SpinPilotspinpilot
Download

SpinPilot Privacy Policy

Last Updated: August 12, 2026 Effective Date: August 12, 2026

At SpinPilot ("SpinPilot," "we," "us," or "our"), your privacy is important to us. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the SpinPilot mobile application and related services (the "Service").

This Policy is written in plain language. Where we reference a specific technical behavior (for example, where tokens are stored), we describe the actual implementation, not marketing-speak.

The short version: SpinPilot is a cycling computer app. We collect the minimum needed to give you an account and record your rides. Your rides are stored on your device and, when you sign in, synced to your own private cloud account. We do not sell your data. When you connect Strava, your rides upload to your Strava account — we store only non-secret connection metadata in the cloud, never your Strava password or full access token.

1. Information We Collect

1.1 Information You Provide Directly

  • Account information: Email address and password (or, if you sign in with Google/Apple, the email and name returned by that provider).
  • Profile information: Username, display preferences, weight (used for power calculations), and any settings you configure.
  • Optional connections: When you connect Strava, we store only non-secret metadata (provider name, athlete ID, athlete username, connection timestamp). We do not store your Strava password.

1.2 Information Collected Automatically (Ride Data)

When you record a ride, we collect and store:

  • GPS location: Latitude and longitude trail points, recorded continuously while a ride is active.
  • Telemetry: Speed, distance, elevation, heart rate, power, and cadence — from your device GPS and any connected Bluetooth sensors.
  • Ride summaries: Duration, distance covered, average and maximum metrics, and timestamps.
  • Per-sample data: Time-series data used to render post-ride charts (speed, elevation, heart rate, power, cadence over time).

This ride data is generated by you, on your device, and primarily stored locally (see Section 3). Cloud storage only occurs when you sign in and sync.

1.3 Device and Technical Information

  • Device identifiers: A stable identifier used by our backend (Supabase) for authentication session management.
  • Authentication tokens: Your Supabase session token. Strava access and refresh tokens are stored only on your device using the platform's secure storage (flutter_secure_storage), never in our cloud.
  • Cached BLE device IDs: MAC/UUID identifiers of sensors you have paired, stored locally in secure storage for fast reconnection.
  • Connectivity state: We detect network changes (Wi-Fi/cellular/offline) solely to know when to retry syncing — we do not log or share this.
  • Crash and diagnostic data: If and when we add crash reporting, we will update this Policy and minimize what is collected.

1.4 Information We Do Not Collect

  • We do not continuously track your location when the app is closed or a ride is not in progress. GPS collection only happens during an active ride recording.
  • We do not read your contacts, photos (other than images you explicitly choose to share/save), messages, or browsing history.
  • We do not sell, rent, or barter your personal information to anyone.
  • We do not build a profile of you for third-party advertising networks.

2. How We Use Your Information

We use your information to:

  1. Provide the Service: Create and authenticate your account, record and store rides, compute metrics (power, elevation, averages), and display your ride history.
  2. Sync your data: Back up rides to your cloud account and, when connected, upload rides to your Strava account.
  3. Provide navigation and routing: Fetch route suggestions, POIs, and elevation data from map providers.
  4. Improve accuracy: Power and fitness estimations rely on rider weight, bike weight, and historical telemetry.
  5. Communicate with you: Account verification, password reset emails, security notices, and material changes to these policies.
  6. Maintain security and prevent fraud: Authenticate sessions, detect abuse, and protect your account.
  7. Comply with legal obligations: Respond to lawful requests where we are legally required to do so.

We do not use your personal information for targeted advertising.

3. Where and How Your Data Is Stored

3.1 On Your Device (Primary)

The vast majority of your data lives locally on your device:

  • All recorded rides, GPS trails, telemetry samples, and ride summaries are stored in a local SQLite database.
  • Paired sensor IDs are cached in platform secure storage so you don't have to re-pair every ride.
  • Strava access/refresh tokens are stored only on your device in secure storage — they never reach our cloud.
  • Cached map tiles are stored in your device's app cache so rides can be navigated offline.

This means that if you uninstall the app without enabling cloud sync, your ride history will be lost. We strongly recommend signing in to enable cloud backup.

3.2 In the Cloud (When You Sign In)

When you create an account or sign in:

  • Your account credentials and profile are stored in Supabase, our backend provider.
  • Your synced rides are stored in your Supabase-backed account so you can access them across devices and recover them after reinstall.
  • Strava connection metadata (provider, athlete ID, username, connected-at timestamp) is stored in the cloud so your "Connected" status shows on every device — but not your Strava tokens.

3.3 With Strava (When You Connect)

When you connect Strava and a ride is uploaded:

  • The ride's GPX file (or summary stats) is sent from your device directly to Strava using a Strava access token.
  • Once uploaded, the ride is governed by Strava's privacy policy, not ours.
  • We only mark the ride as "synced to Strava" locally; we do not retain a copy of what Strava stores.

3.4 Data Residency

Supabase data is stored in the region configured for our project (typically a major cloud region such as AWS US-East or EU). Map and routing data is fetched from third-party providers (e.g., OpenStreetMap/Overpass, Thunderforest) whose data handling is governed by their respective policies.

