Privacy

Privacy

Last updated 29 April 2026.

TL;DR. Erg3D is local-first. Your workout data, ergometer readings, and settings live on your device by default. If you create an account, we sync only what you ask us to. We don't sell your data, we don't run ads, and the desktop app contains zero third-party analytics or trackers. The marketing site at erg3d.com uses one privacy-respecting analytics tool (Umami, self-hosted) and a contact form.

This page covers the Erg3D desktop app (Windows, macOS) and the marketing site.

What stays on your device

When you use the desktop app without signing in:

  • BLE readings from your Concept2 RowErg (stroke rate, pace, watts, distance, time)
  • Your workout history
  • Your settings, customisations, and which 3D world you last picked

None of that leaves your computer. There's no anonymous telemetry, no crash reporter that pings home, no "improve our product" toggle hiding in settings.

If you never sign in, we never see anything you do in the app.

What we collect if you create an account

Account creation is optional. Anonymous downloads work without one.

If you sign up:

  • Your email address. Sign-in is passwordless: we email you a one-time link.
  • A user ID the auth system generates for you.
  • Workout sessions you choose to sync. Cloud sync is opt-in per session.
  • Sign-in events (timestamp, IP address, refresh-token rotation), kept for 30 days for account-security reasons, then dropped.

Everything else stays local.

Your profile (display name, gender, age bucket, country) is stored on Erg3D's servers so it can sync across your devices and appear in races. You can set your profile visibility to Private (default) or Public on the Account page. Bot players never have profile data stored.

What we don't collect

  • No location, contacts, microphone, camera, accelerometer, or browser history.
  • No analytics or telemetry inside the desktop app.
  • No tracking pixels, no third-party advertising, no fingerprinting.
  • No data when you're not signed in.

How we use what you give us

Three things, that's it:

  1. Run your account. Log you in, sync the sessions you choose, let you reset your password.
  2. Keep the service running. Throttle abuse, debug a broken sign-in, restore your data if a server falls over.
  3. Reply to you. If you contact support, we read what you wrote.

We don't profile you, target ads at you, train models on your data, or sell anything.

Who touches your data

The Erg3D backend is self-hosted, which means most of your data sits on infrastructure under our direct control. Outbound email (password resets, sign-in confirmation) is also sent from our own servers. There's no third-party email vendor in the loop.

Two outside companies do see slices of it:

  • Hetzner Online GmbH (Germany). Runs the cluster the auth and sync servers live on.
  • Cloudflare, Inc. (US). DNS and the encrypted tunnel that fronts our servers. Cloudflare can see TLS-terminated traffic but doesn't store request bodies.

Self-hosted Supabase, the auth software we run, is open-source code on our servers. Supabase the company is not a processor. They don't host or see your data.

Your controls

  • Export your data. Email us; we'll send you a JSON dump of your account and synced sessions within 30 days.
  • Delete your account. Same channel. Account and synced sessions are erased within 30 days. Sign-in logs roll off on their own 30-day cycle. Local files on your computer are yours to delete.
  • Find your local files. Windows: %APPDATA%\Erg3D. macOS: ~/Library/Application Support/Erg3D. Delete the folder, the app forgets everything.
  • Stop the marketing-site analytics. Block analytics.e-labs.pt in your browser, or use any ad blocker. We never set cookies for analytics, but the request still reaches us; a block stops that.

If you're in the EU, UK, or California, the rights above cover what GDPR and CCPA give you (access, deletion, portability, objection). If you want them in formal language, contact us and we'll handle it case by case.

Security and what we can't promise

We use TLS everywhere, encrypt data at rest, hash passwords with bcrypt, and keep the access surface tight. We don't run a bug bounty yet, but we read every report seriously: [email protected].

No internet service is fully secure. If a breach affects you, we'll tell you within 72 hours of confirming it.

Self-assessment tests

Erg3D includes a short self-assessment that estimates your sustainable 30-minute power (Threshold Power) from the data your erg already streams. It is an estimate derived from your warm-up, not a medical reading. We do not infer health conditions, we do not surface lab numbers, and we never claim an age guess.

Heart rate, when a strap is paired, is used live on-screen during the test. Only per-stage aggregates — mean, max, drift — sync to the cloud if you have cloud sync on. The raw 1 Hz waveform stays on your device unless you turn on the "keep raw HR for export" setting (off by default).

Anonymous kiosk results live under a six-character short code at erg3d.com/r/<code> for 90 days, then auto-purge. Claiming a result to your account before that window expires moves it into your normal session history under the standard retention rules above.

Children

Erg3D isn't aimed at children under 13 (or under 16 in the EU). If you think a child has signed up, email us and we'll delete the account.

Contact and changes

Questions, deletion requests, security reports: [email protected].

If we change this page in a way that affects what we collect or who touches it, we'll email account holders before the change takes effect. Smaller edits, fixing a typo, adding a clarification, go in silently with the date at the top updated.

Ergon Labs, Lda · NIPC 519225112 · Portugal