Legal

Privacy Notice

Effective 1 November 2026 (preview) · Deutsche Fassung

Who is responsible

Pushing Ideas GmbH, Gildestraße 20, 48477 Hörstel, Germany (see the legal notice). Questions about your data, and withdrawals of consent, go to jan@pushinglimits.club at any time. Data protection officer: Jan Staggenborg.

muntro in this preview

muntro is a cycling game in the browser, offered from 1 November 2026 as a preview to people we invite by link. To ride you need a muntro account or a Pushing Limits (PLC) account linked to muntro. During the preview muntro Plus is free for every account until 31 December 2026: nothing is sold and no payment data is processed.

Your account

Your email address and display name; when you completed sign-up and accepted the terms and this notice, with the version you accepted and the IP address and browser identification of that moment; hashed session secrets with their expiry; one-time sign-in links, stored only as hashes and valid for 15 minutes; and counters that limit how many sign-in emails an address receives. We use them to create and protect your account and sign you in (Art. 6(1)(b) GDPR); the acceptance record lets us prove the acceptance (Art. 6(1)(f)). Sessions last 30 days and revoked sessions are removed 7 days later; sign-in links when they expire; an account whose sign-up is not completed within 24 hours is removed; the rest is kept until the account is deleted.

Rider profile, rides and progress

Your rider profile (FTP, weight, optional maximum heart rate, time zone, visibility choices, game and trainer preferences, rider-kit colours and artwork); saved rides with the samples your equipment and the game supply (time, distance, power, heart rate, cadence, speed, position in the game world, gradient) and the summaries, training metrics, zones and maps we derive from them; route progress, completed routes and achievements; your saved workouts. We use them to run the game, save and analyse your rides, give you FIT files and restore your progress on any device (Art. 6(1)(b)). They are kept until you delete a ride or your account; completed route-attempt receipts are removed after 7 days.

Riding with others

In the shared world other riders see your display name, rider kit, position and live ride figures while you ride; event results keep your display name, weight and W/kg. Friendships, blocks, clubs, invitations, club events and notifications are stored as you create them. A chat report keeps at most five recent messages of the reported rider as evidence, a community report the reason and your description, both for 180 days (longer only while a moderation action refers to them). Basis: Art. 6(1)(b); moderation evidence: our legitimate interest in a safe community (Art. 6(1)(f)).

Pushing Limits (PLC)

In this preview PLC is the only connected service. When you sign in with PLC or link it, PLC tells us your PLC account identifier, your email address and whether it is confirmed, your first name and your display name. If a muntro account with the same confirmed email address already exists, it is linked to your PLC account. We store the PLC identifier and name, the granted permissions and the PLC access tokens, encrypted.

Once linked, ride sync and the import of planned workouts are switched on: each saved ride goes to PLC as a FIT file with its title and an identifier that prevents duplicates, on first linking your most recent rides (up to 100) are sent as well, and your dated planned cycling workouts are taken over from PLC. You can switch either off, or unlink PLC, in the app; unlinking removes the connection, queued uploads and imported plans at once, and a withdrawal of the token at PLC is kept only until PLC confirms it. PLC is run by the same company; for data held in PLC its own privacy notice applies. Basis: Art. 6(1)(b), the connection you ask for.

Performance data (on by default)

So that the game runs smoothly on as many devices as possible, it sends anonymous performance data while you ride. It is on by default. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, it stays off unless you switch it on.

What is sent. With each ride record, under a random session identifier that is new for every ride and every page load:

What is not sent. No account, name, email address, real location or cookie. The performance data is stored without an IP address; only the web server's request log (below) records the request itself.

A page that ended without warning. If the browser ends the game without warning (for example when it runs out of memory), the next load reports this once: the start-up step it reached, a short browser and device class, the quality tier, memory figures and how long it ran. This note follows the same switch.

Purpose and legal basis. We use the data only to find where in the game world and on which devices the game stutters or fails, to fix it, and to tune the quality settings for each class of device: our legitimate interest in a stable game (Art. 6(1)(f) GDPR).

Retention. Single ride records, including the positions in them, are deleted after 90 days. Daily statistics per game version, device class and route, without any single ride or position, are kept for longer.

How to switch it off. In the game, open Settings › Feedback & privacy and turn off "Share anonymous performance data". From then on this browser sends nothing more, and a ride in progress is not sent. The choice is kept in your browser's local storage; clearing it resets the switch to the default.

