PrivacyPolicy
Last updated: 26 August 2026
1. Introduction
Hot Chilli Studios ("we", "us", "our"), a Swiss-based sole trader operating the FuelCyclePro product brand, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use FuelCyclePro ("the Service").
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where applicable, we also comply with the EU General Data Protection Regulation (EU GDPR).
2. Data Controller
Hot Chilli Studios is the data controller for the personal data processed through the Service.
Contact: privacy@fuelcyclepro.com
3. Data We Collect
3.1 Account Data
- Email address (for authentication and communication)
- First and last name
- Password (stored as a one-way hash - we cannot read your password)
3.2 Profile and Fitness Data
- Age, gender, height, and weight
- Functional Threshold Power (FTP) and cycling experience level
- Training goals, available training time, and riding style
- Activity level and dietary preferences
3.3 Training and Nutrition Data
- Training plans and workout sessions
- Completed workouts and session data
- Meal logs, hydration logs, and nutrition goals
- Fueling scores and bonk prediction data
- GI distress incidents and gut profile data
- Metabolic profile and data points
3.4 Third-Party Integration Data
When you connect third-party services (Strava, Zwift, Garmin, Intervals.icu), we receive:
- OAuth access tokens (encrypted at rest)
- Activity data (distance, duration, power, heart rate)
- Athlete profile information from those platforms
We only request the minimum permissions needed to provide integration features.
3.5 Payment Data
We do not store your payment card details. All payment processing is handled by:
- Stripe (web subscriptions) - Stripe Privacy Policy
- Apple App Store (iOS subscriptions) - Apple Privacy Policy
- Google Play (Android subscriptions) - Google Privacy Policy
We store only your Stripe customer ID and subscription status for service management.
3.6 Technical Data
- IP address (for security and rate limiting - not stored long-term)
- Device type and platform (for push notifications)
- Request logs (retained for 30 days for debugging)
4. How We Use Your Data
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Provide the Service (training plans, nutrition tracking) | Contract performance |
| Process payments and manage subscriptions | Contract performance |
| Send transactional emails (verification, password reset) | Contract performance |
| Improve and personalise the Service | Legitimate interest |
| Prevent fraud and ensure security | Legitimate interest |
| Send marketing communications (opt-in only) | Consent |
5. Data Storage and Security
- Database: Your data is stored in a PostgreSQL database hosted by Supabase (AWS infrastructure, EU/US regions)
- Encryption in transit: All connections use TLS 1.3 encryption
- Encryption at rest: Sensitive tokens (OAuth, API keys) are encrypted using AES-256-GCM
- Password security: Passwords are hashed using bcrypt with a cost factor of 12 - we never store or see your password
- Access control: Data is isolated per user - you can only access your own data
6. Data Sharing
We do not sell your personal data. We share data only with:
- Payment processors (Stripe, Apple, Google) - to process subscriptions
- Email provider (Resend) - to send transactional emails
- Connected fitness platforms (Strava, Zwift, etc.) - only when you explicitly connect them
- Personalization engine provider (Anthropic) - anonymised prompts for meal and training plan generation (no personal identifiers sent). Listed here to satisfy GDPR Article 28 subprocessor disclosure.
We use privacy-conscious product analytics to improve the Service. Where enabled, we may use PostHog (typically EU-hosted) for product usage and funnels, and Vercel Analytics for performance telemetry. We do not sell your personal data and we do not use advertising trackers.
7. Your Rights (GDPR)
Under GDPR, you have the following rights:
- Right of access - Export all your data via Settings → Export Data
- Right to rectification - Update your profile and data at any time
- Right to erasure ("right to be forgotten") - Delete your account and all associated data via Settings → Delete Account
- Right to data portability - Export your data in JSON format from Settings (recent plans, logs, and linked account data in a single machine-readable file; contact us for a broader archive request)
- Right to restrict processing - Contact us to restrict specific processing
- Right to object - Contact us to object to processing based on legitimate interest
- Right to withdraw consent - Where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, contact privacy@fuelcyclepro.com. We will respond within 30 days.
8. Data Retention
- Active accounts: Data is retained for as long as your account is active
- Deleted accounts: All personal data is permanently deleted within 30 days of account deletion
- Server logs: Retained for 30 days, then automatically purged
- Payment records: Retained for 7 years as required by tax law
9. Cookies and Local Storage
FuelCyclePro uses minimal browser storage:
- Authentication token - Stored in localStorage to maintain your login session
- User preferences - Theme, units, and UI state stored locally
We do not use third-party advertising cookies. First-party and provider analytics may use cookies or similar technologies as described in their documentation when those tools are enabled.
10. International Data Transfers
Your data may be processed in the United States (where our infrastructure providers operate). Where data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and adequacy decisions.
11. Children's Privacy
The Service is not intended for users under 16 years of age. We do not knowingly collect data from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. The "Last updated" date at the top indicates when the policy was last revised.
13. Contact and Complaints
For privacy enquiries:
Email: privacy@fuelcyclepro.com
If you are unsatisfied with our response, you have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC):