LEGAL

Privacy Policy

Last updated: October 3, 2026

This policy explains what personal data zone2 (play.zone2.online and this website) collects, why, who can see it, how long we keep it and what your rights are under the GDPR. Short version: we collect what the game needs to work, we don’t sell data, and there are no ads, analytics or tracking.

01Who we are

The controller of your personal data is [operator: full name or company name, registered address] (“we”, “us”). For anything about your data, write to hello@zone2.online.

02What we collect

Data	What exactly	Where it comes from
Account	E-mail address, player name, password (stored only as a salted hash), when you accepted the terms, whether your e-mail is confirmed.	You, at registration
Profile	Weight, height, FTP, max heart rate, running threshold pace; your rider’s look; settings such as preferred maps and trainer difficulty.	You, in the setup wizard and settings
Rides	For each ride of at least 1 minute or 100 m: sport, map, start and end time, distance, time, averages and maxima, work (kJ), elevation, and a once-per-second record of distance, speed, power, cadence, heart rate and altitude. If you rode in a group, the group’s results.	Your training equipment and heart-rate strap, through the game
Social	Your friends list, friend requests and lobby invites.	You and other players
Live game data	While you play: position on the map, speed, power, cadence and heart rate, sent about once per second and not stored by the world server.	Your equipment, through the game
Technical	IP address (used to limit login and e-mail attempts), session cookie, request logs with errors.	Your browser

Bluetooth devices are paired in your browser. We receive only the readings (power, cadence, speed, heart rate and similar), not your device’s name or identifier.

Guests: a guest’s nickname, rider and settings stay in the browser. While a guest plays, live game data goes to our servers like everybody else’s, but guest rides are not saved: the summary exists only on the screen and disappears when you leave it.

NOTEHeart rate, weight and height are data concerning health. We process them only with your explicit consent, given when you enter them or connect a heart-rate strap. You can play without them: leave the fields empty and don’t connect a strap.

03Why we use it

To run the game and your account (registration, login, saving your rider, settings and rides, ride history and FIT export, friends, group rides): necessary to perform our contract with you, Art. 6(1)(b) GDPR.
To calculate in-game values such as speed from power and weight, heart-rate zones, calories and workout targets from FTP: contract, and for health data your explicit consent, Art. 9(2)(a) GDPR. You can withdraw consent at any time by deleting those values; this doesn’t affect what was done before.
To send e-mails needed for the account: confirming your e-mail and resetting your password. We send no newsletters or marketing.
To keep the Service secure and working (rate limiting by IP address, error logs, preventing cheating and abuse): our legitimate interest, Art. 6(1)(f) GDPR.

We don’t sell your data, don’t use it for advertising or profiling, and make no automated decisions with legal effects.

04What other players see

Everyone on the same map: your player name or guest nickname, your rider, where you are, your speed, power and cadence.
Your friends: whether you’re online, which sport and map you’re on.
Riders in your group (a group ride you joined): your live power and heart rate, and after the ride your name, average power, average heart rate and work on the group podium, which stays in their ride history.
Anyone who knows your player name can send you a friend request.

Your e-mail address, body data and ride history are never shown to other players.

05Who processes it

zone2 runs entirely on Cloudflare (Cloudflare, Inc., USA, and its affiliates): hosting, database, file storage for ride records, real-time game servers, e-mail sending and logs. Cloudflare processes the data on our behalf under its data processing agreement. Data may be processed outside the European Economic Area, including in the USA; such transfers rely on the EU–US Data Privacy Framework, under which Cloudflare is certified, and on the European Commission’s Standard Contractual Clauses.

We use no other processors: no analytics, advertising, social media plugins or external fonts. We disclose data to authorities only when the law requires it.

06How long we keep it

Account, profile, rides and friends: until you delete them or your account.
Login sessions: 30 days from login, or until you log out; expired ones are deleted daily.
E-mail confirmation and password reset links: valid for 24 hours and 30 minutes; deleted 7 days after they expire.
Live game data: only in memory while you play.
Logs: a few days, as kept by Cloudflare.
Guest data: in your browser until you clear it or remove the guest profile.

When you delete your account, your group results remain in other riders’ histories only as your name and three averages.

07Cookies and browser storage

We use only what the game needs, so no consent banner is required:

Name	Type	Purpose
zone2_session	Cookie, 30 days	Keeps you logged in. HttpOnly and Secure.
zone2.settings	Local storage	Game settings on this device.
zone2.guest, zone2.guest.active	Local storage	Guest profile and whether guest mode is on.
zone2.pendingEmail	Session storage	The address to show on the “check your e-mail” screen after registering.

This website (zone2.online) sets no cookies and stores nothing in your browser.

08Your rights

You have the right to:

access your data and get a copy of it;
correct it (most of it you can change yourself in the game);
have it deleted, or restrict how we use it;
data portability: download any ride as a FIT file from your history, or ask us for all your data;
object to processing based on our legitimate interest;
withdraw consent for health data at any time;
lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (PUODO, uodo.gov.pl), or the authority where you live or work.

To use your rights, including deleting your account, write to hello@zone2.online from the e-mail address of your account. We reply within one month.

09Age, security, changes

zone2 is for adults (18+). We don’t knowingly collect data from children; if you think a child has an account, tell us and we will delete it.
Connections are encrypted (HTTPS). Passwords are stored only as salted PBKDF2 hashes and session tokens only as hashes. Login and e-mail attempts are rate-limited.
If we change this policy in an important way, we will tell account holders by e-mail or in the game before the change applies. The date at the top shows the latest version.

10Contact

Questions about your data? Write to hello@zone2.online.