Security

Less kept, less to lose

The strongest protection is not holding data at all. Your rides stay on your computer unless you turn backups on, your heart rate is never stored here -- with its own consent it only passes through to the training services you link -- and from a training service you link we keep only your athlete number and the service's number for each ride we sent. There is no password to steal: you sign in with a one-time code sent to your email address.

In transit and at rest

• Every connection to this website, the account service and the relay riders meet on is encrypted.
• The database and the stored rides are encrypted at rest by the providers who hold them, in the EU.
• The access a linked training service grants is encrypted again with a key of our own, kept apart from the database, and is used only by our server. The app on your computer never holds it.
• Sign-in tokens on your computer are kept in your system's keychain.

Access and logging

• Only the people who run the service can reach the servers and the database.
• The account service keeps no IP addresses in its logs; the relay keeps only a shortened one. Logs are deleted after 14 days.
• How long each kind of data is kept is enforced by the software, not by a reminder, and a deletion is applied again to any backup we restore.

If something goes wrong

If a breach of security affects personal data, we report it to the supervisory authority within 72 hours where the law requires, tell the riders affected without undue delay where it puts their rights at high risk, and tell any training service whose data is affected as our agreement with it requires.

Reporting a vulnerability

Write to support@ridevelowatt.com with "Security" in the subject line, in English, German or Dutch; the same address is in https://ridevelowatt.com/.well-known/security.txt. Tell us what you found and how to reproduce it. You will hear from a person, normally within two working days, and we will keep you informed while it is fixed.

Please give us a reasonable time to fix a problem before you disclose it, do not access or change other people's data beyond what is needed to show the problem, and do not degrade the service for others. Research done in good faith on those terms is welcome, and we will not take action against it.

For training services and partners

If you are reviewing an integration with VeloWatt Pro and need more detail than this page and the privacy notice give, such as a description of our technical and organisational measures or a data processing agreement, write to support@ridevelowatt.com.