App privacy policy

Data controller

Daniel Ortega, responsible for Pedalytics and for GoForIt (goforit.day). For anything about your data, write to support@pedalytics.bike.

One account for Pedalytics and GoForIt

Pedalytics and GoForIt are two apps from the same controller that share the account and the database: you sign in with the same email, and your bike rides are the same in both. What you record in Pedalytics (bikes, components, maintenance) is only shown in Pedalytics; what you record in GoForIt (gym workouts, food, sleep) is only shown in GoForIt. Deleting the account from either app deletes both.

What data we handle and why

We only handle the data needed for the app to work and the data you choose to add or connect.

• Account: email address, name and username (optional) and password. The password is stored encrypted by our authentication provider and we cannot see it. If you sign in with Apple or Google, we receive your name and email (or the private email you choose) from them. Legal basis: performance of the service you ask for (art. 6.1.b GDPR).
• Your garage: your bikes, their components, the kilometres and hours of each part, the installations and changes you note, the maintenance done and due, and the photos of your bikes you choose to upload. We use them to estimate wear and remind you of maintenance. Legal basis: performance of the service.
• Your rides: date, duration, distance, elevation, GPS route, heart rate, power, cadence, speed, altitude and temperature of each ride, and the bike you rode. They come from Strava if you connect it, from the FIT files you upload, or from Apple Health or Health Connect if you allow it from GoForIt. With them we compute the mechanical load of each part and the ride's statistics. Legal basis: your consent when you connect each source, which you can withdraw by disconnecting it (art. 6.1.a GDPR).
• The weather: for each ride we ask a weather service for the conditions at that place and time (approximate start position and time), because rain and dust wear parts faster. We do not send your name or your full route.
• Photos and camera: only for the bike photos you upload yourself, and to read a barcode or a web page of your bike when importing components. The page is read on your phone; the recognised text is sent to our server only to identify the parts, and the page is not stored.
• Technical data: IP address, date and errors in server logs, for security and to detect faults. Legal basis: legitimate interest in keeping the service secure (art. 6.1.f GDPR).
• Plan: Pedalytics is free. If you have a paid GoForIt plan, we read from the same account whether it is active, because it decides how long we keep the raw data of your rides (see “How long we keep it”). We do not receive your card details.

We do not sell your data, we do not advertise with it and we do not use it to train artificial-intelligence models.

Who we share it with

With providers that handle data on our behalf to provide the service, and with nobody else:

• Supabase (database and authentication, in Frankfurt, European Union) and a virtual private server in Frankfurt that runs our APIs.
• Cloudflare, where the photos of your bikes are stored in a private bucket; each photo is served through a temporary address that only your session can request.
• Strava, if you connect your account: we receive the rides and bikes Strava sends us with your permission, and nothing goes back to Strava. Pedalytics follows the Strava API agreement: when you disconnect, we stop receiving data and delete the connection. Strava is a trademark of Strava, Inc.; Pedalytics is not affiliated with Strava.
• Visual Crossing, the weather service: it receives the approximate position and start time of each ride, with no identifier of yours.
• Apple and Google: if you choose to sign in with them.
• Sentry: it receives server errors so we can fix them, without your name, your email or your ride data.

Some providers may process data outside the European Economic Area. In that case they rely on the safeguards the GDPR provides, such as the EU-US Data Privacy Framework or the standard contractual clauses.

How long we keep it

We distinguish two kinds of data:

• What you record and what we compute per ride (your bikes and components, the maintenance, the summary of each ride with its totals and laps, the wear of each part) is kept for as long as you have an account, on any plan.
• The raw data of each ride (the second-by-second readings of heart rate, power, cadence, speed and altitude, and the GPS route) is a copy of what the source holds (Strava, your FIT file, your watch). An account without a paid plan keeps the last 12 months; with a paid GoForIt plan it is kept while the plan lasts. After that it is deleted and the ride's summary stays; if you connect the source again, it can be imported again.
• The copy of each record a provider sends us (kept so a failed import can be reviewed) is emptied after 30 days.
• Server logs, for as long as the security of the service requires.
• An account nobody enters for 24 months is deleted with everything in it, in both apps. Entering is opening Pedalytics or GoForIt, signing in on the GoForIt website or a sync of one of your sources. A month before, we write to the account's email with the date; opening the app before that day is enough to keep it, and you can export your data first. We never delete an account without having sent that notice.

If you delete your account, we erase your data from our systems immediately, except what we must keep by law. Backups are rotated periodically and any data they contain disappears with them.

Deleting your account

From the app: Profile > Delete account. It immediately deletes the account and everything in it, in GoForIt too. You can also write to support@pedalytics.bike from your account's email with the subject “Delete account”: we delete it within 30 days at most. Deleting the account does not cancel a GoForIt subscription bought through Apple or Google: cancel it first where you bought it.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to support@pedalytics.bike. If you gave us your consent (when connecting Strava, Apple Health or Health Connect), you can withdraw it at any time by disconnecting the source in the app, without affecting the lawfulness of the previous processing.

If you believe we have not handled your data correctly, you can lodge a complaint with the competent supervisory authority; in Spain, the Agencia Española de Protección de Datos (www.aepd.es).

Security

Data travels encrypted (TLS) and is stored with providers that encrypt it at rest. Each account can only read its own data: the database enforces it on every query, not just the app. Strava connections are stored encrypted and no secret reaches the phone.

Children

Pedalytics is not intended for anyone under 16.

Changes to this policy

We will update this policy if the app's data processing changes, and we will tell you in the app when a change affects you. The date of the latest version appears at the top of the page.