Cyclarena Privacy Policy
Cyclarena is a virtual cycling app published by Hurfindia (“we”, “us”), the data controller for the information described here. The app connects to your smart trainer and sensors over Bluetooth and lets you ride with other real riders in a virtual world. This policy explains what we collect, why, who can see it, how long we keep it, and the rights you have.
Cyclarena is in early development. The current test version lets you create an account (stored on our servers) but does not yet send any ride data. This policy describes the app as it will work once group rides are available, so that you know in advance what to expect.
Summary
- We collect what is needed to simulate your ride fairly and to ride with others: your name, email address, country, date of birth, height, weight, and the power, cadence, speed and heart rate from your sensors.
- Heart rate, weight and height are health data. We only process them with your explicit consent, which you can withdraw at any time.
- We do not sell your data, show ads, or share your data with advertisers or data brokers.
- You can delete your account and all its data at any time.
What we collect
| Data | Why we need it |
|---|---|
| Account details: first and last name, email address, password (stored only as a salted hash), account ID | To create and secure your account, to show your name to the riders you ride with, and to contact you about your account (for example to confirm your email address with a code, reset your password or answer a support request). |
| Android test sign-up: the email of your Google Play account, if you ask to join the Android test on our website | To invite you to the closed test of the Android app on Google Play. Nothing else: no newsletter, no marketing. |
| Country | To show the country you ride for next to your name in group rides and results, and for national rankings. |
| Date of birth | To check you are old enough to use the app and to place you in the right age category for group rides and results. Your date of birth itself is never shown to others. |
| Height and weight | To calculate your virtual speed realistically: speed on a climb depends on your power relative to your weight, and air resistance depends on your size. Also used to show watts per kilogram. |
| Ride data: power, cadence, speed, distance, time, route and position in the virtual world | To run the ride, show your progress to you and to the riders you ride with, keep your ride history and results, and detect cheating (our servers calculate your speed from your power so that results are fair). |
| Heart rate (only if you connect a heart-rate monitor) | To display it during the ride and keep it in your ride history. |
| Technical data: app version, device model and operating system, crash and error reports | To keep the service working and fix problems. |
We do not collect your real-world location, contacts, photos or payment details. On Android 11 and earlier the app asks for the location permission only because Android requires it for Bluetooth scanning; the app never accesses your location.
Bluetooth
The app scans for nearby Bluetooth devices to find your trainer and sensors. The list of nearby devices stays on your phone and is never sent to us.
Legal basis (GDPR)
- Contract: account details, age and ride data are needed to provide the service you sign up for.
- Explicit consent: heart rate, height and weight are health data. We ask for your explicit consent before processing them. You can withdraw it at any time in the app or by email; we then delete that data, and the app falls back to default values for the speed calculation.
- Legitimate interest: technical data and anti-cheat checks, to keep the service reliable and results fair.
Who can see your data
- Other riders: during group rides and in ride results, other riders can see your name (your first name and the initial of your last name), your country, your position in the ride, your power (watts and watts per kilogram) and your speed. Your heart rate, age category, height and weight are not shown to others unless you choose to show them in your settings.
- Our hosting provider: our servers are run by netcup in the European Union. They store data on our behalf and may not use it for anything else.
- Google: when we invite you to the Android test, your Google Play email is added to the app's tester list in the Google Play Console, so that Google can let you install the test version. Google's own privacy policy applies to your Google account.
- Our email provider: account emails (the code that confirms your email address and the code to reset a forgotten password) are delivered by Brevo (Sendinblue SAS, France, servers in the European Union). Brevo receives your email address, your first name and the email itself, only to deliver it, and may not use them for anything else. We send no newsletters or marketing emails.
- Services you connect yourself: if a future version lets you export a ride (for example to Strava), data is sent only when you ask for it, under that service's own privacy policy.
- Authorities: only if the law requires it.
We never sell your data and never share it for advertising.
Security
All data between the app and our servers is encrypted in transit (HTTPS). Passwords are stored only as salted hashes. Access to the servers is restricted to the developer.
How long we keep it
- Account details, profile and ride history: for as long as you keep your account.
- An Android test sign-up is kept while the closed test runs, and deleted when it ends or when you ask us to (write to the address below).
- When you delete your account, or a single ride, it is deleted from our systems within 30 days, and from backups within a further 60 days.
- Accounts with no activity for 3 years are deleted, after an email warning.
- Crash reports and technical logs: at most 90 days.
Your rights
You can access, correct, export or delete your data, object to or restrict its processing, and withdraw your consent at any time. To delete your account see Delete your account; for anything else write to the address below. We answer within one month. If you are unhappy with our answer you can complain to your data-protection authority (in France, the CNIL).
Age limit
You must be at least 16 years old to create an account. We do not knowingly collect data from anyone younger; if we learn we have, we delete it.
This website
This website (cyclarena.com) uses no cookies, no analytics, and keeps no access logs.
Changes to this policy
If we change what we collect or how we use it, we will update this page and its effective date, and tell you in the app before the change applies to you.
Contact
Hurfindia
Email: arnaud@jeanroch.fr