Your privacy.

Where this policy applies.

This policy applies to the hupser apps for iPhone, iPad, Mac, Windows, and Android, the hupser account and the online services the apps connect to, and this website at hupser.app. In this policy, “hupser”, “we”, and “us” refer to the operator of the hupser service.

You need a hupser account to ride: sign in with Apple, Google, or a link we email you. You choose whether to connect Strava, Intervals.icu, Garmin Connect, Discord, or Apple Health, ride with others, add friends, join clubs, or share usage data.

Information we collect.

On your device

Rides you record, workouts you create or import (including .zwo files you choose), training zones, paired trainers and sensors, and app settings are stored in hupser on your device, so you can ride offline. Your training zones, maximum heart rate, the workouts you create or import, and your calendar are also kept in your hupser account, so every device you sign in on shows the same.

Account and profile

If you sign in with Apple, Google, or an emailed sign-in link, we receive your email address and, from Apple or Google, the name they share. You can add your name, sex, date of birth, weight history, and FTP. Weight and FTP are used for power zones, W/kg, and virtual speed.

Your account also notes which hupser app you first used (iPhone, iPad, Mac, Windows, or Android) and when you finished onboarding, and each uploaded ride notes the app and version that sent it. We use this for support and to count, in total, how many new riders go on to finish their first rides. It also notes the days you open a hupser app while signed in, with that app and its version, and for each signed-in device which app it is and when it was last used, so we can help with support and see whether new riders get started. On a Mac or Windows PC, those days also note the size of your screen and of the hupser window, and whether it is full screen, so we can design hupser for the screens riders use.

Rides

When you are signed in, finished rides are uploaded to your hupser account: date and duration, the course and workout, power, heart rate, cadence, speed, distance on the virtual course, pauses, and derived figures such as TSS. Each ride also lists the trainers and sensors you rode with, as each device describes itself: its type and brand, the name it broadcasts over Bluetooth or ANT+ (which can include a name you gave it), its maker, model, serial number and firmware version, the services it offers, and how often the connection dropped. Only the hupser team sees this, to fix connection problems; it is never shown to other riders, your friends included. hupser is an indoor app and does not collect your GPS location.

Riding now

While you ride, the app sends a short heartbeat with a random installation identifier, platform, and ride mode so we can count active riders. On a Mac or Windows PC, while the ride is not paused, it also says whether hupser is the app in front or runs in the background with the ride overlay on or off; we keep this only as live counts across all riders, not per rider. If you are signed in, the heartbeat is linked to your account and also includes the course and workout name so friends can see that you are riding, according to your sharing settings.

Friends and riding with others

Friend requests, accepted friends, your friend code, and your sharing choices are stored with your account. When “Ride with others” is on, the app sends your position on the course, speed, cadence, current W/kg, display name, and the country you chose to the other riders on the same course.

Clubs and events

If you create or join a club, we store the club’s name, place, description, colour, and logo, its members and their roles, and requests to join. If you host a ride or sign up for one, we store the ride (its time, course or workout, who can see it, and any limit on places) and who signed up.

Crash reports and feedback

hupser sends crash reports to Sentry, hosted in the EU. They contain technical crash details, the app version, and device and operating-system information. They do not include your name, email, ride data, screenshots, or network traffic. When you use Submit feedback, your message is sent the same way with the name and email of your hupser account, so we can reply, unless you choose Send anonymously, together with your installation identifier, app version, build, and operating system. If you leave Include diagnostics on (the default), feedback also carries your paired devices (their role, brand, and protocol, and whether they are connected, never their names or identifiers) and a log of recent trainer and ride events kept on your device (connections, drops, errors, power targets, and ride start, pause, and end). That log stays on your device unless you send it, holds at most a few hundred kilobytes, and overwrites its oldest lines. See what’s sent shows exactly what is attached. On Windows, a crash report is sent the next time hupser starts. It also contains a minidump (the state of hupser at the moment of the crash: its threads and loaded program files) and the technical log of that session.

Optional usage analytics

On iPhone, iPad, Mac, and Windows, “Share usage data” is off by default; on a Mac or Windows PC it is chosen separately for each profile. If you turn it on, the app sends usage events to PostHog, hosted in the EU, such as app opens, onboarding, trainer pairing and connection success or failure, workout previews on Mac and Windows, ride start, save, or discard, and upload results. Events can include your chosen country, app and system version, device model (such as “iPhone” or “MacBook Pro”; not sent from Windows), time zone, trainer brand, ride mode, duration in whole minutes, completion range, and, on a Mac or Windows PC, how many riding seconds hupser was in front or in the background with the ride overlay on or off. They use a separate random analytics identifier and never include your account identifier, email, name, Bluetooth device names, fitness measurements, or health data, and we never combine them with your account. IP-based location, session recording, and screen capture are disabled. Turning it off stops collection and deletes the identifier and any events not yet sent. The Android app does not send usage analytics.

