Last updated 27 October 2026
The short version
- Your training data is stored on your device. Rides, workouts, your plan and your settings live in your browser. We never receive them, so we can’t see, sell or recover them.
- We use self-hosted, cookieless analytics (Umami) to count visits and see which features get used. It doesn’t use cookies or advertising IDs, doesn’t follow you to other sites, and isn’t shared with anyone.
- We don’t record your screen. There are no session replays and no heatmaps.
- There are no ads, social media widgets, embedded third-party content or third-party fonts. The only outside companies involved are our host, Hetzner (Germany), and, if you email us, our email provider.
Who is responsible
MeepMeep is run by Alexandru Nedelcu, who is responsible for the data processing described here (the “controller” under the GDPR).
Email: contact@meepmeep.cc
For any question about this policy, or to use your rights, email us at that address.
1. Data that stays on your device
The app keeps everything in your own browser’s storage:
- localStorage: your settings (FTP, weight, bike weight, heart-rate values, fueling targets and other preferences) and the Bluetooth devices you’ve paired, so the app can reconnect to them.
- IndexedDB: your rides, your custom workouts, your training plan, and any ride that’s in progress, which is saved every 30 seconds so a crash doesn’t lose it.
None of this is sent to us. The app uses this storage only because you need it to work, so it doesn’t need your consent. Clearing your browser’s site data for meepmeep.cc deletes it all. Settings → Export backup saves a copy as a file on your device.
Bluetooth: your browser connects straight to your trainer, power meter, heart-rate strap or cadence sensor. The sensor data (power, heart rate, cadence, speed) goes to the app on your device and isn’t sent to us.
Files: FIT and .zwo files that you import are read on your device. Files that you export or download are saved on your device. If you upload a FIT file to Strava, intervals.icu, Garmin Connect or another service, that service’s own privacy policy applies.
2. Server logs
Like any website, our server receives some technical data each time your browser asks it for a page or file. Our web server records:
- your IP address
- the date and time
- the page or file requested, and the response
- the referring page
- your browser’s user-agent string (browser, version and operating system) and other standard request headers
Why: to deliver the site, keep it secure (for example, to spot and block attacks) and fix errors.
Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
How long: up to 2 years. We don’t use these logs for analytics.
3. Analytics (Umami)
We run Umami, an open-source analytics tool, on our own server at stats.walpha.cloud, which is hosted by Hetzner in Germany.
Umami doesn’t use cookies or any other identifier stored on your device. It reads one setting in your browser’s storage, umami.disabled, to check whether you’ve opted out.
What it collects on each page view:
- the page address. In the app, ride and custom-workout IDs are removed first. Query parameters are kept: for example, a plan link includes the event name, date and distance.
- the referring page and the page title
- your screen size and browser language
- your browser, operating system and device type, worked out from the user-agent
- your country, region and city, looked up from your IP address. Your IP address isn’t stored.
Feature usage. We also record a short event when you use certain features, so we know what’s used and what’s broken:
- On the website: clicks on “Open the app” and similar buttons, the sections you scroll to, and the FAQ questions you open.
- Rides: when a ride starts or finishes, the workout (a built-in workout’s name, or just “custom”) and its category, its planned length, whether it came from your plan, and whether the simulator was on. When a ride finishes, we also record its length in minutes and its TSS, and whether it was saved or was a test. We also count resumed and recovered rides; fueling prompts you log or dismiss, with the item you logged; FTP updates, with where they came from but not the FTP value; devices you connect, with their type (trainer, power, heart rate or cadence) and whether it worked but not their name; turning on the simulator; and copying the app link on a device without Bluetooth.
- Plans: when you create a plan, the event distance, the number of weeks, your hours and days per week, whether the event has climbing, and whether you came from a plan link. We also count plan edits, deletions and exports, and, when you open a plan link, the race site’s domain.
- Workouts: saving, importing, exporting or scheduling one, with counts, length and number of blocks.
- Ride history: imports (how many worked and how many failed), manual rides (their length and RPE), FIT downloads and deleted rides.
- Backups: exporting or restoring one, with the number of rides and workouts restored.
We never receive your name, email address, exact FTP, weight, heart-rate values, ride files or notes through these events.
How visitors are counted. Umami combines your IP address and user-agent with a secret value that changes every month, then hashes the result into a random-looking ID. This lets us tell that several page views came from the same visitor in the same month, on the same device and network. It can’t link you across months or across other websites, and we can’t reverse it to get your IP address.
Why: to understand how the site and app are used and to improve them.
Legal basis: our legitimate interest in understanding and improving our service (Art. 6(1)(f) GDPR).
How long: 2 years, then deleted.
4. Emailing us
If you email us, we receive your email address, any name your email shows, and whatever you write. We use it only to reply to you and, if you’re using your rights under the GDPR, to handle your request.
Legal basis: our legitimate interest in answering your message (Art. 6(1)(f) GDPR). For requests about your data rights, it’s our legal obligation to answer them (Art. 6(1)(c) GDPR).
How long: we delete emails 2 years after the conversation ends.
5. How to opt out
The website and app work fully without analytics. To stop all analytics, block stats.walpha.cloud in your browser or content blocker.
6. Who else processes the data
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, hosts the website and the analytics server in Germany. Hetzner processes data only on our instructions, under a data processing agreement (Art. 28 GDPR).
- Namecheap, Inc., in the USA, hosts our email, so the emails you send us are processed by Namecheap.
We don’t sell or rent any data, and we don’t share it with advertisers or data brokers. Apart from email (see above), all data stays in the EU.
When you follow a link to another website, such as a race listing or Strava, that site’s own privacy policy applies.
7. Your rights
Under the GDPR, you can ask us:
- for a copy of your data (access)
- to correct it (rectification)
- to delete it (erasure)
- to stop using it for now (restriction)
- to send it to you in a portable format (portability)
Your right to object: you can object at any time to any processing based on our legitimate interest (sections 2, 3 and 4), on grounds relating to your particular situation (Art. 21 GDPR).
Because we have no accounts and don’t store IP addresses, we usually can’t tell which analytics records are yours. To help us find your visits, tell us roughly when you visited and which browser and device you used, and we’ll delete what we can find (Art. 11 GDPR).
You can also complain to a data protection authority, in particular in the EU country where you live or work, or where you think the problem happened.
We don’t make automated decisions about you that have legal or similarly significant effects.
8. Children
MeepMeep isn’t aimed at children under 16.
9. Changes to this policy
When the site changes in a way that affects your data, we’ll update this page and the date at the top.