By Roberto Viola, creator of QZ
On September 10, 2020, I began building QZ (qdomyos-zwift), an app born from a simple idea: open up closed fitness hardware and make it work with the platforms people actually love—Zwift, Peloton, Kinomap, and more.
Back then, Echelon devices—bikes, treadmills, rowers—were locked to their own proprietary app. You bought the hardware, but the experience was fully controlled by the company.
That didn’t sit right with me.
Indice dei contenuti
A Better Bike, Thanks to QZ
QZ started by adding compatibility with Echelon bikes. But I didn’t stop there. I added auto-resistance, letting users enjoy full integration with Zwift or Peloton—sometimes with a smoother experience than Peloton Bike+ itself.
Then came Echelon rowers. Then treadmills. QZ became a bridge between locked-down devices and the open fitness ecosystem.
For five years, it worked perfectly. QZ helped people get more out of their hardware, and—ironically—it helped Echelon sell tens of thousands of bikes. I myself recommended Echelon as the best indoor bike on the market, precisely because it worked so well with QZ.
Until July 2025
That’s when everything changed.
Without warning, Echelon pushed a firmware update. It didn’t just upgrade features—it locked down the entire device. From now on, bikes, treadmills, and rowers must connect to Echelon’s servers just to boot.
Here’s how it works:
- On startup, the device must log in to Echelon’s servers.
- The server sends back a temporary, rotating unlock key.
- Without this handshake, the device is completely bricked—no manual workout, no Bluetooth pairing, no nothing.
What This Means
This server-based lockout creates three serious problems:
- No internet? No workout. Even basic offline usage is impossible.
- If Echelon ever shuts down its servers (it happens!), your expensive bike becomes just metal.
- QZ—and apps like it—can no longer function, because the device refuses to talk unless Echelon says so.
QZ was built to give users freedom and compatibility. This new system gives them dependence and risk.
My Request to Echelon
I’m not asking for open-source code or deep-level access. I ask for a basic fallback:
Let the device send encrypted data locally, even without internet. That way, users retain basic control, and devices won’t become useless if servers vanish.
It’s not just a nice feature. It’s a responsibility.
A Growing Problem in the IoT World
Sadly, this isn’t new. The tech industry is full of stories where devices died because cloud servers were turned off:
- Hive smart cameras and sirens (UK) will stop working in August 2025 due to backend shutdowns.
- Insteon (US) smart home hubs went dark overnight in 2022, leaving homes stranded.
- VanMoof smart bikes bricked after company troubles—users lost remote unlock and tracking.
- Even Google’s Android Things, once a flagship IoT platform, was quietly buried by 2022.
This is the risk of cloud-only hardware. When the servers die, so does your investment.
A Final Word
QZ was made with passion, not profit. It brought life to closed devices. It empowered users. It helped companies grow.
But this new model—where ownership is meaningless without permission from a server—is dangerous. As an Italian, I believe in beautiful, functional things. But they must last, and they must be yours.
Echelon: it’s not too late. Give users a path to independence. Let them ride, row, and run—even offline.
⚠️ Do Not Update Your Firmware
If you’re using an Echelon bike, rower, or treadmill that still works with QZ: do not update the firmware.
The recent updates introduce a non-reversible lockout system. Once installed, your device will:
- Require a constant internet connection.
- Refuse to work without validating against Echelon’s servers.
- Completely block third-party apps like QZ.
There is no way to roll back to a previous version. If you update, you lose control forever.
If you care about device freedom, offline workouts, or open compatibility:
Avoid all firmware updates. Disable automatic updates. Stay alert.
This is infuriating. I paid £1199 for a bike in 2020, and a further £399 for 2 years of classes, so surely what I choose to do with the hardware I purchased outright is none of their business!
