Lab processes personal information only to the extent necessary to provide its services. We do not sell personal information or use it for personalized advertising. Information independently processed by external services is also subject to those providers' privacy policies.

Personal information we process and why

The information below is collected when you enter it or connect an external service, and may also be generated as you use the service.

Category	Information processed	Purpose
Account and authentication	Email, display name, Strava profile picture URL, password hash, email verification result, confirmation of minimum age 14 years, records of acknowledging terms and policies, session information, IP address, and browser information	Registration, login, account identification and account menu display, policy acknowledgment, security, and abuse prevention
Training profile	FTP (entered by the user during onboarding or in settings), maximum heart rate, weight, fitness level, goals, and training availability	Personalized analysis, workout intensity settings, and training plan generation
Event course	Event course analysis (distance, elevation gain, gradients, elevation changes, and major climbs), uploaded GPX filename and course map coordinates, and selected Strava route ID	Creating training plans tailored to the event course and displaying the course
Raw Strava activities	Activity ID, name, type, date and time; distance, elevation gain, moving and elapsed time, speed, power and heart rate summaries, cadence, energy, device and equipment information; second-by-second power, heart rate, cadence, speed and elevation; route maps and start/end coordinates	Synchronizing rides, displaying activities and maps, and calculating training records
Training records and analysis	Strava activity ID, date, moving time and type; ride-level training metrics (Load, Intensity, and weighted power) and power/heart rate summaries; best power by duration; fitness metrics (CTL, ATL, TSB); training levels by zone; prescribed workout matches and results; RPE, workout difficulty, completion and reasons for stopping; estimated maximum heart rate and VO₂max; recommendations and training plans	Assessment of workout performance, fitness and fatigue estimates, adjustment of recommendations, and service improvement
Optional Strava features	The training log written to Strava activity descriptions (plan name, week, training phase, workout name and completion, this week's and cumulative completed counts, progress, days until the goal, and the next workout's schedule); saved Strava route lists and selected route files (not stored)	Writing training results to Strava activities and choosing saved Strava routes for events when selected by the user
Support and operational records	Support email address, subject, and message; access, sync, error, security, and administrator activity logs	Handling support requests, maintaining service stability, responding to outages and security incidents, and resolving disputes
Service usage statistics	When optional GA4 analytics consent is given: normalized page paths, visit times, external referral sources, device and browser information, and cookie-based visitor and session identifiers	Google Analytics 4 statistics on page usage, visitors, and referral sources, and service improvement
Browser notifications	Push subscription endpoint and encryption public keys, device and browser information, notification preferences, and delivery and failure logs	Sending today's workout, effort rating reminders, and all-time power PR notifications to devices you authorize

Strava connection data

While you keep Strava connected, Watts Lab retrieves the following information through the Strava API within the permissions you grant.

Strava athlete ID and profile picture URL
Activity summaries including ID, name, type, date and time, distance, elevation gain, moving and elapsed time, speed, power and heart rate summaries, cadence, energy, and device/equipment information
Second-by-second power, heart rate, cadence, speed, and elevation
Route maps and start/end location coordinates

We do not retrieve information Strava does not provide or you have not authorized, and do not request segment records or second-by-second location coordinates. Strava profile picture URLs are used only to display your picture in the account menu and are deleted within 7 days of collection and periodically retrieved again while connected. We do not store FTP from your Strava profile. Your chosen display name is retained and is not replaced with your Strava name when connecting or reconnecting. Your Strava athlete ID is kept while connected.

Activity summaries, second-by-second records, route maps and coordinates, and exact start times received from Strava are deleted from our database and storage within 7 days of collection. Afterwards, only the activity's Strava ID, date, moving time and type (indoor/outdoor) remain, together with the following training records calculated by Watts Lab, until you disconnect Strava or delete your account.

Training load and power/heart rate summaries for each ride
Best power by duration
Fitness metrics
Training levels by zone
Prescribed workout matches and performance results

Connected data is used for ride analysis, map display, and training recommendations. Disconnecting Strava in settings stops new collection and deletes imported Strava activities, derived analysis, and generated training plans.

The following features operate only when you choose them. Other features remain available if you do not use them.

Write training results to Strava activities: when enabled in settings, we append a training log to your own matched activity descriptions. It contains the plan name, current/total weeks and training phase, workout name and completion indicator, this week's and cumulative completed/planned counts with progress, days until the goal, and the next workout's date, name and duration, written in Korean or English according to your language setting. Power, FTP and training-load values and links are never written. This requires additional Strava write permission (activity:write). The existing activity description is read when writing but is not stored. Written content may be visible to other Strava users according to that activity's visibility settings. Disabling the feature stops future updates; existing content can be edited or removed directly in Strava.
Select an event course from Strava routes: when you select a saved route for an event plan, Watts Lab retrieves your route list and the selected GPX file through the Strava API and sends them to your browser, where course analysis runs. The list and route file are not stored. Only analysis results (distance, elevation gain, gradients, elevation changes, and major climbs) and the Strava route ID are saved with the event goal. Private routes require additional Strava permission (read_all).

