Privacy
Turbo Trainer Games · last updated 27 September 2026
Turbo Trainer Games is run from Kent, United Kingdom, and is the data controller for everything described here. We are a small team and this is a closed test, so this page is written plainly rather than in legal language: if anything here is unclear, ask us and we will explain it and fix the wording.
Before this goes past a closed test: UK GDPR requires a privacy policy to name the legal entity that holds the data — a registered company or a named sole trader, with an address. "Turbo Trainer Games" is a product name, not a legal entity, so that line needs filling in before the site is opened to the public.
Write to info@turbotrainergames.com about anything on this page, including a request to see or delete what we hold.
The short version
- The games themselves send nothing anywhere. A game is one file; it reads your trainer over Bluetooth and keeps your settings in your own browser.
- If you asked for a test code, we hold what you typed on that form.
- While you are signed in on the website, we log which game you opened and for how long you rode.
- If you connect Strava, we hold your Strava tokens — encrypted — and your Strava athlete number. Nothing else, and nothing we could read from your Strava account even if we wanted to.
- We do not sell anything to anybody, we run no advertising trackers, and there are no third-party analytics on this site.
What we hold, and why
| What | Why | How long |
|---|---|---|
| Your test-code request: name, email, country, age band, sex if you gave it, your current turbo platform, trainer brand and sensor type, how often and how long you ride, your device, what you would like built, what you would pay, your notes, and the date | To decide who to let into a closed test, to email you a code, and to understand who the games are for. Our lawful basis is your consent, given by ticking the box on that form. | Until the test ends, or until you ask us to delete it |
| Your test code, when it was first used, and how many times you have signed in | To keep the test closed and to see whether a code is being shared | As above |
| Usage: date and time, your test code, which game, how many seconds of riding, your average watts for that stretch, and a one-way hash of your IP address | To see which games people actually ride and which they abandon. The hash lets us tell two testers apart without storing anybody's address. | As above |
| Strava: an access token, a refresh token, when the access token expires, and your Strava athlete number | The only way to upload a ride to your account on your instruction | Until you disconnect, or you ask us to delete it, or the test ends |
| Your settings — FTP, weight, units, sound, which way round the steering goes | So a game remembers you next time | They never leave your own browser; clear your browser data and they are gone |
We do not hold your address, your date of birth, your payment details or any health record. Heart rate and power readings are used live on screen and written into the ride file on your own machine; they are not sent to us, and the usage log keeps only an average watts figure per stretch.
Where it lives, and who can see it
Everything is stored as ordinary files on the web host that serves this site, in a folder blocked to the internet. Only the people running the test can read it, through a password-protected page or over FTP. Our web host processes the data on our behalf as part of hosting the site. We use no other processor, and we share nothing with anybody else — no advertisers, no data brokers, no analytics companies.
Cookies, storage and the usage log
This site sets no cookies at all. Not one, of any kind. There is no third-party analytics package, no tag manager, no tracking pixel and no third-party script anywhere on it — we count visits ourselves, in the plainest way there is, and that is described below. The adverts inside the games are our own artwork, listed in our own table and served from our own server — so there is nothing to personalise and nobody to report to.
Three things are kept in your browser's local storage, on your device, and are never sent anywhere:
- Your sign-in — the signed token that proves you entered a valid test code. Without it you cannot get into a game.
- Your settings — weight, FTP, units, sound, graphics quality and your rider profile.
- Your recent rides — the last few, so the end-of-ride card can show them to you.
All three are necessary for the thing you asked us to do, which is why there is no consent banner standing between you and the site: under the rules, storage that is strictly necessary to deliver what you asked for does not need your agreement, and a banner that claimed otherwise would be inaccurate. Signing out, or clearing your browser data, removes all three.
The usage log, which you can switch off
One thing does leave your browser. When you play, the game tells our server which game it was and how many minutes you actually pedalled, recorded against your tester code. It is how we know which of the sixty-one games are worth keeping and which need work, and it is the whole point of a closed test. It does not store anything on your device, so it is not a cookie question — but it is about you, so you can say no.
The switch is in What this site keeps, at the foot of every page and in the settings panel of every game. Open it now. Turn the usage log off and nothing is sent; everything else keeps working exactly as before.
