Privacy policy

Last updated: October 2026

Who we are

PuffinERG is operated from Austria by Gunnar Sjúrðarson Knudsen (see Impressum), the controller for the processing described here. Contact: contact@puffinvbt.com.

Data we process

• Account data: your email address, the name you choose to show others, and the identifier of the sign-in service you use.
• Concept2 data, read from your Concept2 Logbook with your permission: your Concept2 account number and username; the access tokens that let us read your Logbook (stored encrypted); and your workouts: date and time, machine, distance, time, stroke rate, calories, drag factor, intervals and splits, comments, stroke-by-stroke data and, where recorded, heart rate.
• What you create here: goals, groups and your role in them, join requests, which goals you take part in, friendships, and what you choose to share with whom.
• Usage data: when you were last active, and server logs that include IP addresses, used to run and secure the service.

Heart rate is health data (Art. 9 GDPR). We process it only with your explicit consent, given when you sign up.

Why, and on what legal basis

• To provide the service you signed up for: goals, groups, trends and sharing (contract, Art. 6(1)(b) GDPR).
• Heart rate: your explicit consent (Art. 9(2)(a) GDPR).
• To operate and secure the service, for example rate limits and logs (legitimate interest, Art. 6(1)(f) GDPR).
• Anonymous usage statistics with Google Analytics: only if you opt in (consent, Art. 6(1)(a) GDPR).

Who can see your data

Other users see only what the service shows by design and what you choose:

• members of a group you are in see your name and your progress on that group's goals you take part in, and when your data was last synced with Concept2 (so they know how current the leaderboard is);
• signed-in members can find you by your name in friend search, unless you turn that off; they see only your name;
• friends see what you share with each of them (workouts, trends and personal goals by default; heart rate only if you turn it on);
• coaches of a group see your workouts and trends only if you allow it for that group, and heart rate only with a second opt-in.

Nobody else sees your email address. Processors working for us: Google Cloud (hosting and database, EU region) and, only if you opt in, Google Analytics 4 (processed under Google's data processing terms with the EU Standard Contractual Clauses; Google may process this data outside the EEA). Concept2 is where your workouts come from: we send Concept2 only the requests needed to read your Logbook, and never write to it. Data is read when you use PuffinERG, and, with live updates on (the default; switch it off on your account page), also when Concept2 notifies us that one of your workouts was added, changed or deleted: we then read that one workout and its stroke data, even if you are not using PuffinERG at that moment.

Cookies and browser storage

• A session cookie keeps you signed in. It is necessary for the service and needs no consent. It expires after 30 days without a visit, and logging out deletes it.
• If you install PuffinERG as an app, your browser keeps a copy of the site's own files (styles, scripts, images) so it loads faster. Your workouts and other personal data are never stored there.
• Google Analytics cookies are set only if you opt in, and you can switch them off on your account page.
• Your light or dark theme is remembered in your browser's local storage and never sent to us.

How long we keep it

Your data stays until you delete it. Deleting your account erases your account, workouts, stroke data, goals, group memberships and friendships immediately. Disconnecting Concept2 deletes the access tokens but keeps the workouts already synced until you delete them with your account. When an owner removes someone from a group, a record that they were removed is kept so they cannot rejoin by link, until the owner allows them again or either account is deleted. Deleted data may remain in database backups until those backups expire.

Children

PuffinERG is for people aged 16 and over. Concept2 accounts marked as age-restricted cannot be connected. If you believe a child has given us data, contact us and we will erase it.

Your rights

You may ask for access to, correction, erasure or portability of your data, restrict or object to its processing, and withdraw any consent at any time, without affecting processing that happened before. You can delete your account yourself on your account page, or email contact@puffinvbt.com. You may also complain to the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).

Changes

If this policy changes in a way that matters, you will be asked to review and accept it again the next time you sign in.