Routes and location information are handled as follows.

Strava activity route maps and start/end coordinates: deleted with other raw data within 7 days of collection
Saved Strava route lists and files: not stored
GPX files uploaded as event courses: analyzed in your browser; the original file is not sent to the server. The filename, simplified course coordinates, and analysis results are saved with the event goal to display the course again

Retention and deletion

Personal information is retained for as long as necessary to fulfill its purpose and then deleted without delay.

Information	Retention period
Account and profile	Until you delete your account or request deletion of the information
Raw Strava activities (summaries, second-by-second records, route maps and coordinates, and exact start times)	Deleted within 7 days of collection
Training records, analysis, and training plans	Until Strava disconnection, account deletion, or a request to delete the information. After raw Strava data is deleted, only the Strava ID, date, moving time, activity type, and values calculated from them remain
Strava athlete ID and connection permissions	Until Strava disconnection or account deletion
Saved Strava route lists and files	Not stored
GA4 user and event data	As set in the connected GA4 property's data retention settings. Aggregate reports may be retained separately from these settings.
Raw first-party visit analytics collected before the transition	90 days from collection
Daily first-party visit aggregates created before the transition	13 months
Cookie preference record	180 days from your selection, or until deleted in your browser
Browser push subscriptions	Until you disable notifications on the device or delete your account
Browser push delivery and failure logs	30 days after delivery or final failure
Customer support messages	1 year after the request is closed
Access and security logs	Up to 2 years
Records of acknowledgment of terms and policies and the granting or revocation of external access	Up to 3 years
Backups	Deleted through backup rotation within 30 days after deletion

Where retention is required by law or necessary to respond to disputes or security incidents, only the relevant information is stored separately with restricted access. Electronic files are deleted using methods that make recovery difficult.

Disclosure to third parties and external connections

Watts Lab does not provide personal information to third parties without your consent or a legal basis. When you select an external integration, the following information is transmitted at your request to provide the feature.

Service	Information transmitted and purpose	Timing and retention
Strava, Inc.	Identifiers for account connection, permission renewal/revocation, and activity/saved-route retrieval	Encrypted communication during connection, synchronization, or route selection; subject to Strava policies
Strava, Inc. (training result updates)	When enabled, writes the plan name, current/total weeks and training phase, workout name and completion indicator, this week's and cumulative completed/planned counts with progress, days until the goal, and the next workout's date, name and duration to your matched activity descriptions	Sent over encrypted communication for each matched activity. Remains on Strava until you edit or delete it there; subject to Strava policies and the activity's visibility settings
Intervals.icu	Athlete ID, workout dates, titles, descriptions, and ZWO files sent to the calendar	Encrypted communication during schedule synchronization; until disconnection or as specified by the provider's policies
OpenStreetMap	IP address, browser information, and displayed map area included in map tile requests	Requested directly by your browser when you view a map; subject to the provider's policies
Browser push provider for your device	Delivery using encrypted notification titles and content and the subscription endpoint	Sent when you allow notifications; subject to the policies of the relevant provider, such as Google, Apple, Mozilla, or Microsoft

Service providers and international transfers

Watts Lab entrusts the providers below with tasks needed to operate the service. We manage contracts and operations so that these providers process personal information securely.

Task	Provider	Processing location	Information and retention
Web application and Redis operations	Amazon Web Services (AWS Lightsail)	Seoul, Republic of Korea (ap-northeast-2)	Account, activity, analysis, and operational information; retention periods in Section 4
Managed PostgreSQL storage, queries, and backups	Neon, LLC (Neon PostgreSQL)	Singapore (ap-southeast-1)	Account, activity, training, analysis, policy, and operational information; retention periods in Section 4 and up to 30 days for backups
Storage of activity time-series objects and database backups	Cloudflare R2	Countries determined by operational contracts and settings	Encrypted second-by-second activity records are deleted within 7 days of collection; encrypted database backups are kept for up to 30 days
Running training plan generation jobs	Google (Google Cloud Run)	Seoul, South Korea (asia-northeast3)	Training profiles, goals, and records required for plan generation; processed during the job, with generated results stored in the service database
Authentication and support email delivery	The email delivery service used by the operator	Countries determined by operational contracts and settings	Recipient email address, display name, and email content; retention periods in Section 4
Browser push delivery	The push provider designated by the device's browser	Countries determined by the provider and device settings	Encrypted notification content and subscription endpoint; until delivery is complete or for the period specified by the provider's policies
Optional visit analytics	Google (Google Analytics 4)	International processing under Google's data processing terms	Visit information such as page paths, referral sources, device information, and cookie identifiers; subject to the GA4 property's retention settings and Google's processing terms

International transfers to Neon take place over TLS-encrypted connections during service use, activity synchronization, analysis, and account management to provide the database functionality needed to fulfill the service agreement. You can stop future transfers by deleting your account, but account-based services cannot be provided if you refuse international transfers. Backup copies of deleted information are removed through rotation within 30 days.

