Privacy notice

Updated 26 October 2026

Who is responsible

PowerTrace is operated by Johannes Randrop Keiding, the controller responsible for personal data processed through the service. For privacy questions, access or deletion requests, contact pocketwoolf@gmail.com.

Recordings and analysis

Recordings can contain timestamps, power, cadence, heart rate, speed, distance, elevation, device identifiers and other recording metadata. Names you enter, rider labels, analysis settings, PPT/baseline profiles and calculated results can also form part of an analysis. Heart-rate and fitness information can reveal information about health: only use recordings you are entitled to process, and consider what they contain before saving or sharing them.

Opening a manual FIT file does not by itself save the recording to your account. Some preferences and remembered device names are kept in your browser. A temporary comparison draft can be kept in session storage when you leave the page to sign in, so you can continue afterwards. Browser storage can be cleared in your browser settings.

Device identification uses PowerTrace’s device lookup. Recognized-model lookups send device lookup hashes rather than your ride’s sample stream. Remembered device names can be saved to your account. Where shared model contributions are enabled, a recognized product/model label and matching device keys can contribute to the lookup used by other visitors. Manage or withdraw these contributions in Device names. This is separate from making a recording public.

Accounts and private storage

If you sign in with Google, PowerTrace receives the identity and email information needed to recognize your account. Email sign-in stores your address and a verification challenge, and sends a one-time code through Resend. If you add a verified email backup while signed in through Strava, Discord or Intervals.icu, that address is linked to the same PowerTrace account so you can use email sign-in to access its existing analyses. PowerTrace uses an essential, HttpOnly session cookie to keep you signed in; session tokens are not stored in browser JavaScript storage.

When you save, PowerTrace stores a decoded snapshot of the recordings, results and settings under your account. Saved history, rider labels, device names, preferences and baseline profiles support reopening comparisons and following results over time. Optional current-fitness tracking keeps best-effort evidence and source details; its settings include a separate control to delete that evidence.

Discord identity and recovery

If you choose Discord sign-in or link Discord, PowerTrace requests identify and email. It stores your Discord user ID, username, display name and avatar reference as a login identity. A provider-verified email address is retained as a suggested address for email verification, not as proof that another PowerTrace account belongs to you. Discord login tokens are discarded after the profile is retrieved.

PowerTrace does not request server lists, membership, roles, messages, linked third-party accounts or posting webhooks for sign-in. It does not automatically join a server. Profile names and provider email matches alone never combine existing PowerTrace accounts.

While signed in, you can verify an email address with a fresh PowerTrace email code. If it already belongs to another PowerTrace account, successful verification automatically combines the private saved histories and keeps the existing email account’s settings. Compatible ride connections are retained; different athlete connections require a choice. Other provider-link flows ask for confirmation after verifying both accounts. Unlinking Discord requires another sign-in method and removes the login mapping and stored profile/email hint; old Discord-created sessions stop working. Saved analyses remain available through the other linked login.

The optional Discord community link opens Discord’s website. Joining the community is separate from connecting a PowerTrace login and does not share your recordings or results automatically.

Optional connections and email

When a new account is created, PowerTrace can notify its operator by email with the sign-in provider, creation time and total account count. These operational notices contain no ride, heart-rate or fitness details. A private signup record and delivery status prevent repeat logins or account linking from triggering duplicate notices.

If you sign in with Strava, PowerTrace requests basic profile permission and stores an account link based on your Strava athlete identifier. It does not retain the login access/refresh tokens or import your rides through this sign-in. Linking Strava while signed in connects it to your existing PowerTrace account; profile names and unverified email addresses are not used to merge accounts. Unlinking removes the PowerTrace sign-in link. If separately created accounts belong to you, PowerTrace verifies access to both before combining them. A fresh PowerTrace email code requested while signed in can automatically consolidate an account into the existing account for that address; the existing email account’s settings take priority. Compatible established ride connections and their automatic import settings are retained when accounts are combined; different athlete connections require a choice in the provider-link flow. Provider email matches alone do not consolidate existing accounts. Other provider-link flows offer a separate confirmation after verifying both logins. Confirming links their private saved histories, baselines and device names under one account; it does not publish them. For those manually confirmed provider links, your current account settings take priority.

A separate owner-only Strava test requests permission to read private activities and edit descriptions. It stores authorization tokens encrypted, lets the owner select an Only You activity, and requires preview and confirmation before appending text. It retains an encrypted copy of the previous description for restoration within 24 hours. Disconnecting removes the local tokens and test preview/restore records and attempts to revoke the Strava authorization.

