Privacy

Who is responsible

The controller under the GDPR is Eckhard Völcker, Driessenstraße 8, 83707 Bad Wiessee, Germany — see the imprint. He is also your contact for privacy matters. An informal message to info@vfworks.com is enough for any question or to exercise your rights.

Part A — Public pages, no account

No tracking, no advertising cookies

These pages embed no analytics or advertising services — no Google Analytics, no pixel, and no consent banner, because there is nothing to consent to. Fonts are served from our own domain so your browser never contacts Google while you read. We set exactly two cookies, both for you rather than about you: if you have signed in to the app, your own sign-in session lives as a cookie on our domain — the public pages read it solely to show YOU your own numbers; without signing in that cookie does not exist. The second one remembers your unit system — kilometres or miles, explained in the next section. Third-party tracking never takes place either way.

Units and your country

So that kilometres or miles fit you without being asked, your browser asks us once on your first visit which country your request comes from. The answer is the country code our hosting provider technically attaches to every request anyway — we run no additional service for this, evaluate no IP address ourselves, and store or log nothing in the process. Only the unit system derived from it is remembered by your browser as a cookie (zrg_units) on our domain; that is not a location — a country is not a place. If you pick your units yourself using the switch, your choice applies permanently and beats any automatic guess. Signed in, we additionally store the chosen unit in your account so it follows you to every device; deleting the account removes it too. The legal basis is our legitimate interest in an intelligible display (Art. 6(1)(f) GDPR).

Server logs

As with any web server, a technical log entry is created when you load a page: IP address, timestamp, the address requested, browser identification. These entries arise at our hosting providers, serve operation and attack defence, and are deleted there automatically after a short period. The legal basis is our legitimate interest in running a working, secure service (Art. 6(1)(f) GDPR).

The calculators on these pages

The calculators in the Tool Lab, such as the W/kg calculator, Segment Lab and Bike Lab, compute inside your browser. Whatever you type into a slider stays there — nothing is transmitted and nothing is stored. The comparison curves rest on pre-aggregated, anonymous distributions drawn from public Zwift racing profiles; no individual rider is contained in them or recoverable from them.

GPX and FIT files

When you upload a recording it is read and processed inside your browser. The file is never transmitted to us. Your GPS track — where you actually rode — does not leave your device. Even what we store about a segment is deliberately coordinate-free: length, gradient and elevation profile, but no position.

Map view in the race calendar

The race calendar first shows a small overview map that we serve ourselves — country outlines and markers, no external service. Only when you choose “Open map” does your browser load the interactive map: the MapLibre GL library from the jsDelivr content network (Prospect One, Poland) and the map tiles, fonts and icons from OpenFreeMap (a non-profit community project). Technically these two providers then receive your IP address, browser details, the referring page and the addresses of the requested map tiles — zooming and panning loads new tiles continuously, which reveals the area you are looking at. Your own location is never requested; the races themselves live in our data, not in the tiles. No cookies are set and nothing from your account is transmitted. Without that click no data reaches these providers. The legal basis is our legitimate interest in a spatial view that you trigger yourself (Art. 6(1)(f) GDPR). We are working on serving the tiles ourselves; this section will disappear once that is done. Map data © OpenStreetMap contributors (ODbL).

Feedback

The feedback box lets you write to us without signing in. We store your text, the category, a timestamp and — only if you attach them yourself — a screenshot and an e-mail address for our reply. Without contact details the report is anonymous. The basis is your voluntary submission; you can ask us to delete it at any time.

Club Discord coupling

Clubs can connect their internal Discord server to the club RaceHub. Our bot then posts race polls, confirmed lineups (with the names of the riders lined up) and captain-triggered scout comparison tables into the channel the club chose — Discord (Discord Inc., USA) processes these messages under its own terms, so your details may be transferred to a third country. If you reply in Discord via button, we store your reply (yes/reserve/no or spot confirmation) exactly as if you had clicked it on the platform. For the mapping we store your Discord account ID in your club's member list; a link is only created by your own action (your click, /link) or set up by your captain with you. You can remove the link at any time via your captain or the address above; deleting your account removes it as well. The legal basis is running the club's racing operations (Art. 6(1)(b) GDPR).

