1. Introduction
ECRO ("we," "us," or "our") operates the ECRO Platform, a multi-tenant e-cycling competition management platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.
By using the ECRO Platform, you consent to the data practices described in this policy. If you do not agree with the terms of this privacy policy, please do not access the platform.
2. Information We Collect
Personal Information
We may collect personal information that you voluntarily provide when registering for an account, including:
- Name and display name
- Email address
- Profile photo
- Country/region
- Zwift account information (when connected)
Racing and Performance Data
When you participate in races or connect third-party services, we collect:
- Race results and finish times
- Power output data (watts, W/kg)
- Heart rate data (if provided)
- Rating and category information
- Activity and workout data from connected platforms
- Power curve and racing profile data
Automatically Collected Information
We automatically collect certain information when you access the platform, including device information, IP address, browser type, and usage patterns through cookies and similar technologies.
3. Connected Services
Zwift
The ECRO Platform integrates with Zwift, Inc. ("Zwift") to provide racing and competition features. When you connect your Zwift account, we may receive and process the following data through Zwift's API:
- Racing profile and Zwift ID
- Activity data from completed workouts and races
- Power curve data (historical best efforts)
- Racing score and performance metrics
- Live event data and segment results
Your Consent: By connecting your Zwift account to ECRO, you explicitly consent to the transfer and processing of your Zwift data as described in this policy. You may disconnect your Zwift account at any time through your account settings.
Zwift's collection and use of your data is governed by Zwift's own Privacy Policy, available at support.zwift.com.
Garmin and Wahoo (dual recording)
You can connect a Garmin Connect or Wahoo account under Account › Connections so that a ride you record on your own head unit or watch during an ECRO race becomes your dual recording. When you connect, we receive:
- Your Garmin or Wahoo user ID and the access tokens needed to receive your rides
- For rides you record after connecting (and, for Wahoo, rides from the last 30 days when you press "Check recent rides"): the activity file and its summary, including time, power, cadence, heart rate, speed, distance, the device name and, if your device recorded it, location
How we use it: only to match a ride to an ECRO race you entered and compare its power with your Zwift result, so you and race officials can confirm the result is genuine. Rides that do not overlap an ECRO race are not kept. The comparison is shown on your race page and to race officials.
What we never do: we do not sell Garmin or Wahoo data, share it with other riders, teams or organizers beyond the comparison above, or use it for advertising. Garmin and Wahoo data is never processed by AI systems, and never used to train, test or improve any AI model.
Who processes it: Vercel (application hosting) and Google Cloud / Firebase (database and file storage) process this data on our behalf. No other third party receives it.
Withdrawing consent: disconnect at any time under Account › Connections, or remove ECRO from your Garmin Connect or Wahoo account settings. When you disconnect, we delete your access tokens and stop receiving rides. Rides already matched to an ECRO race stay with that race as part of its verification record, the same as a file you upload yourself. To have them erased, email support@ecro.app and we will delete them. They are also deleted when we delete your ECRO account at your request.
Garmin's and Wahoo's own handling of your data is governed by their privacy policies at garmin.com/privacy and wahoofitness.com/privacy.
The ECRO app and the dual recorder
The ECRO app (Android and iPhone), and the recorder on ecro.app in a supported browser, can record your own power meter and heart rate monitor over Bluetooth during an ECRO race, so that recording becomes your dual recording. When you record, we collect:
- Each second's power, cadence and heart rate from your sensors, with the time it was recorded
- Your sensors' details: manufacturer, model, name, serial number, firmware and hardware versions, battery level, the Bluetooth id your phone gives the sensor, and the features the sensor reports
- If you connect your smart trainer too, its power each second and the same details about it
- Gaps in the recording (for example a sensor that dropped out), and your phone or browser type
While you ride, the app sends your recording to ECRO each minute, so a phone that runs out of battery or a forgotten upload loses nothing. If you don't upload it yourself, we save what was sent as your recording two hours after it stops. Recording happens only when you start it: the app does not use Bluetooth or record anything otherwise, and it never uses your location.
How we use it: only to compare your recording with your Zwift result, so you and race officials can confirm the result is genuine. Sensor details let officials see which device recorded each file. The comparison is shown on your race page and to race officials.
What we never do: we do not sell recordings, share them with other riders, teams or organizers beyond the comparison above, or use them for advertising. Recordings are never used to train AI models.
Who processes it: Vercel (application hosting) and Google Cloud / Firebase (database and file storage).
Deleting it: a recording is kept with its race as part of the verification record. Delete it by deleting your account under Account › Settings › Delete account, or email support@ecro.app.
4. How We Use Your Information
We use the information we collect to:
- Create and manage your account
- Process race registrations and results
- Calculate ratings, rankings, and standings
- Facilitate team management and contracts
- Display public leaderboards and race results
- Communicate with you about races and platform updates
- Enforce competition rules and fair play policies
- Improve and optimize the platform
- Comply with legal obligations
5. How We Share Your Information
Public Information
Certain information is publicly visible on the platform by design, including:
- Display name and profile photo
- Race results and standings
- Team affiliations
- Category and rating information
Competition Organizers
When you participate in a competition, the organizer of that competition may access your registration information, race results, and performance data for the purpose of managing their events.
Service Providers
We share information with service providers who perform services on our behalf and are contractually obligated to protect it:
- Vercel: application hosting and site analytics
- Google Cloud / Firebase: database, file storage, sign-in, and the AI services described below
- Railway: hosting for our Discord bot
- Twilio SendGrid: email delivery
- Stripe: license payments (we never see your full card details)
- Discord: our community server and race notifications
- Sentry: error monitoring
Garmin and Wahoo ride data is processed only by Vercel and Google Cloud / Firebase, as described in Section 3.
AI Transparency Statement
We use AI services from Google (Gemini) for specific features: reading equipment verification photos, answering support tickets, and narrating transfer market news. ECRO admins can also query league data, such as race results and standings, through an AI assistant (Anthropic's Claude). These features use your account, race and support data, not ride files from Garmin or Wahoo, which are never processed by AI systems. Equipment photos can be approved or rejected automatically from the AI reading; you can always resubmit, or ask support@ecro.app for a person to review the decision. Your data is not used to train AI models. To object to AI processing of your data, contact support@ecro.app.
Legal Requirements
We may disclose your information if required by law, court order, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
6. Data Retention
We retain your personal information for as long as your account is active or as needed to provide you services. Race results and historical performance data may be retained indefinitely to maintain the integrity of competition records.
Ride files received from Garmin or Wahoo that were matched to an ECRO race are kept with that race as part of the competition's verification record, until you ask us to erase them or we delete your account at your request. Rides that did not match an ECRO race are never stored.
You can delete your account under Account › Settings › Delete account (details at ecro.app/account-deletion), or ask us to delete your account and personal data at any time. However, we may retain certain information as required by law or for legitimate business purposes, such as maintaining historical race records.
7. Your Rights
Depending on your location, you may have certain rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate personal data
- Deletion: Request deletion of your personal data
- Portability: Request transfer of your data to another service
- Objection: Object to certain processing of your personal data
- Withdraw Consent: Withdraw consent for optional data processing
To exercise these rights, please contact us at support@ecro.app.
8. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that are different from the laws of your country. We take appropriate safeguards to ensure your personal data remains protected in accordance with this Privacy Policy and applicable law.
9. Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
10. Children's Privacy
The ECRO Platform is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn we have collected personal information from a child under 13, we will delete that information promptly. If you believe we have information from or about a child under 13, please contact us.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.
12. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
ECRO
Email: support@ecro.app