If GA4 is connected and you consent to visit analytics, visit information is sent from your browser to Google. Communication information, including your IP address, is also sent to Google during Google tag requests. Rejecting or withdrawing analytics consent in Cookie Settings stops future analytics transmissions without affecting the core service. For information on Google's processing, see Google's partner-site data information.

If a service provider or processing country changes, we will notify you through this policy. Where separate consent is required, we will obtain it before the change takes effect.

Rights of users and legal representatives

You may request access to or export of your personal information, correction, deletion, restriction of processing, or account deletion. Submit your request through Settings or Contact support. After confirming that you are the account holder or an authorized representative, we will process the request in accordance with applicable law and inform you of the outcome.

Account and profile changes and session termination: Settings
Stop new Strava collection and delete connected data: disconnect in the external connections section of Settings
Stop writing training results to Strava: disable the feature under external connections in settings
Export, correct, delete, or restrict processing of personal information: Contact support
Delete your account: Settings, in the Account section

If a legal representative or authorized person makes a request, we may ask for documentation confirming their authority.

Cookies, analytics, safeguards, and children

Cookies are small pieces of text sent by websites to your browser and stored on your device. Watts Lab uses cookies and browser storage as described below to keep you signed in, protect external connections, remember your cookie preferences, and provide optional visit analytics.

Category	Purpose and information processed	Retention and choice
Essential authentication cookies	Maintaining sign-in sessions, preventing OAuth request tampering, and administrator security	For the browser session or until the authentication or connection purpose ends · Always used
Cookie preference record	`watts_lab_ga4_consent` stores your choice to allow or reject visit analytics	180 days · Required to remember your choice
GA4 analytics cookies	`_ga`, `_ga_*` and similar cookies distinguish visitors and sessions and generate page usage statistics	Used only with optional consent · Cookies are set to 180 days and may be renewed on visits. Data retention follows the GA4 property's settings.

Visit analytics uses the Google Analytics 4 Google tag and analytics cookies. The Google tag loads only after you consent to visit analytics, and first-party visit statistics collection is discontinued. Names, email addresses, member IDs, and workout records such as power, heart rate, and GPS data are not sent as GA4 analytics fields. Query strings and individual record identifiers in page URLs are removed or generalized. Google signals and advertising personalization are not used. If Do Not Track (DNT) or Global Privacy Control (GPC) is enabled in your browser, analytics tags are not used regardless of consent.

You can choose 'Accept all' or 'Reject optional cookies' in the first-visit banner, and change your choice at any time through 'Cookie settings' in the landing page footer. Rejecting or withdrawing consent does not restrict core features such as sign-in or training analysis. Information sent to Google before withdrawal is managed under GA4's retention settings and Google's processing terms. Previous consent to first-party visit analytics is not treated as GA4 consent; a new choice is requested.

You can also block or delete cookies in your browser under Settings → Privacy and security → Cookies and site data. Blocking essential authentication cookies may limit sign-in and external connections.

We apply safeguards including password hashing, encryption in transit, access restrictions, administrator MFA, audit logs, private object storage, and backup management.

Watts Lab is available only to users aged 14 or older. The date of birth entered at registration is used temporarily to verify age; the original value is not stored.

Privacy inquiries and policy changes

Privacy matters are handled by Watts Lab Privacy Team. For requests concerning access to or deletion of personal information, or privacy incidents, contact admin.wattslab@gmail.com or use Contact support. You may also seek advice from the Personal Information Infringement Report Center (118, without an area code) or the Personal Information Dispute Mediation Committee.

This policy takes effect on October 19, 2026. Significant changes to information processed, purposes, retention, external disclosure, overseas transfers, or user rights are generally announced in the service or by email at least 7 days before taking effect. Significant changes unfavorable to users are generally announced 30 days in advance, and separate consent is obtained when required.

Previous versions will be retained with a change history so that they remain available for review.

Revision history

The main changes effective October 19, 2026 are as follows.

The training log written by ‘Write training results to Strava activities’ now also includes this week's completed count, progress, and the next workout's date, name and duration, and is written in English for members who use English.

Previous policy applied from October 12, 2026 through October 18, 2026.

The main changes effective October 12, 2026 are as follows.

Retention of Strava activity summaries, second-by-second records, route maps and coordinates, and exact start times was reduced from up to 3 years after collection to deletion within 7 days. Afterwards, only the Strava ID, date, moving time, and activity type remain with derived training records until Strava disconnection or account deletion.
Strava profile picture URLs are retained only for account menu display for up to 7 days after collection. Strava profile FTP is not stored, and display names are not replaced with Strava names. Segment records and second-by-second location coordinates are not retrieved.
Users enter FTP directly during onboarding or in settings.
Optional training result updates to Strava activities and Strava route selection for event plans were added, with details of information sent to Strava at the user's request.
Handling of event course analysis and uploaded GPX files was specified.
Google Cloud processing for training plan generation was added, and Cloudflare R2 processing was updated to include database backup storage.

Previous policy applied from September 23, 2026 through October 11, 2026.