If you connect Intervals.icu using OAuth or a personal API key, PowerTrace stores the access token or key encrypted and uses it to retrieve the activities and original files needed for the features you enable. OAuth requests activity-read permission. You can use Intervals.icu to sign in or create a PowerTrace account, or link it to an existing account after verifying that account. PowerTrace stores a login mapping from the Intervals.icu athlete ID and a short display name, without taking an email address from the OAuth response. New accounts connect available original ride files with automatic comparisons, fitness checks and notifications off. Existing API-key connections, disconnection choices and enabled options are preserved. Repeated sign-in refreshes a matching OAuth connection credential if the provider rotates it. Unlinking Intervals.icu sign-in requires another login method and invalidates old Intervals-created sessions; it is separate from disconnecting ride access. Names are not used to merge accounts. Provider linking requires confirmation; consolidation through a fresh PowerTrace email code follows the process described above. You can add a separately verified email backup or link another supported provider. You can choose available original FIT files manually. Automatic comparison creation, connected fitness/PPT checks and email notifications are separate options. Scheduled checks run only for enabled options. Only eligible original recordings available through that connection are imported; Strava-sourced activities are excluded. Imported recording data may be cached on the server to avoid repeated downloads. A first-use prompt records your choice about automatic comparisons. A separate private notice queue stores the ID, title, recording count and creation time of new comparisons so you can open or dismiss them when you return. Acknowledgements keep dismissed notices from being shown repeatedly. These notices are separate from optional email delivery, and opening a new analysis requires your action.

For OAuth connections, Intervals.icu can send authenticated activity event notices containing your athlete ID and activity metadata. PowerTrace uses a private, deduplicated queue to update eligible imports when their automatic options are enabled, and to flag changed or deleted sources. Source deletion removes related derived fitness evidence; deliberately saved analyses remain available with a source-change note. Disconnecting Intervals.icu removes the stored connection credential, import state and cached imported recording data and stops future imports. For OAuth it also attempts to revoke the app at Intervals.icu and tells you if revocation could not be confirmed. Previously saved analyses remain until you delete them. You can disable notifications in Settings. Resend processes the destination address and message content when PowerTrace sends sign-in codes, verification codes or enabled notifications. Notification links lead to private analyses; enabling notifications does not create public links.

Sharing and downloads

Saved analyses are private until you create a public share link. Anyone with that link can open the shared snapshot without signing in and may download or forward its data, reports, images or text. A shared snapshot can include recording samples, device information, labels and attached baseline evidence. Check the content before sharing.

A share is a snapshot: later private edits do not automatically replace it. Use the sharing controls to update or revoke it. Deleting the saved analysis also revokes its active share link. Revocation prevents future access through PowerTrace, but cannot remove copies other people have already downloaded, forwarded or captured. Files you export directly are under your control. After an analysis, PowerTrace may prepare a report-card image in the background in your browser so the sharing preview is ready sooner. Preparing or opening that preview does not by itself publish a link, upload the image to a social service, post to Discord or Strava, or copy anything to your clipboard. Copying, downloading and sharing require the corresponding action you choose.

Why data is used

PowerTrace uses account, recording and analysis data to provide the functions you request: analysis, private saves, reopening history, baselines, exports and sharing. For ordinary personal data necessary to deliver those requested services, the legal basis is performance of the service agreement. Optional connections and notification emails follow your choices and can be switched off. Essential security and abuse prevention rely on the legitimate interest in keeping the service and its users safe.

These service purposes do not authorize unrelated use of sensitive health information. This notice explains data handling; it is not a request for consent and accepting a privacy policy is not required to use the site. Contact the operator if you need health-related data removed or have questions about its use.

The application does not include advertising trackers or third-party analytics scripts, and does not sell your recording data. PowerTrace’s automated scores describe recording agreement and performance-model checks. They are not an official race eligibility decision; any organizer’s decision is separate.

Service providers

PowerTrace uses OpenAI Sites and its Cloudflare hosting and storage infrastructure to serve the site and keep server-side records. Hosting providers receive normal request information, such as IP address and browser information, when you visit. Google handles Google sign-in; Strava handles optional Strava authorization; Discord handles optional Discord identity authorization and profile images; Resend handles service email; Intervals.icu handles the connected activities you authorize. These providers also have their own privacy information and terms.

Provider processing may take place outside the EU/EEA. This notice does not promise a particular storage country or transfer arrangement. Contact the operator for information about the providers and transfer safeguards applicable to your data.

How long data stays

Private saved analyses and baseline records remain available until you delete them or request account-data deletion. Share snapshots remain available until revoked or their source analysis is deleted. Connection credentials and cached imported recordings remain while connected; disconnecting removes them. Fitness evidence has its own deletion control and evidence-window settings. Removing an analysis does not automatically remove separately retained fitness evidence or baseline profiles.

Email codes expire after 10 minutes and sessions are valid for up to 14 days. Expiry stops their use; it does not promise immediate removal of every underlying record. Security, delivery and support records are retained only as needed for those purposes and any applicable legal obligations. There is no automatic account-inactivity deletion schedule. Discord and Intervals.icu login mappings and basic profile information, including a Discord email hint where supplied, remain until you unlink that login or request deletion. Consent choices and notice acknowledgements remain as account preferences until removed with the account or a deletion request. For complete account deletion, including related records, contact the operator.

Your choices and rights

You can export a comparison backup, delete saved analyses and baselines, revoke links, forget remembered device names, delete fitness evidence and disconnect imports through the site. Clearing browser storage removes local preferences and drafts; it does not delete server-side records.

Depending on the applicable conditions, you can request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent where processing relies on it. Contact pocketwoolf@gmail.com using the email associated with your account where possible. Verification may be needed to protect your records. You can also complain to Sweden’s Authority for Privacy Protection (IMY) or your local supervisory authority.

Terms of Service · Return to PowerTrace