If I delete the echelon app and never run it, can I be sure the bike will not find a way to update it’s firmware?
yes this is the best solution. delete the echelon app and you will be safe. be sure, if your bike has a tablet, that the tablet can’t reach internet by itself
Bought my Echelon second hand an went straight to QZ. Never even installed the Echelon app….offers me nothing but more cost.
I’d been tracking the price of an Echelon stepper for a while and had been looking at buying. I’m glad I read about this on Ars. Now I know better.
This is unbelievable, Roberto. I’m a Domyos owner, but I completely support your request to Echelon. The limits of property in the digital license era have to be revisited.
Thanks!
YouTube’s anti-spam filter is preventing me from posting this on Louis’s timely bounty video. For those looking to take on the bounty and create a one-stop shop unbricking system, here is some helpful information that I found when I unlocked and unbloated my Stride-6s-10 about a year ago and switched it to a custom launcher and custom apps. I found at one point that you can use Rockchip development tools to read and write from the NAND memory on my Echelon treadmill. This naturally would extend to other Echelon products as well equipped with Android-based and Rockchip-equipped tablet units. This XDA Developers thread is a chockful of helpful information:
https://xdaforums.com/t/upgrading-glory-star-nebula-21-5-tablet-to-basic-android-rom.4023915/
yes but this is a different story: now they put this rolling key mechanism directly inside the bluetooth controller, not on the tablet :/
Do you know what the Bluetooth controller chip is, I assume it’s an nRF52832 or similar?
Older versions are susceptible to a glitch attack to read out the firmware. I’ve just reversed one of these to get a hashing algo out.
But, I would also assume it’s not going to be that easy, as if they are any good it’ll use public/private key encryption with only the public key in the actual device.
I don’t have access to one of these bikes unfortunately, so I can’t take a look easily.
Has anyone put together a page for reverse engineering this yet?
Hi actually I don’t know, but this is the user that he’s currently check it https://github.com/Dilbert66
Also, Echelon screams scam. If you thought it was fishy, you were onto something: They block all negative customer reviews on their product pages. I had a treadmill fail on me as others have in the past (defective tablet unit) and they kept us from posting our negative reviews. Their ecommerce platform system’s reviews are one deliberately and carefully orchestrated astroturfing scam.
a classic 🙂 thanks for sharing this!
Question:
I LONG ago disconnected the tablet from my Echelon bike, only performing initial setup when new. Since then have only used the bike via the bluetooth connection to QZ on my phone.
Does this mean I’m safe from updates? I don’t think the BODY of the bike (i.e. without tablet connected) has my wifi access embedded in it but I guess it’s possible (I’ve never seen the bike on my WLAN since I tossed the tablet).
I hope so,.. I purchased this bike BECAUSE of QZ! I Never had ANY intention of using their dumb app and, as the tablet had zero useful functionality (like LAN media viewing), I tossed that in favor of a stand-alone android tablet.
yes you are good to go!
Echelon probably sell their hardware as a loss-leader (i.e. at or below cost) on the basis that it enables them to lower the purchase price to attract buyers. That business model fails when people purchase e.g. a bike but never subscribe. I can well believe that others buy their bike solely because it is a nice piece of hardware in the comfort of the knowledge they can use decent software with it. I tried once their app and – yes it was horrible – deleted it straight after.
It’d be helpful to link from this ticket (and have) an FAQ for existing Echelon users and – sadly – to warn newcomers that we no longer recommend purchasing an Echelon bike (new or secondhand) unless the situation is resolved.
An FAQ should verify that there is no hazard unless someone runs their app. Then its game over.
I’m on an EX-5 (no screen, bluetooth only) so it only gets on the network through my phone. I am now never going to update the firmware.
As this is about money, Echelon should be asked if they would accept payment as a way to unlock the hardware. An incentive for them is that many of their devices are going to be headed straight for the junkyard and – given their 1.7 star rating – attract even more negative reviews. That could sink their company and their investors and owners should care about that.
QZ may have given them a bump in sales but they are not coming back from 1.7 easily.
Martin