Club applications (e.g. DNSTY)

Some clubs on this platform accept applications through a form — today that is DNSTY. It includes your Zwift ID (required: without it the club cannot activate you), an e-mail address for the reply, and the club's form fields such as an introduction, your goal and your sponsor on the team. We store this application with us so the club's officers can review it and activate you; the legal basis is initiation of the membership (Art. 6(1)(b) GDPR). In addition the club is notified by a message into its internal Discord channel — Discord (Discord Inc., USA) processes that message under its own terms, so your details may be transferred to a third country. If your application is declined we delete the free-text fields and contact address after the decision; you can request deletion at any time via the address above. ZRG-R does not accept applications through the platform.

Club requests to the platform

To bring a club onto the platform you fill in a form on the Club RaceHub page. We collect details about the club (name, tag, ZwiftPower team ID, colour, rough squad size, race formats, logo address), about the person asking (name, Zwift ID, e-mail address) and a free-text motivation. We store the request in order to review it, ask follow-up questions and, where applicable, create the club; the legal basis is initiation of the usage relationship (Art. 6(1)(b) GDPR). If the request is declined we delete the motivation text, the e-mail address and the contact person's details; only the fact that the request existed is kept. You can request deletion at any time via the address above.

Part B — Account, Zwift ID and club

The account

An account needs an e-mail address and a password. Sign-in runs through Amazon Cognito in the Frankfurt region (eu-central-1); we never see your password. The purpose is to provide the personal functions, the legal basis is performance of the user relationship (Art. 6(1)(b) GDPR). Delete the account and the associated profile data goes with it.

What the account record holds

A few items belong to the account itself, and we name them for completeness: display name and e-mail, how you sign in (e-mail or Google), your language, when you linked your rider, your last sign-in and how many times you have signed in, your role (rider or admin), and the record of when you acknowledged this policy and which version of it. The sign-in figures serve operations — we build no usage profiles from them and do not analyse them for behaviour.

The acknowledgement record is our obligation, not your burden: it holds which version of this policy you read. If we change it substantively we ask again — and the earlier record stays alongside, so it remains traceable what applied when.

Your Zwift ID and what comes with it

If you link your Zwift ID we fetch your publicly visible racing profile: display name, category, number of races, best efforts across several durations, weight and the figures derived from them. All of this is already public — we retrieve it, organise it and compute with it; we do not uncover anything hidden. You authorise the link yourself, and without it the personal functions simply stay empty.

We refresh your profile when you use the tools and the data is more than a week old — never speculatively. If you stop coming back, we stop fetching.

Two roles: club rider and solo rider

With an account you are one of two things, and the server decides which — never the page in your browser. As a club rider you are on your club's roster: your racing numbers, entries and team assignments are visible to your club-mates and theirs to you — that is what a club is for. As a solo rider the service is an analysis for you alone: you receive your own entry and nothing else, the club's rider list is never sent to you, and no club member sees your numbers either.

The distinction runs through everything: the rider views, the season poll (solo sees only their own answer plus a bare total), the personal layer on the public pages — and feedback, which when signed in carries your name and role.

Race entry, season poll and teams

Inside the club you record whether you are starting a race, whether you want to ride a season and which team you are on. These entries are club-internal and serve the line-up. Your identity always comes from your sign-in token, never from something the page claims — you cannot file an entry for somebody else.

Your garage in the Bike Lab

In the Bike Lab you can build a garage: your favourite frames with their upgrade stage and your wheelsets. Without signing in this list lives solely in your browser (localStorage) and never leaves your device. Signed in, you can save it to your profile — it then sits in a protected area of our storage assigned to you alone and follows you across devices. It is in-game material (virtual bikes), not sensitive data; we store only the list itself plus a timestamp. Delete your account and the garage goes with it.

Connecting intervals.icu

You may voluntarily connect your account to intervals.icu. You grant that authorisation at intervals.icu itself; all we keep is the access key, held in a protected area that is never delivered to a browser. The connection lets us write workouts to your training calendar and read your rides (such as power, heart rate and cadence) and your training settings. We use this data to build your performance profile and calibrate your values, to analyse races, for training, tactics and line-ups in your club — club leadership (such as the captain and tactics team) sees the values derived from it — and for further platform features serving these purposes. We store figures derived from it, not complete raw recordings.

We read health data (wellness values such as resting heart rate, heart-rate variability, sleep or weight history) only if you tick a separate, explicit box when connecting (Art. 9(2)(a) GDPR), and only for the purposes above. This consent is voluntary; you can withdraw it at any time by disconnecting or reconnecting without that box.

