Echelon's firmware update made gym bikes phone home — offline use and QZ app broke

A firmware update pushed to Echelon smart home gym equipment in July 2025 forces the machines to connect to Echelon's servers to work properly. As developer Roberto Viola explained in a blog post about his QZ app, on startup the device must log in to Echelon's servers, which send back a temporary, rotating unlock key; without that handshake the device is, in his words, completely bricked — no manual workout, no Bluetooth pairing. Users reported their machines stopped syncing with QZ and could no longer display exercise metrics without an internet connection.

QZ, which launched in 2020 and costs $7–8 to download, connects Echelon machines to platforms like Zwift, Peloton, Strava and Apple HealthKit; it was the No. 9 sports app on Apple’s App Store. Viola first heard of problems from treadmill owners at the end of 2024; the July 2025 update bricked QZ functionality on Echelon bikes. Affected machines now have full functionality only when the Echelon app is active and the machine can reach Echelon’s servers — meaning if the company ever goes out of business, the equipment effectively bricks.

The update's logic, as Ars Technica laid out: Echelon sells hardware, software and subscriptions starting at $40 a month, and apps like QZ overlapped with paid features — QZ can show Peloton classes on an Echelon device while Echelon sells its own classes, including guided scenic rides. Keeping machines online also feeds Echelon usage data for product development and marketing. Echelon did not respond to Ars Technica's request for comment.

No fine — owners lost offline workouts and metrics, the QZ app (No. 9 on Apple’s App Store) broke, and machines are now fully dependent on Echelon’s servers.

The server handshake converts a purchase into a permission: Echelon can degrade or end machines' function remotely.

QZ overlapped with paid features — scenic rides and classes — so the update reclaims subscription revenue the app was bypassing.

Forcing workouts through the company's app also harvests usage data for feature development and marketing.

Buyers were never told the hardware depended on the vendor's servers; some might not have purchased if they had known.

A server-side unlock key turns a purchase into a permission. If connectivity decides whether hardware works, say so before the sale — customers find out after the next firmware push, not before.

Echelon made no public response as of the July 25, 2025 report. Viola urged Echelon to let machines send encrypted data to another device without the internet, and the QZ community began work on a fully open-source Echelon controller to unlock bikes that had already received the update — at a very early stage. Ars framed it as another example of tech firms bricking products customers already own.