1. Who is responsible for your data
Wattson is operated by Luke Parsons in Barcelona, Spain ("Wattson", "we", "us", or "our"). For privacy questions or requests, email wattson@luke.ac.
This policy applies to wattson.club, the
Wattson iOS app, the Wattson API at api.wattson.club, and the hosted integration
surfaces at mcp.wattson.club.
2. Data we process
Account and authentication data
Wattson signs you in with Apple or Google. We receive and store the identifiers needed to create and secure your account: your provider account identifier, your email address and whether the provider reported it as verified, your display name, your sign-in times, and hashed or opaque session credentials. We never receive your Apple or Google password. If you authorise a hosted integration (such as a connected chat client or command-line tool), we store the OAuth client registration and the session scopes you granted.
App Store reviewers may sign in with a shared reviewer account. That account is seeded demo data and is not linked to a personal identity.
Rider profile and training data
We store the profile you set up in the app and the training content tied to it: your rider display name, your FTP, your athlete weight, your derived power zones, any goals, constraints and training preferences you record, your workout library with its revision history, and your current plan and scheduled sessions.
Ride recordings
When you finish a ride, the app uploads the completed recording to your account. That includes the ride's start and end times, its duration, the workout it followed, and the recorded telemetry — elapsed time, power, cadence, heart rate, speed and distance — together with derived summary metrics and a generated FIT file kept as a ride artifact. Indoor rides recorded by Wattson do not include GPS co-ordinates.
Connected Strava data
Strava is optional and off until you link it. If you link it, we store your Strava athlete identifier, username and display name, the scopes you granted, and the access and refresh tokens (with their expiry) needed to act on your behalf.
With your authorisation, Wattson writes your completed Wattson rides to Strava as activity uploads, and reads from Strava only what the feature you use needs. Depending on the feature, that can include your activity list and individual activities, their data streams (time, power, heart rate, cadence, distance, elevation and GPS co-ordinates), your activity power and heart-rate zones, your segment efforts, your starred segments, and your saved routes. GPS co-ordinates from your outdoor Strava rides are processed when you ask Wattson to turn a ride, a segment or a route into a simulated climb.
Wattson only ever reads data from the Strava account you linked. You can unlink Strava in the app's connection settings, and you can revoke Wattson's access from your Strava account settings at any time.
Training chat
When you use Chat, we process the messages you send, the context sources you switch on (your profile, your workout library, your Wattson ride history, and your Strava rides), and the tool calls needed to answer — for example looking up a climb, building a course, or saving a workout to your library. Your conversation history is stored on your device; the server keeps a short-lived record of each in-flight chat run and prunes it after about 24 hours.
Subscription data
Where Wattson offers a paid subscription, purchases are made through the Apple App Store. We receive Apple's signed transaction information and keep one entitlement record per account holding the product identifier, the subscription status, and the renewal or expiry date. We never receive or store your card or bank details; Apple handles payment.
Data that stays on your device
Some data is only ever held locally on your iPhone or iPad and is never sent to us: the Bluetooth trainer and heart-rate monitor you pair with and their live telemetry during a ride, your preferred trainer, in-progress ride recovery state, your chat conversation history, your last-used sign-in hint, and any ride cards or clips you choose to save to Photos. Deleting the app removes these local copies but does not by itself delete your account data.
Diagnostics and support data
Our servers keep operational records needed to run the service: request and error logs, request identifiers, failed-upload and retry state, and any messages you send us for support.
3. How we use data and our legal bases
- Provide the service and perform our contract: authenticate you; store and sync your profile, workout library, plans and ride history; scale workout targets to your FTP; accept and process completed rides; produce FIT files; build courses and climbs you ask for; answer your chat messages; manage subscription entitlements; and provide requested support.
- Legitimate interests: keep Wattson secure and working; prevent abuse; diagnose ride, upload and sync failures; and control third-party provider costs.
- Consent: link your Strava account, enable individual chat context sources, use Bluetooth to connect your trainer and heart-rate monitor, and save ride media to your Photos library. You can withdraw a device permission in iOS Settings and unlink Strava in the app.
- Legal obligations and claims: comply with law, respond to valid legal requests, and establish, exercise or defend legal claims.
We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use your training data to train third-party AI models beyond what is needed to answer the request you made.
4. When data is shared
We share data only as needed to operate Wattson, comply with law, or complete something you asked for. Recipients can include:
- Sign-in providers: Apple and Google, for authentication.
- Strava: when you link it, to upload your rides and read the data described above.
- OpenAI: training chat runs on OpenAI's API. Your message, the context you enabled for that conversation, and the tool results needed to answer are sent to OpenAI for processing.
