Privacy notice
Who we are
Tour du Pain is an indoor cycling game in your browser at tourdupain.app. It's made and run by WouterMedia (Wouter Hoonakker), Pierebaan 45, 1141 GV Monnickendam, the Netherlands, Chamber of Commerce (KvK) number 65271955. WouterMedia is the controller for your data. Questions about your data or this notice: wouter@woutermedia.nl.
What we store and why
| Data | Why | Legal basis |
|---|---|---|
| Email address | To sign you in with a code or link, and for messages about your account | Contract (Art. 6(1)(b) GDPR) |
| Display name, look, settings (FTP, weight, height, heart rate zones, kit colours, trainer and sound settings, privacy choices) | So your game works the same on every device | Contract |
| Rides: time, distance, speed, power, cadence, laps, the devices you used, the FIT file | Your ride history, baguettes and rank | Contract |
| Heart rate in your rides | Only if you choose "Store heart rate with my rides" | Your explicit consent (Art. 9(2)(a)); withdraw any time in Settings, then we remove heart rate from your stored rides |
| Passkeys: the public key and a name like "iCloud Keychain" | To sign you in without a password | Contract |
| Sessions: when you signed in, last activity, a coarse device label ("Chrome on macOS") | To keep you signed in and show your sessions so you can sign them out | Contract |
| Connected services: which service you connected, when, and the access keys it gave us (stored encrypted) | To fetch your planned workouts and send your finished rides there, only after you connect it | Your consent when you connect (Art. 6(1)(a)); disconnect any time |
| Guest: a random device id (we store only a hash of it), distance ridden | The 20 km you can ride before making an account | Legitimate interest (Art. 6(1)(f)) |
| Riders you block and reports you file (with what you reported) | To keep riding pleasant and act on misbehaviour | Legitimate interest |
| Your IP address, briefly | To limit sign-in attempts and keep the service safe; it is used in memory and not stored in our database | Legitimate interest |
We don't sell data, don't show ads, and use no tracking or analytics cookies. We don't make automated decisions that have legal or similarly significant effects on you.
What other riders see
Your display name, your rider's look, speed, position on the course and lap number. Your W/kg only if you switch it on. Never your heart rate, exact power, FTP, weight or email address.
Connected services
You can connect Tour du Pain to Strava, TrainingPeaks, intervals.icu or Garmin Connect. Nothing is shared until you connect a service yourself, and you can disconnect it at any time in Connections; we then delete the access keys we hold (and ask the service to revoke them where it offers that).
- What we keep: which service you connected and when, the permissions it gave us, your id and a short name there (for "Connected as"), and the access keys, stored encrypted. For intervals.icu that key is the personal API key you enter yourself; you can also delete it on intervals.icu.
- What we fetch: from TrainingPeaks and intervals.icu, your planned workouts for today and the next 7 days, so you can ride them in the game. We keep those a few minutes at most. From Strava we fetch nothing.
- What we send: the FIT file of a ride you save, with the title and description you gave it, and heart rate only if you chose to store heart rate. Photos are never sent to the service itself.
- Postcard link (Strava): with Strava connected and "Add a postcard link to Strava" on, we store one picture of the game's 3D scene per ride (your latest screenshot, else a postcard from the middle of the ride) and publish it on a page with an unguessable link, together with the ride's title, distance and ride time. That link goes in the Strava description, so anyone who can see the activity can open it. The page shows nothing else: no name, no e-mail, no heart rate. Delete the ride (or your account) to remove the picture and the page; switch the setting off for new rides.
- Who is responsible there: each service is its own controller for the data you keep with them, under its own privacy policy. Disconnecting stops new transfers but doesn't delete what is already stored with that service.
What we read from Garmin Connect. Garmin sends us new data from your Garmin account as it syncs; we only read.
- Always, once connected: your rides (cycling activities): name, type, start, duration and distance, so they show in your ride history, and Garmin's link to each ride's file, which we fetch only when you download it. A watch ride that overlaps a ride saved in the game is not shown twice.
- Only if you tick "Read my health data (resting heart rate, HRV, sleep)": per day your resting heart rate, last night's average heart rate variability and your sleep score, shown on Home. This is health data (GDPR Art. 9); we ask for it separately and store nothing of it without that consent.
- Only if you tick "Use my weight": the weights Garmin sends; the newest one updates your weight in Settings.
- Untick a choice in Connections and what it covered is deleted. Disconnecting (or removing Tour du Pain in Garmin Connect, or deleting your account) deletes everything that came from Garmin and tells Garmin to stop sending.
- Garmin doesn't let apps like ours put rides into Garmin Connect: "Export for Garmin Connect" downloads the file for you to import yourself.
Tour du Pain is not affiliated with or endorsed by Strava, TrainingPeaks, intervals.icu or Garmin. The Strava link is compatible with Strava.
Where it's stored
With Cloudflare, in the European Union: the database (Cloudflare D1, EU jurisdiction), ride files (Cloudflare R2, EU jurisdiction) and the live rooms (Cloudflare Durable Objects, EU jurisdiction). Sign-in mail goes through Cloudflare Email Service. Cloudflare is our processor under its Data Processing Addendum, which includes the EU Standard Contractual Clauses for any transfer outside the EU (for example when mail is delivered). A connected service you choose may store data outside the EU under its own safeguards.
How we protect it
Connections use HTTPS. We store no passwords; you sign in with a code, a link or a passkey. Session tokens, sign-in codes and guest ids are stored only as hashes, and the access keys of connected services are encrypted. Only the operator can reach the admin tools, protected by a passkey, and every admin change is logged.
How long we keep it
- Sign-in codes and links: deleted 24 hours after they expire (they expire after 15 minutes).
- Sessions: deleted 7 days after they expire (30 days without use, 90 days at most).
- Your account, settings, rides and ride files: until you delete them or your account.
- Connected services: until you disconnect them or delete your account.
- When you delete your account, we delete it at once from the database and file storage. Database backups (Cloudflare D1 Time Travel) can hold a copy for up to 30 days, after which it's gone.
- Server logs: 30 days, without personal data.
- Admin audit log: 12 months. Reports about other riders: 12 months after they're closed.
Cookies
We only use cookies that are strictly necessary: one that keeps you signed in, a short-lived one during sign-up and, while the game is in testing, one that remembers the test password. No consent banner is needed for these.
Your rights
You can see and download all your data (Settings → Account → Download my data), correct it, take it with you, delete your account (Settings → Account → Delete account), withdraw your heart rate consent, disconnect a service, and object to processing based on legitimate interest. For anything else, write to wouter@woutermedia.nl; we answer within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
Age
You need to be 16 or older to make an account. We don't ask for your date of birth.
Changes
If this notice changes in a way that matters, we'll tell you in the game before it applies. The version date is at the top.