Privacy in ErgIntz Grand Prix

Last updated 5 November 2026.

ErgIntz Grand Prix is a racing game for the Concept2 SkiErg. You sign in to it with your ErgIntz account, and it has its own small server, the "Grand Prix server" at gp.ergintz.app. This page says what the game sends where, what the Grand Prix server keeps about you and why, who can see it, how long it is kept, and how to switch it off or delete it.

Your ErgIntz account itself (your email address, your training sessions, your profile and any Premium subscription) is held by ErgIntz, and the ErgIntz privacy policy covers it: ergintz.app/privacy. This page says where the game touches it.

Who is responsible for your data

Martin Ahlberger, a private individual resident in Sweden, is the data controller for ErgIntz Grand Prix, as he is for ErgIntz. Contact: hello@ergintz.app.

If ErgIntz is one day run by a company formed for the purpose, that company becomes the controller. We will say so here before it happens. The change does not by itself alter what we hold, why we hold it, or any of your rights over it.

The short version

• You can play without an account. As a guest, nothing about you leaves your phone: your races, your progress and your recordings stay on it.
• Signed in, your races are kept on the Grand Prix server so you can see your history on any phone, get your progress back on a new one, and race other people's recorded rides ("ghosts").
• Your name and times are shown to other players on the weekly boards, the streak list and with your ghosts. There is a switch to stop your rides being raced, and ErgIntz's leaderboard switch takes you off the boards and the streak list too.
• Heart rate never reaches the Grand Prix server. With your consent on ErgIntz it is saved with your training session on ErgIntz, and nowhere else.
• Premium is paid to Apple or Google. We never see your card, your Apple ID, your Google account or your name from either.
• A short diagnostics log goes to ErgIntz while you are signed in, and you can switch it off. It says what went wrong with your erg, your heart-rate strap or a race, so it can be fixed: never a heart rate, never where you were on the course. It is on by default (Settings › Privacy › Send diagnostics). As a guest, nothing is sent.
• No advertising, no analytics or tracking SDKs, no tracking across apps or websites. The website counts its visitors with Cloudflare Web Analytics, which uses no cookies and does not follow you between sites. We do not sell your data and we never will.

What we hold, and why

If you play as a guest

Nothing is sent to the Grand Prix server or to ErgIntz. Your races, recordings, T-Fruties, Locker and bests are kept on your phone only. The game talks to your erg (and to a heart-rate strap, if you pair one) over Bluetooth; that connection is between your phone and the device.

Your ErgIntz account, through ErgIntz

You sign in with your email address and a six-digit code that ErgIntz emails you; there is no password. From then on the game reads from your ErgIntz account: your account number, your email address, your display name, your FTP and power profile (from your 5 km benchmark), your body weight and height, whether you have agreed to store heart rate, your clubs, and your Premium status. You edit these on ergintz.app; the game only reads them.

The game also reads your best-power profile from ErgIntz (your best average watts over 5 seconds to 20 minutes, all time and this season, for each erg you have used). It compares a race with it on your phone, to tell you when a race beats one of your bests, and keeps a copy on the phone. The Grand Prix server does not receive the profile.

When you finish a race signed in, the game also saves it to ErgIntz as a training session: start and end time, the erg's distance and time, average power, and the erg's own record of the race. That session is ErgIntz's, under ErgIntz's privacy policy, like any session you row.

The Grand Prix server uses your ErgIntz sign-in only to ask ErgIntz who you are. It does not store your email address or your sign-in token.

