Privacy Policy

Who is responsible

Fabian Fleige, c/o IP-Management #10083, Ludwig-Erhard-Straße 18, 20459 Hamburg, Germany. Email [email protected]. See the Imprint.

This website

• No cookies, no analytics, no tracking. The site has no advertising, no social-media buttons and no embedded content from other services.
• Everything is self-hosted. Fonts, images and scripts come from this site itself; your browser contacts no third party when you open a page.
• Server logs. Like any web server, the server that delivers the site may record the requested page, the time, your browser type and your IP address in short-lived technical logs used only to keep the site running.
• Waitlist. The waitlist form sends your email address only if you submit it; see Waitlist below.

Waitlist

What it is. If you enter your email address in the waitlist form, I will use it to send you one confirmation email and, after you confirm, one email when Hammy is available in the App Store. Nothing else.

Who is responsible. Fabian Fleige, as named at the top of this page.

What is stored. Only your email address, plus the dates and times of your signup, your confirmation and any withdrawal, which Brevo (see below) keeps with it. I do not ask for your name. I do not store your IP address, and the code that receives the form keeps no log of it. Like any internet service, the services that deliver the request and the email technically see your IP address while they do so. The form sets no cookies and stores nothing in your browser.

Legal basis. Your consent (Art. 6(1)(a) GDPR; for the email also § 7(2) No. 2 UWG). It is voluntary: without it you cannot join the waitlist, and the app and this website work as before.

Double opt-in. After you submit the form you receive an email with a link. Your consent is complete only when you click it. If you do not click it, you are not added to the waitlist, and I send you nothing further.

Who processes it. Your address is processed for me by Brevo (France), which stores it on servers in the European Union and sends the emails. The form request first passes through Cloudflare, which hosts this website and processes the request technically; I use its endpoint only to pass your address on to Brevo and keep nothing there. Each provider's data-processing terms are part of the terms I accepted with it. Some of their sub-processors are outside the EU; transfers rely on the EU-U.S. Data Privacy Framework and, where needed, the EU Standard Contractual Clauses. You can ask me for a copy of the safeguards.

How long. Until the launch email has been sent, and I delete your address from the list within six months after the launch. If you withdraw earlier, I stop emailing you at once. If you unsubscribe, Brevo keeps the address marked as unsubscribed so that you are not emailed again by mistake; write to me if you want it deleted at once.

Withdrawing and your rights. You can withdraw your consent at any time with the unsubscribe link in any email from me, or by writing to [email protected]; this does not affect what was lawful before. You also have the rights to access, rectification, erasure, restriction, objection and data portability, and you may complain to a supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg.

The Hammy app

Training data on your device

Workouts you create, rides you record (power, cadence, heart rate and workout events as your sensors report them), your FTP and FTP history and your paired devices are stored in the app’s own storage on your iPhone. Today this training data is stored on your device and is not sent to the cloud. Deleting the app deletes this data. Your device backups (iCloud or computer) include it like any other app data, under Apple’s terms.

Account and cloud storage

An account is required. Using Hammy requires an account. You sign in with Sign in with Apple, or with your email address and a password. An emailed code is used only to confirm your email address and to reset a forgotten password.

What is stored in the cloud. Your account and up to two rider profiles are stored in the cloud: for the account, your email address (or the relay address Apple gives the app if you hide your email), an account identifier and, if you sign in with email, your password in protected (hashed) form; for each rider profile, its profile name and an identifier. Nothing else is stored in the cloud today.

Ride sync is planned, not available. Syncing your training data (rides, workouts and FTP history) to your account is planned. Until it ships, that data stays on your device. When it is introduced, it will be stored with the same provider in the same EU region, and I will update this policy before ride sync ships.

Who processes it. Account data is processed for me by Supabase Inc. as processor. The database is hosted in the European Union, in Frankfurt (AWS region eu-central-1). Sign in with Apple involves Apple. For email sign-in, the emails that carry your confirmation or password-reset code are sent by Brevo (France, EU).

Transfers outside the EU. Supabase and Amazon Web Services are US companies. The data is stored in the EU region named above; where a transfer to the United States is involved, it relies on the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses. You can ask me for a copy of the safeguards.

Legal basis. Performance of the contract, or steps at your request (Art. 6(1)(b) GDPR): the account exists only so that you can sign in and use it at your request. There is no advertising, no tracking and no analytics.

How long, and deleting it. If your subscription lapses, the cloud account data is deleted 30 days later. You can also delete your account in the app at any time; this deletes the cloud account and its rider profiles. Data on your device stays there until you delete the app.

Bluetooth

Hammy asks for Bluetooth access only to find, connect to and control your smart trainer and to read your heart-rate strap or other sensors. Bluetooth is not used for anything else. If you decline, you can still browse and edit workouts; riding needs it.

Optional connections

Strava and Apple Health connections are planned. They will be optional and off by default: nothing is shared unless you connect the service yourself, and you can disconnect at any time. Sharing a ride file from the app sends it only to the destination you pick in the system share sheet. This policy will be updated before such a connection ships.

Subscription

The subscription is purchased through Apple’s App Store. Apple processes the payment and holds your payment details under its own privacy policy; Hammy receives no name, address or payment information from the purchase, only a confirmation that a subscription is active.

Diagnostics

Hammy contains no analytics or crash-reporting service of its own. If you have enabled sharing of analytics with app developers in iOS settings, Apple may pass on anonymised crash reports under its terms.

Your rights

You control your training data on your device directly in the app, and you can delete your account and its cloud data in the app at any time. You have the rights to access, rectification, erasure, restriction, objection and data portability for your account data. For these, or any other question, including questions about this policy or about server logs, write to [email protected]. Under EU data-protection law you may also complain to a supervisory authority.

Changes

This page will change when the app launches with a subscription, before ride sync ships, and when optional connections ship. The date of the last edit is shown at the top.