Your privacy.

Where this policy applies.

This policy applies to the hupser apps for iPhone, iPad, Mac, Windows, and Android, the hupser account and the online services the apps connect to, and this website at hupser.app. In this policy, “hupser”, “we”, and “us” refer to the operator of the hupser service.

You can ride without an account. You choose whether to sign in, connect Strava or Intervals.icu, ride with others, add friends, or share usage data.

Information we collect.

On your device

Rides you record, workouts you create or import (including .zwo files you choose), training zones, paired trainers and sensors, and app settings are stored in hupser on your device. Without an account, they stay there.

Account and profile

If you sign in with Apple, Google, or an emailed code, we receive your email address and, from Apple or Google, the name they share. You can add your name, sex, date of birth, weight history, and FTP. Weight and FTP are used for power zones, W/kg, and virtual speed.

Your account also notes which hupser app you first used (iPhone, iPad, Mac, Windows, or Android) and when you finished onboarding, and each uploaded ride notes the app and version that sent it. We use this for support and to count, in total, how many new riders go on to finish their first rides.

Rides

When you are signed in, finished rides are uploaded to your hupser account: date and duration, the course and workout, power, heart rate, cadence, speed, distance on the virtual course, pauses, and derived figures such as TSS. Each ride also lists the kinds of trainers and sensors you rode with (type, brand, and how often the connection dropped, never their Bluetooth names) so we can fix connection problems. hupser is an indoor app and does not collect your GPS location.

Riding now

While you ride, the app sends a short heartbeat with a random installation identifier, platform, and ride mode so we can count active riders. On a Mac, while the ride is not paused, it also says whether hupser is the app in front or runs in the background with the ride overlay on or off; we keep this only as live counts across all riders, not per rider. If you are signed in, the heartbeat is linked to your account and also includes the course and workout name so friends can see that you are riding, according to your sharing settings.

Friends and riding with others

Friend requests, accepted friends, your friend code, and your sharing choices are stored with your account. When “Ride with others” is on, the app sends your position on the course, speed, cadence, current W/kg, display name, and the country you chose to the other riders on the same course.

Crash reports and feedback

hupser sends crash reports to Sentry, hosted in the EU. They contain technical crash details, the app version, and device and operating-system information. They do not include your name, email, ride data, screenshots, or network traffic. When you use Submit feedback, your message, the optional email you enter, and your installation identifier, app version, build, and operating system are sent the same way. The Windows app does not send crash reports.

Optional usage analytics

On iPhone, iPad, and Mac, “Share usage data” is off by default; on a Mac it is chosen separately for each profile. If you turn it on, the app sends usage events to PostHog, hosted in the EU, such as app opens, onboarding, trainer pairing and connection success or failure, workout previews on Mac, ride start, save, or discard, and upload results. Events can include your chosen country, app and system version, device model (such as “iPhone” or “MacBook Pro”), time zone, trainer brand, ride mode, duration in whole minutes, completion range, and, on a Mac, how many riding seconds hupser was in front or in the background with the ride overlay on or off. They use a separate random analytics identifier and never include your account identifier, email, name, Bluetooth device names, fitness measurements, or health data, and we never combine them with your account. IP-based location, session recording, and screen capture are disabled. Turning it off stops collection and deletes the identifier and any events not yet sent. The Android and Windows apps do not send usage analytics.

Website

When you visit hupser.app, Cloudflare and the site host process your IP address and standard request information to deliver and secure the website. Signing in at hupser.app/account/ sets a strictly necessary session cookie. We do not use advertising cookies or website analytics. The App Store button can carry the name of the campaign that brought you to the page (from the page address); Apple then reports to us only totals per campaign, such as page views and downloads. Nothing is stored on your device for this.

Device permissions.

• Bluetooth: to connect your smart trainer and heart-rate, power, and cadence sensors. On Android 11 and earlier, the system requires the location permission to scan for Bluetooth devices; hupser does not use it to determine your location.
• Photos (add only): to save a ride image you choose to share. hupser cannot read your photo library.
• Files: only the workout files you choose to import.

hupser does not read or write Apple Health data.

How we use information.

