Beta · Effective 3 October 2026

Privacy Policy

1. Who we are

openpack is an indoor cycling game played in the browser with a smart trainer, power meter or keyboard. It is operated by [operator name] (“openpack”, “we”, “us”), the controller of the personal data described here. Questions or requests: [contact email].

openpack is in beta. Features change often; when what we collect or how we use it changes, we update this page first (see section 13).

2. What we collect

When you ride without an account (as a guest)

• The rider name you choose, and a random guest ID, so other riders in the same ride can see who you are.
• Live ride data while you ride with others: your position on the route, speed, power, cadence and whether you are drafting, shared with the riders in your room so they can see you. It is held in memory for the ride, not stored.
• Your device's IP address, which every web request carries; we use it to deliver the game and to limit abuse (for example, too many sign-in attempts).
• Your settings and the rides you save as a guest stay in your browser's storage, on your device. We don't receive them.

When you create an account

• Email address: to sign you in (by a 6-digit code we email, or by Google) and to identify your account.
• Rider name and a friend code others can use to add you.
• Settings you choose to keep across devices: units, display, rider and bike appearance, controller setup, and the riding numbers the game uses, such as your weight and FTP (functional threshold power). We also keep a short history of the weights you enter, to set a fair race weight.
• Saved rides: a FIT activity file of each ride (time, distance, speed, elevation, your position on the route, power, cadence, and heart rate if you connect a heart rate monitor), and a summary of it.
• Progress: lifetime totals (rides, time, distance, climbing, energy), level, streaks and badges.
• Friends you add and requests between you; segment times you set; scheduled rides you create or join.

Sign in with Google

If you choose “Continue with Google”, see section 4 for exactly what we receive from Google and how we use it.

Apps you connect (optional)

If you connect Strava or intervals.icu, we keep the access they give us (Strava's sign-in tokens, or the intervals.icu API key you enter), encrypted, and the name of the connected account. We use it only to send your finished rides there and, for intervals.icu, to read the planned workouts you ask for.

Routes you import or draw

A GPX or FIT file you import, or a route you draw on the map, is sent to our server, which builds a world from it and keeps the route so you, and anyone you share the ride's link or code with, can ride it. A route file can contain the real-world places it passes through. Routes are stored without your name or account.

Your trainer, power meter, heart rate monitor and controllers

The game talks to them over Bluetooth directly from your browser (in the OpenPack app for iPhone and iPad, through the app on your device). Their readings are used on your device to drive the game; they reach us only as part of the live ride data and saved rides described above.

Error reports

Visit counts. We count visits with Umami, which runs on our own server, not a third party's. It records the page, the site that sent you, the browser, operating system, device type, screen size, language and country, and a few game events (a ride started and in which mode, a device paired, a sign-in, a ride finished and roughly how long). It sets no cookies and stores no IP addresses; visits are told apart by a short-lived identifier that can't be turned back into your address or browser, and can't follow you to other sites. If your browser asks sites not to track you (Do Not Track), you aren't counted.

When the game hits an error in your browser, it sends us the error message, where in our code it happened, the page, and the kind of device, browser and graphics chip (for example “iPhone, Safari, Apple GPU”), so we can fix it. Reports carry no account, name, email or address, are rate-limited, and are kept only in our short-lived server logs.

Cookies and storage on your device

We use one cookie to keep you signed in (op_session, for up to 60 days) and, while a Google sign-in is in progress, one short-lived cookie (op_google, 10 minutes) that protects it. The game also keeps your settings and saved rides in your browser's local storage. There are no advertising, analytics or third-party tracking cookies.

3. How we use it

• To run the game: build routes, ride with others, show you your rides, progress, friends and boards, and keep your settings on every device.
• To sign you in and keep your account secure, including limiting abuse.
• To send the sign-in codes you ask for. We don't send marketing email.
• To send your rides to apps you connect, when you connect them.
• If you use Ask your rides (paid plan): to read the question you type, which our server then answers from your own rides.
• To fix problems and keep the service running.

We don't sell or rent your personal data, show you ads, build advertising profiles, or use your data to train AI or machine-learning models.

Legal bases (for the EEA, UK and similar laws): providing the service you asked for (your account, rides and multiplayer); our legitimate interests in keeping openpack secure and working; and your consent where you give it (connecting an app, signing in with Google), which you can withdraw at any time.

