Privacy
Who is responsible
Arthur Pfalzgraf, Germany. Questions about your data: ar.pfalzgraf@gmail.com.
Short version
No accounts, no cookies, no ads, no tracking across sites. Both sites count page views with cookieless analytics that I host myself. The only personal data that reaches a server is what every website request carries (your IP address and browser details), handled by the host and the analytics tool below.
Hosting
Both sites are hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. To deliver the pages and keep them secure, Netlify processes the data each request carries: IP address, date and time, page requested, referring page, browser and operating system. I don't use these logs for statistics or to identify anyone. Netlify acts as my processor under its Data Processing Agreement. Data may be processed in the USA; Netlify is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in running the sites reliably and securely.
Analytics
Both sites use Umami, an open-source analytics tool that I host myself on a server in Frankfurt, Germany. It sets no cookies and stores nothing on your device. It records page views, the referring site, and the browser, operating system, device type and country, and it does not store your IP address. Visitors cannot be identified or followed across sites, and the data is not shared with anyone. Browsers that send "Do Not Track" are not counted. On Croissant Ride it counts visits to the app only: nothing about your rides, sensors or settings is sent. Legal basis: my legitimate interest in knowing how the sites are used (Art. 6(1)(f) GDPR).
Croissant Ride
Croissant Ride (croissantride.com) runs entirely in your browser. Your settings (FTP, weight, units, sound, chosen world), imported sessions and a crash-safe copy of the ride in progress are kept in your browser's local storage on your device. They never reach me or any server, and you can delete them by clearing the site's data in your browser. This storage is needed for the service you asked for (§ 25(2) no. 2 TDDDG), so no consent banner is shown.
Bluetooth sensors (trainer, heart-rate strap, cadence sensor, remote) connect directly to your browser. Their readings, including heart rate, stay on your device until you download a ride file.
A ride leaves your device only when you choose to: "Download .FIT" saves it to your computer, and the "Post to" buttons open the upload page of the service you pick (Intervals.icu, Strava, Garmin Connect, TrainingPeaks), where you upload the file yourself. What happens there is covered by that service's own privacy policy.
Spoken cues use your browser's built-in voices. Some browsers (e.g. Chrome's Google voices, Edge's online voices) send the text of the cue, such as "240 watts, 10 minutes", to their maker's servers to speak it. Mute the cues to avoid this.
Fonts and other content
All fonts and scripts are served from the sites themselves, except the analytics script, which comes from my own server (stats.arthurpfz.com, see Analytics). No content is loaded from anyone else's servers.
Your rights
Under the GDPR you can ask for access to your data (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and portability (Art. 20), and you can object to processing based on legitimate interest (Art. 21). Write to the email above. You can also complain to a data protection authority, e.g. the one in the EU country where you live.