- Apple: for subscription purchase verification and App Store server notifications.
- Hosting and infrastructure: Hetzner, which hosts our servers and database in Europe, managed through Coolify.
- Course and map lookups you request: when you ask Chat to build a course from real roads or a place name, the relevant place names or co-ordinates are sent to OpenStreetMap Nominatim (geocoding), OSRM (routing) and Open Topo Data (elevation). If you paste a public GPX link or a myCols or climbfinder climb link, we fetch that link server-side on your request.
- Authorities or transaction parties: when required by law, necessary to protect rights and safety, or involved in a reorganisation, financing, acquisition or transfer of the service, subject to appropriate safeguards.
These providers process data under their own terms and data-processing arrangements. Do not put content into Chat that you are not comfortable having processed by the providers needed for the feature you invoke.
5. Storage on your device
The Wattson app stores data locally so it can work offline: your downloaded workout library, in-progress and completed ride recordings awaiting upload, paired-device memory, chat history, and your preferences. The website uses no cookies or local storage beyond what the browser needs to load the page. Deleting the app or clearing site data removes local copies but does not delete account data held on our servers.
6. Retention and deletion
- Your account, rider profile, workout library, plans, ride recordings, telemetry and FIT artifacts are kept while your account exists, or until you delete the individual item.
- Sign-in sessions are kept until they expire, you sign out, or you delete your account. Stored session credentials are hashed.
- Server-side chat-run records are pruned after about 24 hours.
- Operational logs and diagnostic records are kept only as long as needed to run and secure the service, or as law requires.
Deleting your account
You can delete your Wattson account from inside the app, at Settings → Account → Delete account. Opening that screen deletes nothing: it explains exactly what will be removed, then asks you to type a confirmation word and accept a final confirmation. You can cancel at either point, and cancelling leaves your account untouched.
When you confirm, we:
- delete your account record, rider profile, workout library, plans, scheduled sessions, ride recordings, telemetry, FIT artifacts and Strava upload receipts, and your chat history with the training assistant;
- invalidate your sessions and any hosted integration credentials issued to your account;
- delete the Strava access and refresh tokens we hold and stop making requests to Strava on your behalf;
- revoke the Sign in with Apple token associated with your account where Apple requires it;
- clear account-specific data on the device and return you to a signed-out state.
Deletion happens immediately when you confirm, and it is a deletion rather than a disabled account — there is no reactivation path. We do not keep a copy for legal, dispute or anti-abuse reasons. Operational server logs can mention the deletion request for a short period before they rotate out.
Two things are outside our control. Rides that Wattson already uploaded to Strava remain in your Strava account — delete those activities in Strava, and revoke Wattson's access from your Strava settings. Subscriptions purchased through the App Store are managed by Apple; cancel the subscription in your Apple account settings, because deleting your Wattson account does not cancel Apple billing.
If you cannot reach the in-app action, email wattson@luke.ac and we will delete the account after verifying that the request relates to it.
7. International transfers
Wattson is operated from Spain and our servers and database are hosted in Europe. Some providers — including Apple, Google, Strava and OpenAI — process data in the United States or other countries. Where required, we rely on recognised transfer mechanisms such as adequacy decisions, standard contractual clauses, or another lawful safeguard. Those countries may have different data-protection laws from your own.
8. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing; to receive a portable copy of the data you provided; and to withdraw consent without affecting earlier lawful processing. You may also have the right to complain to a data-protection authority.
You can exercise most of these directly in the app: edit your profile and FTP, delete individual workouts and rides, unlink Strava, switch off chat context sources, and delete your account. For anything else, email wattson@luke.ac. We may need to verify that the request relates to your account.
If you are in Spain you may complain to the Spanish Data Protection Agency (AEPD); if you are elsewhere in the EEA or the UK, you may contact your local authority.
9. Security
We use measures designed to protect your data, including encrypted network transport, access controls scoped to the signed-in account, hashed session tokens, server-side custody of third-party API keys so they never ship in the app, and separate production and development storage. No system is completely secure, so we cannot guarantee absolute security.
10. Children
Wattson is a structured training tool and is not directed to children under 13. If you are under the age at which you can lawfully agree to online data processing where you live, a parent or legal guardian must authorise your use. If we learn that we collected a child's data without the required authorisation, we will take reasonable steps to delete it.
11. Changes to this policy
We may update this policy as Wattson, our providers, or the law changes. We will post the revised policy here with a new effective date, and for material changes we will provide additional notice where reasonably possible.
12. Contact
Privacy questions and requests can be sent to wattson@luke.ac.
Wattson
Luke Parsons
Barcelona, Spain