Website

When you visit hupser.app, Cloudflare and the site host process your IP address and standard request information to deliver and secure the website. Signing in at hupser.app/account/ sets a strictly necessary session cookie. We do not use advertising cookies. On the home page (hupser.app and hupser.app/sl/) we measure visits with PostHog, hosted in the EU, without cookies and without storing anything on your device. We record which page you saw, the site that sent you, the campaign tags in the page address (such as utm_campaign), your browser, operating system, device type and language, and whether you joined the waitlist, accepted an invite or clicked a download link; we never record your email address. To count unique visitors without an identifier on your device, PostHog combines your IP address, browser, the site and a random value that changes every day and is then deleted into a one-way code. Your IP address is not stored and is not used to find your location, and visits are never combined with your account or with app usage analytics. If your browser sends Do Not Track or Global Privacy Control, nothing is measured. The App Store button can carry the name of the campaign that brought you to the page (from the page address); Apple then reports to us only totals per campaign, such as page views and downloads. Nothing is stored on your device for this. On blog posts (hupser.app/blog/) we count views of each post and where the visit came from (the campaign tag in the link, or the kind of site that sent you, such as Reddit or a search engine), without cookies and without storing anything on your device. To count a visitor once a day, we keep a one-way code made from your IP address, browser, the post and the day for at most 36 hours; your IP address is not stored. If your browser sends Do Not Track or Global Privacy Control, nothing is counted.

Waitlist

If you join the waitlist, on this website or in the app, we store your email address, your language, and when and where you asked (the website, or which app), only to invite you to hupser. If you accept an invite link, we store the email address you enter with that invite, and when you used it. We delete it on request: write to support@hupser.app.

Device permissions.

• Bluetooth: to connect your smart trainer and heart-rate, power, and cadence sensors. On Android 11 and earlier, the system requires the location permission to scan for Bluetooth devices; hupser does not use it to determine your location.
• Photos (add only): to save a ride image you choose to share. hupser cannot read your photo library.
• Files: only the workout files you choose to import.
• Apple Health (iPhone and iPad, optional): if you turn on Save rides to Apple Health, hupser writes each ride you finish to Apple Health as an indoor cycling workout with its active energy, heart rate, power, and cadence. Rides from before you turned it on are added only if you choose Add past rides, or add a single ride. hupser only writes to Apple Health and never reads from it. Nothing from Apple Health is sent to us, and it is never used for advertising.

How we use information.

• Run workouts, control your trainer, and record and display your rides.
• Keep your profile and rides in sync across your devices and at hupser.app/account/.
• Calculate training zones, W/kg, virtual speed, and ride summaries.
• Show riders on the same course, friends, club members, and what friends have chosen to share, and run clubs and the rides they host.
• Upload rides to Strava, Intervals.icu, or Garmin Connect, save them to Apple Health, and show your W/kg on Discord, when you choose to.
• Respond to support and feedback, fix crashes, prevent abuse, and secure accounts.
• Understand, as totals, where new riders get stuck: from account and ride dates we already hold, campaign totals from Apple, cookieless visit counts on this website, and, if you turn it on, usage analytics.
• Comply with legal obligations and enforce our rights.

Why we may use it.

• To provide the service you asked for (Art. 6(1)(b) GDPR): your account, profile, ride sync, friends, riding with others, clubs and events, and the Strava, Intervals.icu, Garmin Connect, Discord, and Apple Health connections you choose.
• Your consent (Art. 6(1)(a) GDPR, and the Slovenian Electronic Communications Act, ZEKom-2, for keeping the analytics identifier on your device): optional usage analytics. You can withdraw it at any time with the same switch; this does not affect what was sent before.
• Our legitimate interests (Art. 6(1)(f) GDPR) in keeping hupser working, secure, and improving: crash reports, riding-now counts, the app and onboarding notes on your account and rides, totals of how new riders progress, campaign totals, and cookieless visit measurement on this website. You can object to this by contacting us.
• Legal obligations (Art. 6(1)(c) GDPR), where the law requires us to keep or disclose information.

When information leaves your account.

Other riders and friends

With “Ride with others” on, riders on the same course see your display name, country, position, and W/kg. If you allow requests from the Nearby list, they can also send you a friend request. With “Suggest me after rides” on, riders who shared a course with you may see you under Riders you met and send you a request. Friends see only what you choose in Friends & privacy: whether you are riding now, the course and workout, your last ride, ride times, and, if you share ride history, power, TSS, and heart rate.

Clubs and events

Members of a club see its other members (name, photo, and role) and when a fellow member is riding now; joining a club shares this with its members. They also see your course if you share it with friends. Club admins see who asked to join. Members see the club’s rides and who signed up for them, and whoever hosts a ride sees who signed up. A ride open to everyone shows its details and host to all hupser riders.

