offarc: privacy
Last updated: October 2026 (draft)
Who is responsible
Felix Thalhammer, Felseckstraße 22, 6020 Innsbruck, Austria · felix@offarc.cc
The short version
- Solo rides stay on your phone. They need no account.
- Group rides need an account (or a guest account). Other riders in the same ride see your name, colour, level, points, zone and percentage of your maximum heart rate while you ride. If you allow it, they also see your heart rate in bpm and your power in watts.
- Heart rate is health data. We only share it in a group ride after you agreed, and you can limit it to zone and points in Profile > Privacy.
- Rooms are deleted from the server a day after their planned start. You can delete your account in the app (Profile > Delete account); everything it left on the server goes with it. Guest accounts nobody has used for 30 days are deleted.
- We do not sell data and we do not show ads.
What is stored where
| Data | Where | Why |
|---|---|---|
| Name, max heart rate, FTP, colour, settings, ride history, sensor list | Only on your phone | The app itself |
| Account: email address, Google or Apple sign-in identifier, or an anonymous guest id | Firebase Authentication (Google) | Group rides need to know who is who |
| During a group ride: name, colour, level, points, zone, percentage of max heart rate, whether you are ready or paused; with your agreement also bpm and watts; the workout | Firebase Realtime Database (Google), region europe-west1 (Belgium) | To show the riders to each other |
| Group rides you made or joined (ride code and planned start), so they show on every phone you sign in on | Firebase Realtime Database (Google), europe-west1 | To find a planned ride again |
| Only if you ask for a reminder: this phone's notification address (Firebase installation ID) for that ride | Firebase Realtime Database and Firebase Cloud Messaging (Google) | To send the reminder 15 minutes before the start |
| Crash reports (only if you switch them on): device model, system version, the error | Firebase Crashlytics (Google) | To fix bugs |
How long
The server deletes a group ride (and everything the riders published in it) a day after its planned start, or a day after it was made when it was not planned; the phone that created it also deletes it then. A reminder is deleted once it is sent, when the ride is over, or when you switch it off. Deleting your account removes your sign-in and, on the server, the rooms you created, your place in other rides, your list of planned rides and your reminders. Guest accounts that nobody has used for 30 days are deleted the same way. Rides saved only on your phone stay there until you delete the app. Crash reports are kept as long as Firebase Crashlytics keeps them (currently 90 days).
Legal basis
Account, group rides and reminders: performing the service you asked for (Art. 6(1)(b) GDPR). Heart rate and power shared with other riders: your explicit consent (Art. 9(2)(a) and 6(1)(a)), which you can withdraw at any time in Profile > Privacy or by leaving the ride. Crash reports: your consent.
Recipients
Google (Firebase) processes the data for us. Other riders in your ride see what is described above. Nobody else gets it.
Your rights
You can ask for access, correction, deletion, restriction or a copy of your data, object to processing, and complain to your data protection authority. Most of it you can do yourself in the app; for the rest write to support@offarc.cc.
Age
offarc is for people aged 16 and older.
Not a medical app
offarc is for training and fun. It is not a medical device and gives no medical advice. Talk to your doctor before hard exercise if you have a heart condition or take medication that affects your heart rate.