Usage analytics (off by default). In the same place, "Share how I use the game" is off unless you turn it on. If you do, the game records which screens you open and whether rides start and finish, tied to a random identifier this browser keeps only while the switch is on and never to your account. Turning it off deletes the identifier.

Feedback you send

Your text and the type of report; a snapshot of the game at that moment (route and the place on it, position in the game world, heading, speed, camera, quality tier, render scale, browser, game version, time); a screenshot and up to four photos if you attach them; your account identifier if you are signed in; and your IP address, to stop abuse of the form. We use it to understand and fix what you report (Art. 6(1)(f)). Reports and their photos are kept for at most 12 months and then deleted automatically; we delete them earlier if you ask us to.

Rider images (logos and kit art)

Signed-in riders can upload a logo or kit artwork for their rider kit. Before uploading, you confirm that you own the design or have the right to use it and that it contains no third-party trademarks or illegal content, and you grant muntro a non-exclusive, worldwide, royalty-free licence to store, process (resize and re-encode), check automatically and show the image to other riders in the game for as long as you use it and until it is deleted. An account can keep up to ten images; you can delete them in the avatar section, any rider can hide another rider's images on their own device, and muntro can remove any image.

Automated check. Before an image is stored or shown to anyone, muntro sends the image (and nothing that identifies you) to the OpenAI API for an automated check for sexual, illegal, extremist, hateful or violent content, personal data, QR codes or links, and third-party brands, team crests or sponsor marks, with response storage turned off. OpenAI processes the image on muntro's behalf; this can involve a transfer to the United States under OpenAI's data processing addendum and the EU Standard Contractual Clauses. An image the check refuses is not stored or shown, and you are told the reason.

Upload log. For every upload muntro records your account, your IP address, the time, the image's fingerprint, the version of the confirmation and licence you gave, and the result of the check, to prevent abuse, enforce the upload terms and establish, exercise or defend legal claims (Art. 6(1)(f)). The IP address is deleted after 12 months and the rest of the log after 3 years.

Server logs

The web server logs each request (a shortened IP address with its last part removed, time, address requested, browser identification, result) for security and fault finding (Art. 6(1)(f)). The logs are rolled over by size and the oldest files are deleted. For the preview we also keep a daily working copy of the stored performance records, crash notes and feedback on the operator's computer to read them each morning; each day's copy is deleted after 30 days.

Storage in your browser

muntro sets no tracking or advertising cookies and none from third parties. Its own cookies: __Host-muntro_session keeps you signed in (HttpOnly, Secure, SameSite=Lax, 30 days); __Host-muntro_recovery holds a short account-recovery step (Strict, at most 15 minutes); muntro_plc_login binds a PLC sign-in to this browser (Lax, 10 minutes). The game also keeps on your device, and sends only where this notice says so: game settings, paired sensors, your custom routes, ghost rides, your album and completed-route marks, ride and progress data not yet sent so a network failure loses nothing, a ride checkpoint to recover a crashed ride, and the two privacy switches. These are needed for the game you use (§ 25(2) no. 2 TDDDG); you can clear them in your browser.

Who receives data

Hosting: Hetzner Online GmbH, Germany, runs the server with the game, the account and ride database and the logs. Sign-in emails are sent through Amazon Web Services (Amazon SES, region Frankfurt). PLC receives data as described above, only when you sign in with it or link it. OpenAI receives rider images for the automated check. muntro uses no analytics, advertising or font services, and the game loads nothing from other domains.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR), and you can withdraw a consent at any time with effect for the future. In the app you can change visibility and preferences, delete single rides, unlink PLC, download your data (a JSON copy of your account data with your rides' files) and request deletion of your account. You may also complain to a supervisory authority, for example ours: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.

Deleting your account

In the app (account › delete; a recent sign-in is required) you can ask for your account to be deleted; the request takes effect after 14 days, until then you can cancel it. An account that owns a club must hand it over or delete it first. During the preview the final deletion is carried out by us, not automatically: we complete each due request within one month. You can also write to jan@pushinglimits.club. Deletion removes the account with its rides, profile, progress, social records and connections; reports you filed lose the link to your account.

Changes

We update this notice when the preview or its use of data changes; the date at the top tells you which version you are reading.