Strava and Intervals.icu

Strava and Intervals.icu connect through your hupser account. When you connect one, we store the connection (for Intervals.icu, its sign-in or API key, encrypted) and send the rides you choose or upload automatically. From Intervals.icu we also read your planned workouts and, only if you turn them on, your profile and zone settings, fitness values, and past activities to import into hupser. Both services handle the data under their own privacy policies.

Garmin Connect

If you connect Garmin Connect, you sign in with Garmin and choose what hupser may access. Garmin then gives us your Garmin user ID and access keys, which we store encrypted with your hupser account, along with which rides we sent. We use them only to send your finished hupser rides to your Garmin Connect account, the ones you choose or upload automatically, and to know when you disconnect. We don’t read your activities, health, or other data from Garmin.

Your Garmin connection is stored on our servers at Hetzner Online GmbH in Helsinki, Finland, our hosting provider. Our nightly backups include it; they are encrypted before they leave our servers and kept with Cloudflare (R2 storage), which cannot read them. If sending a ride to Garmin fails, technical details of the error may go to our crash reporting provider, Sentry, hosted in the EU. These providers process the data only on our behalf, and no other third party receives your Garmin data. We don’t sell it or share it for anyone else’s use, and we don’t process it with AI systems or use it to train, evaluate, or improve AI models.

Disconnect Garmin Connect in hupser or in your Garmin Connect account at any time; we then delete the stored access keys. To access, correct, delete, or export what we hold about your Garmin connection, contact us at the address below. Garmin handles the data under its own privacy policy.

Discord

If you connect Discord, Discord tells us your Discord user ID and username, and we store the connection with its access keys, encrypted. hupser then adds you to the hupser Discord server. With Share W/kg on (the default), your Discord profile shows your W/kg from hupser and the hupser server gives you the matching role, in steps of 0.5 W/kg from 2.0; other Discord users can see both. We work out your W/kg from your best 20 minutes in hupser rides over the last 90 days and your weight on that ride, or from your FTP on a connected Intervals.icu, whichever is higher. Turn Share W/kg off to remove both, or disconnect Discord at any time. Discord handles the data under its own privacy policy.

Service providers and legal requirements

We use providers for hosting, storage, content delivery, email, sign-in, crash reporting, team notifications (Discord, which receives the name and email address of new accounts and waitlist sign-ups), website visit measurement and, when you opt in, usage analytics (both PostHog, hosted in the EU). They receive only what they need to perform services for hupser. We may also disclose information if legally required, to protect users and the service, or as part of a business transfer subject to appropriate safeguards.

We do not sell personal information, and we do not share it for advertising or cross-app tracking.

Your choices and rights.

• Sign out at any time.
• Turn “Ride with others” on or off, and choose what friends see in Friends & privacy.
• Reset your friend code to stop an old code working, and remove friends.
• Disconnect Strava, Intervals.icu, Garmin Connect, or Discord, and turn off automatic uploads or Share W/kg.
• Turn off Save rides to Apple Health in hupser, or remove hupser’s access in the Health app.
• Leave a club, or cancel your sign-up for a ride.
• Turn “Share usage data” on or off: on iPhone and iPad in Settings → Share usage data, on a Mac or Windows PC in Settings → Account → Privacy.
• Edit your profile in the app or at hupser.app/account/.
• Delete your account on iPhone, iPad, Mac, or Windows in Settings → Account, on Android in Settings → hupser account, or at hupser.app/account/.
• Contact us to request access, correction, deletion, restriction, objection, or portability where applicable.

Retention and deletion.

We retain account information and rides while your account is active and as needed to provide the service. Retention may also be required for security, fraud prevention, dispute resolution, and legal obligations. Riding-now counts expire within days and monthly totals within weeks. The app and onboarding notes on your account and rides are deleted with your account. The days you opened the app are deleted after 13 months, or sooner with your account.

Account deletion requires email confirmation. Once confirmed, your account, profile, rides, friends, and connected-service records are scheduled for deletion. Limited information may remain temporarily in backups or operational logs before routine expiry, or where retention is legally required. Rides already sent to Strava, Intervals.icu, or Garmin Connect, or saved to Apple Health, stay there until you delete them with that service or in the Health app. A club you own passes to another member; a club with no other members is deleted with its rides and logo.

Rides saved on your device remain there after you sign out or delete your account. Deleting the app removes them.

How we protect information.

hupser uses encrypted network transport, access controls, restricted production credentials, and encrypted storage for connected-service credentials. No system can guarantee absolute security, so contact us if you suspect unauthorised access to your account.

hupser may process information in countries other than your own through its service providers. Where required, we use appropriate safeguards for international transfers.

Updates to this policy.

We may update this policy when the product, providers, or legal requirements change. The current version and effective date will remain available at this URL. Material changes will be communicated through the app or another appropriate channel.

Questions or requests.

Contact hupser about privacy, account deletion, or data rights using the address below. To help us protect your account, we may need to verify your identity before completing a request.