FondoLab

Race regulations

Privacy

What FondoLab stores about you, where it is kept, for how long, and why.

Last updated 22 October 2026.

In short

Who is responsible

FondoLab is run by TCR-IT B.V., Benedictijnenstraat 27, Arnhem, the Netherlands (KvK 80623662). We are the controller of the personal data described here.

Questions about your data, or a request to use one of your rights below: privacy@fondolab.com.

Your account

An account is optional; the knowledge base works without one. The fueling planner, the rider profile, race weather and race pacing need one, so what you enter can be saved.

We use these to provide the service you signed up for (GDPR article 6(1)(b)).

What you enter

Each account has its own database file. It holds what you enter in the tools, such as your fueling plan inputs and your rider profile (body weight, FTP, your year of birth if you give it, riding position, drag area, your bikes and tyres, and any notes you add on where a number came from), the sweat tests you log (date, ride time, weights before and after, what you drank, ate and passed, temperature, humidity, effort and power, and your note) and any sweat sodium result you enter, your fitness tests (date, body weight, the power of each effort, and blood lactate, a lab VO2max, your power meter and a note if you enter them), and your ride tests (from the FIT file you upload we keep one sample a second of time, power, speed, altitude and temperature, and the laps, with the bike, position, weight and air you tell us; positions are used to find the laps and thrown away, and the file itself is not kept) and your races (each race's name, date and A, B or C priority, the race calendar race it came from and its feed stations) with their race weather courses (each course's name, its positions and elevations, and the start date, time and speed you plan to ride it at), how you want to pace each one (the bike, target power, climb cap and descending style) and the fueling plan you make for each race, and, if you switch on the training plan, your answers to it (how much you ride now and the time you have each weekday, or that you train with another app), the rides you already have (name, day or date, length and how hard), your settings for the plan and the weeks you lock, each day of the plan as it was planned or as you changed it (the session and the FTP its watts came from), and the workouts you keep (a name and their steps), and, if you say where you ride, your home spot and any places away with their dates (each a town's name, or none, and its position rounded to 0.1°, about 10 km; when you use your location, your browser rounds it before sending it, and your exact position never reaches us) and the hours you ride on each weekday if you set them, and whether you run cold or warm if you say so, and your routes (each route's name, its positions and elevations, the workouts you ride it for, if any, the warnings we read from it for those workouts and which of them you dismissed) and the route you chose for a day's session when it is not the plan's, with the workout you chose it for, and nothing else. When you upload a GPX file we keep only its positions and elevations; times, heart rate and anything else in it are thrown away before anything is saved. Your account page lets you download that file as it is, a standard SQLite database, and delete it. Deleting your account removes the file at once.

Sweat and fitness test results say something about your body, so they are health data. We ask you to agree before the first one is saved, keep when you agreed in your database, and use them only for your own profile and plans. You can delete any test, or all of them with your account.

Races you submit

A race you submit to the race calendar is not personal data in your own database: it goes into the shared race calendar, with its name, date, start time, start town, website, course (positions and elevations only, as above) and feed stations, and which account submitted it, so that you can see and plan it while it waits for review. Once we approve it, everyone can see the race, but never who submitted it. When you delete your account, the race stays on the calendar and the link to your account is removed at once.

Usage records

For every request to the site we record:

We never record what you type into forms, and never the part of an address after a question mark, which can contain sign-in links. Images, styles and scripts are not recorded.

We use these records to keep the site running and secure, for example to spot abuse and errors, and to see which pages and tools are used so we can improve them. This is our legitimate interest (GDPR article 6(1)(f)). Only FondoLab's administrators can see them, on our own server; they are not shared with anyone and not used for advertising.

After 30 days each record is reduced: the IP address is cut to its network (for example 203.0.113.0 instead of 203.0.113.7), and the email address, the full user agent and the linking page's path are removed. What remains, such as the page, the time, the network, the browser family and an account number, is kept to see trends over time, and deleted 13 months after the visit. When you delete your account, your records are reduced at once and no longer linked to it.

You can object to these records at any time by writing to us.

Server logs

The server writes one log line per request for troubleshooting: the method, page, status, size and duration. These logs contain no IP address, no account and no user agent.

Cookies

We set at most two cookies, both only when you do something that needs them:

Both are strictly necessary for what you asked for, so we do not ask for consent. There are no other cookies, and the usage records above use none.

Strava

If you connect Strava from your account page, Strava asks you what FondoLab may do, and FondoLab gets a key to your Strava account for that. We ask to read your profile and your activities, including private ones, and to write to your activities. We keep, in your own database, your Strava athlete number, what you allowed, and the keys, encrypted. Our account index keeps your Strava athlete number with your account, because Strava's notice of a new activity names only that.

From your activities we keep only rides, of the last four months when you connect and every ride after that: for each its name, type, start time and the day it was ridden, moving and elapsed time, distance, climbing, and, when the ride has them, average and weighted power from a power meter, energy, and average and highest heart rate, and the ride's data second by second as Strava has it: time, position, distance, altitude, speed, gradient, power, heart rate, cadence and temperature. Positions show where you ride, and so often where you live; Strava's privacy zones hide that from others, not from you, so they do not apply to what we read. We use all of it only for you: to match each ride to the day of your training plan, to work out your training load, fitness, fatigue and form, how well each session went, your best efforts, and estimates such as your drag and the climbs you rode. Nothing of it is shown to anyone else. Heart rate is health data: connecting Strava is your agreement that we keep it, and you can take that back by disconnecting.

A ride you change on Strava is read again; one you delete on Strava is deleted here. Disconnecting, here or in Strava's settings, removes the keys and every ride we read, and tells Strava to withdraw our access. So does deleting your account.

If you turn on writing to your rides, FondoLab adds a short block to the description of each ride from that day on, with the lines you picked: how the ride went against your plan, your race and form, and the weather at the start with the best time to have left, which we look up for where the ride began. Your followers on Strava see it, as they see your description. It never shows watts. We note which rides have it, so each gets it once; turning it off stops it, and what was written stays on Strava for you to edit.

Where your data is

We do not sell or share your data with anyone else.

Backups

We back up so that a broken server does not lose your data. The account index is backed up continuously and your database file every five minutes; both backups go back 7 days. When you delete your account, the backups of your database file are removed within an hour, and your email address disappears from the account index backups within 7 days. Usage records are not backed up.

Your rights

Under the GDPR you can ask to see, correct, delete or take away the personal data we hold about you, and object to or restrict how we use it. Downloading and deleting your account data you can do yourself from your account page; for anything else, write to privacy@fondolab.com and we will answer within a month.

If you think we handle your data wrongly, you can complain to the data protection authority in your country. In the Netherlands that is the Autoriteit Persoonsgegevens.

Changes

When we change what we store or why, we update this page and its date.