Zombike
en
Try free for 7 days

Privacy Policy

Last updated: 26 October 2026. Here we explain which personal data Zombike processes, for what purpose, on what legal basis and for how long. We comply with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act.

1. Controller

Zackplan GmbH, Lessinggasse 23/6, 1020 Vienna, Austria
Commercial register no. FN 561867 a, Commercial Court of Vienna
Email: hello@zombike.app, phone: +43 660 71 51 690

2. The most important points

3. Visiting the website and server logs

When you open zombike.app, our hosting provider and the delivery network process technically necessary connection data, mainly your IP address, date and time, the page requested and information about browser and device. This is necessary to deliver the page, fend off attacks and keep operations secure. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). The logs are kept only for a short time.

Own usage statistics and error log

So that we can see whether Zombike works and where users run into problems, the app and our information pages (blog, training plans, workouts, pricing) record simple events: which page was opened, whether a sign-in, a subscription, a workout or a ride was started, whether a trainer could be connected, and technical error messages. This includes a random identifier that only applies to the respective browser tab (it is stored in the tab without a cookie and ends when you close it), for signed-in users the account identifier, page path, time and the origin of the visit (for example the referring website). In doing so we store no IP address, set no cookies, create no profiles across several devices and pass the data on to nobody. The evaluation takes place on our own servers (Supabase, EU). If your browser sends “Do Not Track” we record nothing. The legal basis is our legitimate interest in a stable, secure and improved service (Art. 6(1)(f) GDPR). You can object to this (contact see section 1). We delete raw data after 180 days.

4. Account and sign-in

For an account we need your email address. You sign in without a password using a code we email to you. In doing so we store your address, the time of sign-in and the time of your consent to the Terms. You can choose a display name that is visible to others in the leaderboard. The legal basis is performance of the contract for the use of Zombike (Art. 6(1)(b) GDPR). We store the proof of your consent on the basis of our legitimate interest in documentation (point (f)).

5. Training, rides and leaderboard

When you ride, we process power (watts), cadence, speed, duration and distance. Rides are first stored in your browser and then synchronised with your account so that you see them on the dashboard, in the activity overviews, in the garage and in the leaderboard. Your display name and your results are visible to other users in the leaderboard. If you do not want that, choose a name that does not identify you. We check performance values automatically for plausibility (to prevent manipulation). This has no legal effect for you other than the possible removal of an implausible entry.

We store your training plans (chosen plan, completed sessions) and your settings (for example FTP, bike and rider in the garage) with your account. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

6. Heart rate (health data)

Heart rate is voluntary. We only process it if you connect a heart-rate sensor or a trainer with a heart-rate display. Because heart-rate data can allow conclusions about your health, we treat it as a special category (Art. 9 GDPR). The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you give by deliberately connecting the sensor. You can withdraw it at any time for the future by disconnecting the sensor. You can have rides already stored with heart rate deleted by us (see section 13). We use heart rate only to show it to you and to store it in your rides, not for advertising and not to assess your health.

7. Story mode (calculated on the server)

The story modes are calculated on our servers. During a ride we send your power values at short intervals to our servers (Supabase functions), which calculate the game state from them and send back only the result. We store the run, game state and result with your account. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

8. Payments and subscription

Payments are handled by Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). You enter your payment data there, we do not see card numbers. We only receive and store a customer identifier, the status of your subscription, the chosen plan, the period and the invoice data. If tax calculation is enabled, Stripe also records your billing address to calculate value added tax according to your country. The legal bases are performance of the contract (Art. 6(1)(b) GDPR) and statutory retention and tax obligations (point (c)). We have the necessary agreements on data processing and data transfer with Stripe.

9. Friends offer

Every account has a personal invite code. If someone signs up through your link, we link the two accounts so that the free month can be credited. You only see the number of your invited friends and the status of the free months, not their names or email addresses. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

10. Emails

We send you emails that are necessary for operation: the sign-in code, notices about your account or subscription and legally required messages. Resend handles the delivery. We send promotional emails or reminders only if you have expressly consented, and you can unsubscribe at any time.

11. Recipients and transfers to third countries

We pass data only to service providers we need to operate the service. They process it on our behalf or under their own responsibility for their task:

Some of these providers belong to companies based in the USA. A transfer to a country outside the EU only takes place with suitable safeguards, for example on the basis of the EU Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework (Art. 44 et seq. GDPR). We do not pass data on for advertising purposes.

12. Storage period

13. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You can withdraw a consent you have given at any time for the future. Write to hello@zombike.app for this. We usually reply within one month.

If you believe we process your data unlawfully, you can complain to the supervisory authority: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at. You can also turn to the authority in the country where you live.

14. Local storage in your browser

Zombike stores in your browser (localStorage and IndexedDB) data that is necessary for operation: your sign-in, settings (for example FTP, display, goals), your chosen difficulty, your chosen language, a random tab identifier for the usage statistics (only until the tab is closed), rides not yet transmitted, the ride in progress as a backup (so you can continue it after a reload) and a training plan chosen before sign-in. This is technically necessary, so no consent is required for it. We do not set advertising or analytics cookies. You can delete the data through your browser settings; you will then have to sign in again.

15. Minors

Zombike is aimed at adults. Minors need the consent of their legal guardians (see the Terms).

16. Changes

We adjust this policy when Zombike or the legal situation changes. You will always find the current version here. For material changes we inform you in the application or by email.