If that ever changes
If we ever add an advertising network, an analytics package or anything else that watches what you do, it will be switched off until you say otherwise, and you will be asked properly — with a real choice, two buttons of the same size, and no pre-ticked boxes. We will also ask everyone again rather than treating an old answer about something else as agreement.
The visitor counter
We count how many people read the guides, because otherwise we are writing them blind. It is done by our own server, for our own eyes, and it is about as modest as counting can be made:
- No cookie is set and nothing is written to your device. Not for this, not for anything.
- Your IP address is never stored. It is put through a one-way code with a secret only our server knows, and only the result is kept. It cannot be turned back into an address, and because the code changes over time, yesterday's cannot be matched to today's.
- Nothing is sent to anybody else. No Google Analytics, no Plausible, no Facebook pixel, nothing. The only machine that ever sees any of it is ours.
- Your browser's user-agent is not kept. We work out "phone, tablet or desktop" as the visit arrives and throw the rest away, because a full user-agent is most of a fingerprint.
- If your browser sends "Do Not Track", nothing is recorded at all.
What is written down, one line per page view: the date and time, which page, the hostname of the site you came from if there was one (never the full address, which can carry a search you typed), phone or tablet or desktop, a two-letter country code if our host happens to tell us one, and roughly how long the page was open. That is the lot. There is no name, no email, no address and nothing that identifies you.
We are telling you about it anyway, because a code derived from an IP address still counts as personal data under UK law even when nobody can read it, and we would rather over-explain than quietly count you. If you would like us to stop counting your visits, turning on "Do Not Track" in your browser does it immediately, and you can also just ask us.
Strava
Connecting Strava is optional, free, and easy to undo. Every game also saves a plain ride file you can upload yourself, so you never have to connect anything.
What the connection can do
We ask Strava for one permission: activity:write, which lets us upload an activity to your account. We do not ask for, and cannot use, any permission that reads your account. We never read, store or display your Strava activities, segments, routes, followers, photos or profile, and nothing from Strava appears anywhere on this site or in any promotion of it.
What we store
The two tokens Strava issues, encrypted at rest with AES-256-GCM on our server, the time the access token expires, and your Strava athlete number so an upload reaches the right account. The tokens are never sent to your browser and never written into any game file.
What gets posted, and when
Nothing is posted until you press Post to Strava on the end-of-ride screen. Before you press it you can read and edit the title and the whole description. The description is built only from what your bike did in that session — distance, time, average and peak watts, heart rate — never from Strava data. One promotional line, 🎮 turbotrainergames.com, is included by a tick box that is on by default; untick it, or edit it out, and it is not sent. We never add text you have not seen.
Virtual courses
An indoor ride has no real GPS track. If this site has virtual maps switched on, we attach a made-up course in open water off the coast of Corfu so Strava can draw something, and the activity is marked as a virtual ride. The course is deliberately out at sea: it cannot match a real road, segment or leaderboard. Rides uploaded this way are flagged as trainer rides. With the setting off, rides carry no position at all.
Disconnecting and deleting
Press Disconnect Strava on the home page. We call Strava's deauthorise endpoint, delete both tokens and your athlete number from our server, and tell you on screen that it is done. You can also revoke us at strava.com/settings/apps, in which case our stored tokens stop working and are deleted the next time we try to use them. Either way, ask us at info@turbotrainergames.com and we will confirm in writing that nothing remains.
Strava's own part in this. When you use the connection, Strava processes your data under Strava's privacy policy and terms of service, which are between you and them. Strava may also collect data about our use of their API. Turbo Trainer Games is not affiliated with, endorsed by, sponsored by or partnered with Strava; "Strava" and the Strava logo are their trademarks and we use them only as their brand guidelines allow.
Your rights
Under UK GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it, and withdraw your consent at any time. One email does any of those; we will answer within a month and usually within a day or two, because there is not much of it. If you are not happy with how we have handled it you can complain to the Information Commissioner's Office at ico.org.uk.
Children
The test is for adults. Plenty of families ride these games together and a child may well be holding the controller — that is the idea — but we do not knowingly hold data about anyone under 16. If you think we do, tell us and we will delete it.
Changes
This is an early test and this page will change as the platform does. The date at the top is the version you are reading; anything that changes materially will be said plainly on the home page.