4. Google user data

When you sign in with Google, openpack asks Google only for the basic sign-in scopes openid, email and profile. From Google we receive your email address, whether Google has verified it, your name, and an account identifier.

• How we use it: the verified email address finds your openpack account, or creates one (the same account an emailed code to that address opens). For a new account, your first name becomes your rider name, which you can change at any time. The account identifier is only checked during sign-in.
• What we store: your email address and rider name, as part of your openpack account. We do not store Google access tokens, refresh tokens or your Google account identifier, and we never ask for access to your Google contacts, Gmail, Drive, calendar or any other Google data.
• Sharing: we don't share, sell or transfer Google user data to anyone, and we don't use it for advertising or to train AI or machine-learning models. Your rider name is shown to other riders as described in section 5; your email address is never shown to them.
• Removing it: deleting your openpack account removes your email address and everything the account keeps. You can also remove openpack's access at any time in your Google Account, under Third-party apps & services.

openpack's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. What other riders see

• Riders in the same ride see your rider name, your bike and kit, and your live position, speed, power and cadence.
• Friends see your rider name and the route you are riding now, so they can join you.
• Segment boards show your rider name and time when you set one with an account.
• Scheduled rides show the rider names of who is in.

Your email address, weight, heart rate and saved ride files are never shown to other riders.

6. Who else handles data

• Service providers that run openpack for us under contract: hosting for our servers and database, and an email delivery service for sign-in codes. They may use the data only to provide that service to us.
• Map and elevation services. To build a route's world, our server requests map data, place search results, routing and elevation for that area from public map services (OpenStreetMap's Overpass API, OpenFreeMap, Photon by Komoot, BRouter, and open terrain elevation data hosted on Amazon Web Services). These requests carry the area's coordinates or the place you searched for, not your name, email or account. Map data © OpenStreetMap contributors.
• Fonts. The game loads its fonts from Google Fonts, so your browser sends Google its IP address when fetching them, as with any web request.
• TypeSafe (Ask your rides, paid plan). When you ask a question, the words you typed go to TypeSafe's Jev model, which reads what you're asking. It receives the question only: never your rides, numbers, name, email or account. TypeSafe states it doesn't train its models on customer data.
• Apps you connect (Strava, intervals.icu) receive the rides you send them; their own privacy policies apply to what they do with them.
• Legal reasons: we disclose data if the law requires it, or to protect the rights, safety and security of our riders or the service.
• If openpack is ever transferred to a new operator, your data would move with it under this policy, and we would tell you first.

7. How long we keep it

Paid plans, when offered, may keep rides longer; the plan says so before you choose it. Server logs used to keep the service running are kept briefly and then deleted.

8. Security

openpack is served over HTTPS. Sessions use random tokens in an HttpOnly cookie, and we store only a hash of each token. Sign-in codes are stored hashed and stop working after a few wrong tries. Access to connected apps is encrypted (AES-256-GCM). No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

9. Your choices and rights

• See and download your rides: each one downloads as a FIT file from the Rides tab and from Profile → Account.
• Correct your rider name and settings in the game.
• Delete your account in Profile → Account → Delete account. It takes effect immediately.
• Disconnect apps in Profile → Account → Connected apps, and sign out on any device.
• Ride as a guest: you can use openpack without giving us an email address.

Depending on where you live (for example in the EEA, UK or California), you may also have the right to access, correct, delete, restrict or object to the processing of your data, to receive it in a portable format, and to complain to your data protection authority. We don't sell or share personal data for cross-context behavioural advertising. To use any of these rights, email [contact email]; we answer within 30 days and will never treat you differently for asking.

10. Children

openpack is not directed to children under 13, and we don't knowingly collect their personal data. You need to be at least 16 to create an account. If you believe a child has given us personal data, contact us and we will delete it.

11. Where data is processed

Our servers and providers may process data in countries other than yours. Where the law requires it, we protect such transfers with appropriate safeguards, such as the European Commission's standard contractual clauses.

12. Health and fitness data

Heart rate, power, weight and similar numbers are used only to run the game and show you your own rides and progress. We never sell them or use them for advertising, and we share them only as described in sections 5 and 6.

13. Changes to this policy

openpack is in beta and this policy will change as the game does. We post every change here with a new effective date, and tell signed-in riders in the game before a significant change takes effect.

14. Contact

[operator name] · [contact email]

Terms of Service · Back to openpack