Data location
Where your data lives
Your account and training data are stored in Germany. This page names the servers, how long backups are kept and every other company that processes personal data for us: what it receives, and when.
The servers: 1blu, Berlin
SteadySignal runs on servers we rent from 1blu GmbH in a data centre in Berlin, Germany. Your account, your rides, your plan and your check-ins are stored there, in the database of the live app.
We have signed a data processing agreement with 1blu under Article 28 GDPR (in German, an Auftragsverarbeitungsvertrag or AVV). It binds 1blu to process the data only on our instructions and to keep it secure.
Backups: 30 days, also at 1blu
Database backups are kept at 1blu in Germany too. Each backup is kept for 30 days and then deleted, so anything erased from the live database has left the last backup 30 days later at the latest.
Who else processes data, and when
This is the complete list. Each company receives only what its job needs.
- Stripe Payments Europe, Ireland
- Payments. When you subscribe or buy credits, Stripe takes your card or payment details directly; we never see your card number.Stripe's US company (Stripe, LLC, formerly Stripe, Inc.) may also process this data. The transfer is safeguarded by the EU-U.S. Data Privacy Framework (Article 45 GDPR) and by the EU Standard Contractual Clauses in Stripe's data processing agreement.
- Anthropic, USA
- The AI coach, and only with your consent. Anthropic receives a minimised numeric snapshot of your training: no name, no email, no free-text notes. Neither we nor Anthropic use it to train AI models.This transfer is safeguarded by the EU Standard Contractual Clauses (Module Two, controller to processor; Article 46(2)(c) GDPR), which are part of Anthropic's data processing agreement with us.
- Google Workspace
- Email. The sign-in codes and notifications we send you go out through Google Workspace, under a data processing agreement with Google. If you choose to use them, Google also handles Sign in with Google and Google Calendar sync.Google LLC in the USA may access this data. The transfer is safeguarded by the EU-U.S. Data Privacy Framework (Article 45 GDPR) and by the EU Standard Contractual Clauses in Google's data processing terms.
- Strava, Garmin, Wahoo and Hammerhead (SRAM)
- Independent controllers, only if you connect them. At your instruction we exchange activities and workouts with them; their own processing is governed by their privacy policies, and they may process data in the USA. You can disconnect any of them at any time.
- Open-Meteo
- Weather. To show the likely weather for a planned ride, we ask Open-Meteo for the forecast at a place and a time. It receives coordinates and a time, never your name or your account.
What stays with us
Our visitor statistics run on Umami, which we host ourselves on the same 1blu servers. Nothing it records leaves them.
Our source code is kept on GitHub. It holds code only, never your data.
Who is responsible
The controller for your data is Cyclefit Europe - SteadySignalTraining, run by Lloyd Thomas. Write to lloyd@steadysignaltraining.com with any question about this page; the full provider details are in the legal notice.
The legal bases, your rights and how long we keep each kind of data are in the privacy policy.