On the Grand Prix server, if you are signed in

• Your race history: for each race, the course, laps, effort, the field you raced (the FTP the computer riders rode at, in watts and in watts per kilogram), your own watts per kilogram at the time of the race (your FTP divided by your weight), the time you started, your finishing time and place, whether you finished, the distance on the erg, the T-Fruties it paid, a short summary of how the race went (where you gained and lost places, pacing, drafting, items), and which version of the game sent it.
• Your rides as ghosts: for each finished race, a recording of your ride, every second: where you were on the course, your speed, your lane and your power. With it, what another phone needs to draw you: your display name and initials, your body weight and height, the kit your skier wears, and your average power (used only for the fairness check below).
• A backup of your game profile: your T-Fruties, your Locker (the kit you've earned), your bests, awards, bibs, Weekly Race progress and your FTP history in the game, so you can get them back on a new phone.
• Your display name and the time you last used the server, to show on the boards and with your ghosts.
• Your list: women or men. The choice you make in the game (Your profile), sent with your races. The weekly boards and the streak list are ranked within it; if you have not chosen, you are in the men's list. Nobody else sees which you chose, only the list you appear in.
• Your Weekly Race streak: the number of weeks in a row you have finished the Weekly Race, worked out from the races above and shown with your name on the streak list on the Weekly Race page. Nothing more is stored for it.
• Timed sprints and climbs: where the game offers them, your time, power and watts per kilogram for each pass of a timed stretch of a course (not a bot's), for the segment boards.
• Races ridden inside an ErgIntz session: when you race from a workout in the ErgIntz app, the race also names that ErgIntz session, so the two can be matched.
• Your settings here: whether you let others race your rides, and a copy of your ErgIntz leaderboard switch so we can respect it.
• Your clubs: the ErgIntz clubs you belong to (the club's name, your role and the member count), copied from ErgIntz and refreshed every few hours, for club ghost races and club Grand Prix sessions.
• Club Grand Prix sessions: races you set up and save for a club (a code, a title, course, laps and effort), which club sessions you were listed for, and, when you finish a race for one, a note to ErgIntz that you finished (your account number, the session and the time) so it counts for your club.
• Weekly Race standings: your place and time in each week's Weekly Race.
• Your Premium status, as a copy: whether you have Premium, monthly or yearly, whether you are in the free trial, and when the current period ends, as ErgIntz last told us. It decides what Premium unlocks in the game.
• Results of races with friends: the finishing order (names, places and times) and the race's settings, sent by the host's phone. Everyone who raced can read it back.

We use these to show you your history and personal bests on any phone, to let you race ghosts and let others race yours, to run the weekly boards and club sessions, to give you your progress back on a new phone, and to run races with friends.

To keep ghost races fair, the server compares a ride's average power with what your ErgIntz power profile says you can do at that duration. A ride that doesn't look real is flagged. The flag is never shown to anyone, and the ride is never refused for it.

Highlight videos

After a race the game can make a short video of it with music. It is made and kept on your phone; nothing is uploaded. It goes where you send it, and only when you share it. The music in it is part of the game, so it says nothing about you.

Live races with friends

While a live race is running, the server passes data between the phones in it: each rider's display name, initials, FTP, body weight and height (so the race can be run fairly, and the game shows each rider's W/kg), their kit, and during the race their power, stroke rate and when they use an item. The host's phone sends the race itself to the others. All of this is held in memory only while the room is open and is not stored. What is stored afterwards is the result, above.

Heart rate

If you pair a heart-rate strap, or your erg reports one, the game shows your heart rate during a race. It is stored only if you have agreed on ErgIntz to store heart-rate data. Then it is recorded once a second and saved with the race's training session on ErgIntz, under ErgIntz's privacy policy, and withdrawing that consent on ErgIntz erases it there. Without that consent it is shown and not kept: the game removes every heart-rate reading, the erg's own included, from the session before it is sent, and ErgIntz removes it again if any arrives. The Grand Prix server never receives your heart rate: it is not in your race history, your ghosts, your profile backup or a live race. As a guest, it stays on your phone.

If you subscribe to Premium

Premium is bought in the game through the App Store on an iPhone or iPad, or through Google Play on an Android phone, and is held on your ErgIntz account. Apple or Google takes the payment; we never see your card, your Apple ID, your Google account or your name. The game sends the store's record of the purchase (Apple's signed record, or Google's purchase token) to ErgIntz, which checks it with the store and keeps the subscription's status with your account: the store's id for the subscription, whether it is monthly or yearly, whether you are in the free trial, when the current period ends, and whether it is renewing, in a billing problem, refunded or ended. On Android, ErgIntz ties the purchase to your account with an identifier that does not say who you are, which Google keeps with the purchase. That is what lets the game know you have Premium, on any phone you sign in on. The Grand Prix server only reads the result (above). ErgIntz's privacy policy covers this in full.

The server's request log

Each request to the Grand Prix server is written to its log: the time, which address was called, the answer, how long it took, and your ErgIntz account number. Never your email address, your sign-in token or what you sent, and not your IP address. It is there so we can find and fix problems. The server keeps no copy of it itself: it is held by Fly.io, our host, for 7 days.