• Run workouts, control your trainer, and record and display your rides.
• Keep your profile and rides in sync across your devices and at hupser.app/account/.
• Calculate training zones, W/kg, virtual speed, and ride summaries.
• Show riders on the same course, friends, and what friends have chosen to share.
• Upload rides to Strava or Intervals.icu when you ask us to.
• Respond to support and feedback, fix crashes, prevent abuse, and secure accounts.
• Understand, as totals, where new riders get stuck: from account and ride dates we already hold, campaign totals from Apple, and, if you turn it on, usage analytics.
• Comply with legal obligations and enforce our rights.

Why we may use it.

• To provide the service you asked for (Art. 6(1)(b) GDPR): your account, profile, ride sync, friends, riding with others, and the Strava and Intervals.icu connections you choose.
• Your consent (Art. 6(1)(a) GDPR, and the Slovenian Electronic Communications Act, ZEKom-2, for keeping the analytics identifier on your device): optional usage analytics. You can withdraw it at any time with the same switch; this does not affect what was sent before.
• Our legitimate interests (Art. 6(1)(f) GDPR) in keeping hupser working, secure, and improving: crash reports, riding-now counts, the app and onboarding notes on your account and rides, totals of how new riders progress, and campaign totals. You can object to this by contacting us.
• Legal obligations (Art. 6(1)(c) GDPR), where the law requires us to keep or disclose information.

When information leaves your account.

Other riders and friends

With “Ride with others” on, riders on the same course see your display name, country, position, and W/kg. If you allow requests from the Nearby list, they can also send you a friend request. With “Suggest me after rides” on, riders who shared a course with you may see you under Riders you met and send you a request. Friends see only what you choose in Friends & privacy: whether you are riding now, the course and workout, your last ride, ride times, and, if you share ride history, power, TSS, and heart rate.

Strava and Intervals.icu

Strava connects through your hupser account; when you connect it, we store the connection and send the rides you choose or auto-upload. Intervals.icu connects directly from your device: its credentials are kept in secure storage on your device, and the app uploads rides and reads your planned workouts and cycling zones from Intervals.icu without passing them through hupser. Both services handle the data under their own privacy policies.

Service providers and legal requirements

We use providers for hosting, storage, content delivery, email, sign-in, crash reporting, and, when you opt in, usage analytics (PostHog, hosted in the EU). They receive only what they need to perform services for hupser. We may also disclose information if legally required, to protect users and the service, or as part of a business transfer subject to appropriate safeguards.

We do not sell personal information, and we do not share it for advertising or cross-app tracking.

Your choices and rights.

• Use hupser without an account, or sign out at any time.
• Turn “Ride with others” on or off, and choose what friends see in Friends & privacy.
• Reset your friend code to stop an old code working, and remove friends.
• Disconnect Strava or Intervals.icu and turn off automatic uploads.
• Turn “Share usage data” on or off: on iPhone and iPad in Settings → Account, on a Mac in Settings → Account → Privacy.
• Edit your profile in the app or at hupser.app/account/.
• Delete your account on iPhone, iPad, or Android in Settings → hupser account, on Mac or Windows in Settings → Account, or at hupser.app/account/.
• Contact us to request access, correction, deletion, restriction, objection, or portability where applicable.

Retention and deletion.

We retain account information and rides while your account is active and as needed to provide the service. Retention may also be required for security, fraud prevention, dispute resolution, and legal obligations. Riding-now counts expire within days and monthly totals within weeks. The app and onboarding notes on your account and rides are deleted with your account.

Account deletion requires email confirmation. Once confirmed, your account, profile, rides, friends, and connected-service records are scheduled for deletion. Limited information may remain temporarily in backups or operational logs before routine expiry, or where retention is legally required. Rides already sent to Strava or Intervals.icu stay there until you delete them with that service.

Rides saved on your device remain there after you sign out or delete your account. Deleting the app removes them.

How we protect information.

hupser uses encrypted network transport, access controls, restricted production credentials, and encrypted storage for connected-service credentials. No system can guarantee absolute security, so contact us if you suspect unauthorised access to your account.

hupser may process information in countries other than your own through its service providers. Where required, we use appropriate safeguards for international transfers.

Updates to this policy.

We may update this policy when the product, providers, or legal requirements change. The current version and effective date will remain available at this URL. Material changes will be communicated through the app or another appropriate channel.

Questions or requests.

Contact hupser about privacy, account deletion, or data rights using the address below. To help us protect your account, we may need to verify your identity before completing a request.