If you disconnect, the key is deleted, access ends immediately and the derived values are removed, except where they are needed for club analyses already produced. Everything still works without a connection — you simply download workouts as files.

Your race, live

During a Zwift race, our live features show you what is happening in your start group. We combine the race itself with what public race results say about the riders. For this we process the following data.

Access to the live data. To receive the races of your start group, you store the credentials of a Zwift account of your own that you do not ride with. They are kept encrypted in a protected area that never reaches a browser, and we use them only for races you open. Delete them and access stops at once. The legal basis is performance of the user relationship (Art. 6(1)(b) GDPR).

Live data during a race. During a race we receive position and performance values of the riders in your start group, for example distance, speed, power and draft, and send them to your device in processed form. On our server this data is held in memory only and is not stored. All we keep from a race are features of the course with no link to any person, such as where a scoring line is.

Data about other riders. For the riders in the field we show figures from publicly visible race results and Zwift profiles, such as power values, category and ratings. Weight or age group from the Zwift profile are displayed but not stored. Health-related values like heart rate are processed in memory only and only in derived form, for example as a hint that someone is at their limit. The value itself is neither shown nor stored. In public races, riders make their heart rate public themselves through Zwift, for instance in the results on ZwiftPower (Art. 9(2)(e) GDPR). The legal basis for the display is our legitimate interest in giving race participants a picture of the race (Art. 6(1)(f) GDPR).

Your settings. How you set up your cockpit, meaning which displays and alerts you see, is saved in your profile. That way it looks the same on every device.

Operation. The live features run with hosting providers, mainly in data centres in the EU. The connection to your device is encrypted and goes through a service that delivers and protects web content. The live data itself comes from Zwift. The providers we currently use are listed below under “Who receives data”.

Information you give voluntarily

Some functions and programmes are voluntary, for example if you want to try new features early. In that case we ask for a few details about you, such as region, age group and interests, and have you confirm that you meet the required minimum age. We use these details to shape and improve the service, and they are kept with your account. You can leave at any time; we then delete the details as far as we no longer need them. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Paid features

We may offer individual features for a fee. If you buy one, we process what is needed for the purchase, billing and activation. The payment itself is handled by a specialised payment provider, and we never see your full payment details. The legal bases are performance of the contract (Art. 6(1)(b) GDPR) and our statutory retention obligations (Art. 6(1)(c) GDPR).

No AI profiling

Every number on these pages comes from formulas with named sources — physics, statistics, published models. There is no automated decision-making and no profiling within the meaning of Art. 22 GDPR, and no AI model is trained on your data.

Who receives data

To run the service we work with providers from these areas: hosting and data centres, delivery and protection of the website, sign-in, email delivery and, for paid features, payment processing. They process data only on our behalf and according to our instructions (Art. 28 GDPR). Where a provider is based outside the EU or may transfer data there, we rely on an adequacy decision such as the EU-US Data Privacy Framework or on standard contractual clauses (Art. 45, 46 GDPR). We may switch providers within these areas. On top of that come services that are only involved in individual functions. The table shows the ones we currently use.

We do not sell data, we run no advertising and we pass nothing to ad networks.

How long we keep things

Account and profile data stay as long as your account exists — including the garage. Entries and team assignments stay as long as the planner carries that season. Access keys for intervals.icu vanish when you disconnect. Feedback is kept until it is dealt with. Club applications stay until the decision; on rejection we delete the free text and contact address. Server logs are deleted by the hosting providers after a short period. Live data from races is not stored at all. Credentials for the live data stay until you delete them, voluntary details until you leave.

Your rights

You can ask what data we hold, have it corrected or deleted, restrict its processing, receive it in a portable format, and object to processing based on legitimate interest. An informal message is enough; we need no proof beyond your account. You may also complain to a data protection supervisory authority.

You can delete the account yourself inside the app. That removes your profile, the link and the associated personal storage. Records of races already run may remain in the club's season history — tell us if you want those gone too.

What we are currently cleaning up

The link between your account and your Zwift ID is currently also stored in our internal source-code repository. Only we can access it; it is not public.

This statement describes the service's actual data flows and is updated whenever they change. A legal review is planned before broad marketing begins.