Diagnostics (on by default, signed in only)

While you are signed in and Settings › Privacy › Send diagnostics is on, the game sends ErgIntz a short log of things that went wrong or looked strange, tied to the race (the ErgIntz session) they happened in. It holds: the game's version and build, your phone model and its iOS or Android version, a random install number made when the game is first opened (it disappears with the app and names no hardware), when your erg and your heart-rate strap connected or dropped and why a connection failed, the course and effort of the race, whether your heart rate could be stored, errors the game raised (which part of its code), whether a session or a purchase reached ErgIntz or was refused, and slow moments in the picture. It never holds a heart rate, where you were on the course, your email address or a sign-in secret (those are taken out on your phone, and again at ErgIntz), or what a server answered. It is our own log for fixing faults, not an analytics service. ErgIntz keeps it for 30 days; Martin reads it to find the fault. A copy of the last few hundred lines stays on your phone, so that Settings › Privacy › Copy log can put it on the clipboard for you to send us. Switch it off and the copy on your phone, and anything still waiting to be sent, is deleted at once. As a guest, nothing is sent.

If the Android game fails to start (on by default, no account needed)

On Android, if a launch never reaches the game's first screen, ends in a crash, or the first screen sits untouched for two minutes, the game sends the Grand Prix server one short report the next time it can, or at once. It holds: the game's version, your phone's make and model, its Android version and amount of memory, how far the game got, how Android says the last run ended, the crash message if there was one, and the game's own log lines from that run. It holds no account, name, email address, sign-in secret or heart rate, and no random install number. (The server's request log, above, sees the address the report came from, as it does for every request.) It exists to find out why a phone cannot run the game. Martin reads it; it is kept 90 days and then deleted. Settings › Privacy › Send diagnostics, when off, stops these reports too. A launch that works sends nothing.

What we do not collect

No advertising identifiers, no contacts, no location, no photos, no camera and no microphone, no browsing activity, no third-party analytics, crash-reporting or tracking SDKs, and no payment card details. On Android 11 and older the system asks for the location permission before any app can look for Bluetooth devices (your erg, your heart-rate strap); the game uses it only for that and never reads or sends your location.

The early-access list on gp.ergintz.app

If you sign up for early access on the website, we keep the email address you type and when you typed it, and nothing else: it is not linked to an ErgIntz account or to anything in the game. We use it only to invite you to test the game and to tell you when it is in the App Store or Google Play. We give it to nobody else. You are on the list because you asked to be (your consent); to come off it, email us and we delete it.

Visits to gp.ergintz.app

The website counts its visitors with Cloudflare Web Analytics. When you open its front page, your browser tells Cloudflare the page that linked you here, and your browser and device type. No cookies are set and nothing is stored on your device, and it does not follow you between sites. It is not on any other page, and not in the game.

Why we are allowed to hold it

• Performance of a contract: running the game you signed in to, keeping your race history, profile backup and settings, running races with friends, the boards and club sessions, and knowing whether you have Premium. It is the service you asked for.
• Legitimate interests: showing your ghosts and your times to other players, which is what a racing game against real people is (you can object at any time with the switches below); the fairness check; the request log; the diagnostics log, to find and fix faults on equipment we cannot see (you can object at any time by switching it off); security and keeping the service working.
• Consent, for the early-access list: you typed your address in to be on it. Ask, and it is deleted.
• Explicit consent, for heart rate: given and withdrawn on ErgIntz (see above). Heart rate can say something about your health, so it is stored only with your agreement.

Who can see what

• Your ghosts: other players racing the same course (the week's Weekly Race), and members of your ErgIntz clubs in a club ghost race or club session, race against your recorded ride. Their game shows your display name, initials and kit. Their phone also receives your weight and height (to draw and move your ghost correctly) but doesn't show them as numbers. Never your account number or your sessions.
• The weekly boards and Weekly Race results: your display name, your time, your watts per kilogram at the time of the race and the field's FTP, to other players, on one board for everyone. Club session boards: the same, to your club.
• Races with friends: the people in the race see your name, your W/kg and where you finished. The room shows whether its host has Premium (that decides the free seats), and nobody else's.
• Only you: your race history and summaries, your profile backup, your settings, your club list and your Premium status.
• The operator: Martin, as the person running the service, can see what the server holds through an admin page, to run it and to deal with abuse.

If you've chosen on ErgIntz to be hidden from leaderboards, you are left off the boards and your rides are not used as ghosts.

How to turn sharing off

In the game, go to Settings › Let others race my rides and switch it off. Your rides then aren't raced as ghosts by anyone else, and new rides aren't uploaded as ghosts. Being hidden from leaderboards on ErgIntz also turns it off.

To stop the diagnostics log, go to Settings › Privacy › Send diagnostics and switch it off.

Who else we give it to

We do not sell your data and we do not share it with advertisers. It reaches these parties, and no others:

• ErgIntz: the Grand Prix server asks ErgIntz who you are, your clubs and club sessions, and tells it when you finish a club session race; the game sends it the diagnostics log while that switch is on. ErgIntz is run by the same controller.
• Fly.io: everything the Grand Prix server holds, as its host. It runs in Stockholm.
• Cloudflare R2: a continuously replicated backup of the database, in a bucket restricted to the European Union, so it does not leave the EU.
• Cloudflare Web Analytics: when you open the website's front page, the page that linked you here, and your browser and device type, so we can count visitors.
• Apple and Google: the game's distribution, and the payment for Premium. Apple (iPhone and iPad) or Google (Android) sends ErgIntz the subscription's status; we send them nothing about you.
• Other players, as set out above.

Fly.io and Cloudflare process data on our behalf, under a data-processing agreement with each. Both are US companies. Your data is stored in the EU: the server and its database run in Stockholm, and the backup bucket is restricted to the EU. Where personal data does reach the US through them, the transfer is covered by the company's certification under the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses, the safeguards EU law recognises for sending personal data to the US. Apple and Google are independent controllers, handling what reaches them under their own privacy policies.

Where it is stored

The Grand Prix server runs on Fly.io in Stockholm, Sweden. Its database is backed up continuously to Cloudflare R2, in a bucket restricted to the European Union. Backups are kept for 7 days.

How long we keep it

• Your race history, ghosts, profile backup, settings, standings and results: until you delete them (below). There is no automatic expiry.
• Your club list: refreshed from ErgIntz every few hours while you use the game, and deleted with the rest.
• A live race: only while the room is open (at most 2 hours idle). Nothing of it is kept except the result.
• Your Premium status copy: replaced each time ErgIntz answers, and deleted with the rest.
• Your address on the early-access list: until the game is in the App Store or Google Play and we have told you, or until you ask us to remove it, whichever is first.
• The request log: 7 days, at Fly.io. The server keeps no copy.
• A start-up report (Android, only when a launch fails): 90 days, on the Grand Prix server, where it is deleted automatically.
• The diagnostics log: 30 days, at ErgIntz, where it is deleted automatically. The copy on your phone is the last few hundred lines only, and goes when you switch the log off.
• Backups: 7 days, so something you delete is gone from the backups within 7 days too.

Your rights

Under GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to hand it to someone else. You can withdraw consent at any time. Email hello@ergintz.app. How to delete your account and data, step by step, is on its own page: gp.ergintz.app/delete-account.

Delete your Grand Prix data. In the game, go to Settings › Privacy › Delete my race data. That deletes everything the Grand Prix server keeps about you: your race history, your ghosts, your profile backup, your name, your settings, your club list, your club sessions and race codes, your Weekly Race standings, your Premium status copy, and your place in results of races with friends (and the results of races you hosted). It doesn't delete what's on your phone, or your ErgIntz account and its training sessions. If you keep racing while signed in, new races are stored again; to stop that, sign out first.

Delete your ErgIntz account. In the game, go to Settings › Account › Delete account. That deletes your Grand Prix data first, then your ErgIntz account and everything ErgIntz keeps for it, and signs this phone out. ErgIntz's privacy policy sets out what that erases. You can also delete the account on ergintz.app, in Settings › Delete account, or in the ErgIntz app; deleting it there does not by itself delete your Grand Prix data, so delete that first in the game, or email us and we will.

Cancelling Premium. Deleting your data or your account does not cancel a Premium subscription. The store bills it, so cancel an Apple subscription in your App Store account settings, and a Google Play one in Play Store › Payments & subscriptions › Subscriptions.

Complaints. If you think we have handled your data wrongly, please tell us first. You also have the right to complain to Integritetsskyddsmyndigheten (IMY), imy.se, or to the equivalent authority in the EU country you live in.

Children

You must be at least 13 to have an ErgIntz account and to sign in to the game. The game is not directed at children under 13 and we do not knowingly hold data about them. If we learn that an account belongs to someone under 13, we will delete what the Grand Prix server holds about it.

Changes

We may update this policy. The date at the top says when it last changed; if a change is material we will say so in the game or on the site.

Contact

Questions, or want something deleted or corrected? Email hello@ergintz.app.

For developers: the in-game deletion is DELETE /v1/account with your ErgIntz sign-in.