4. Legal Bases for Processing (GDPR / UK GDPR)

For users in the European Economic Area, the United Kingdom, and other jurisdictions with similar frameworks, we process your personal data under the following lawful bases:

| Purpose | Lawful Basis | |---|---| | Creating and managing your account | Contract (to deliver the Service you requested) | | Recording, storing, and syncing your rides | Contract | | Connecting Strava at your request | Consent and Contract | | Sending security and account emails | Contract / Legitimate interests | | Improving the Service (aggregate analytics, if added) | Consent or Legitimate interests | | Complying with legal obligations | Legal obligation |

You may withdraw consent for optional processing (such as Strava connection) at any time by disconnecting the relevant integration in Settings. Withdrawing consent does not affect processing that is based on contract or legal obligation.

5. How We Share Information

We share data only as described in this Policy:

5.1 Service Providers (Processors)

We use the following third parties to operate the Service. Each acts as a processor on our behalf and is bound by appropriate data-protection agreements:

  • Supabase — authentication and hosted PostgreSQL database for cloud-synced rides and profiles. supabase.com/privacy
  • Google Sign-In — authentication only. Google Privacy Policy
  • Sign in with Apple — authentication only. Apple Privacy Policy
  • Map data providers (OpenStreetMap, Thunderforest, Overpass) — route and map data. These requests may include the geographic bounding box of the area you are viewing.

5.2 When You Connect Third Parties

Connecting Strava means you direct us to send your ride data to Strava. Once transferred, that data is subject to Strava's privacy controls. Sharing activity cards through the app's share feature sends content through your device's standard sharing mechanism (e.g., messaging, email, social apps) — that sharing is governed by those apps' policies.

5.3 Legal Disclosures

We may disclose information if required by law, court order, or government request, or if we believe in good faith that disclosure is necessary to:

  • Protect the rights, property, or safety of SpinPilot, our users, or the public.
  • Investigate fraud, security incidents, or violations of our Terms.
  • Enforce our Terms of Service.

5.4 Business Transfers

If SpinPilot is involved in a merger, acquisition, or sale of assets, your information may be transferred as a business asset. We will notify you (e.g., via email or in-app) before your information is transferred and becomes subject to a different privacy policy.

5.5 We Do Not Sell Your Data

We have never sold and will not sell your personal information to third parties. We do not buy personal information about you either.

6. International Data Transfers

Your information may be processed in a country other than your own, including the United States and EU, depending on where Supabase, Google, Apple, and map providers operate. Where required, we rely on appropriate data-transfer safeguards (such as Standard Contractual Clauses) for international transfers.

If you are an EU/UK resident, you benefit from the protections described in Section 8 regardless of where your data is processed.

7. Data Retention

| Data type | Retention | |---|---| | Account & profile | Retained while your account is active; deleted within 30 days of account deletion request. | | Cloud-synced rides | Retained until you delete the ride or your account. | | Locally stored rides (on device) | Retained until you delete the ride, clear app data, or uninstall the app. | | Strava tokens (on device only) | Retained until you disconnect Strava or clear app data. | | Cached map tiles | Stored until cleared by the cache manager or you clear app data. | | Authentication logs (Supabase) | Governed by Supabase's retention practices. | | Support correspondence | Retained for as long as reasonably needed to resolve your request. |

If you delete a ride locally, it may still exist in your cloud account if it was previously synced, and on Strava if it was uploaded. You must delete it in each location.

8. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Correct inaccurate or incomplete data.
  • Erasure ("Right to be Forgotten"): Request deletion of your account and associated cloud data.
  • Restriction / Objection: Ask us to limit or stop certain processing.
  • Data Portability: Receive your ride data in a structured, machine-readable format (e.g., GPX exports of your rides).
  • Withdraw Consent: Revoke consent for optional processing at any time (e.g., disconnect Strava).
  • Object to Automated Processing: Where applicable, object to decisions made solely by automated means.

8.1 How to Exercise These Rights

  • Self-service: You can delete rides, edit your profile, disconnect Strava, and delete your account directly in the app's Settings.
  • Contact us: For any other request, email us at [privacy@spinpilot.fit] with the subject "Privacy Request." We will respond within the timeframe required by applicable law (generally 30 days).

8.2 Verification

To protect your account, we may need to verify your identity before fulfilling a request. We will never ask for your full password.

8.3 Children's Privacy

The Service is not directed to children under 13 (or the applicable age of digital consent). We do not knowingly collect data from children. If you believe we have collected information from a child, contact us and we will promptly delete it.

9. Security

We take reasonable measures to protect your information:

  • Encrypted local storage: Sensitive on-device data (Strava tokens, BLE device IDs) is stored using flutter_secure_storage, which uses the platform keystore (Android Keystore / iOS Keychain).
  • Parameterized local database: The local SQLite store uses parameterized queries to prevent injection.
  • Encrypted transit: All network communication with Supabase, Strava, and map providers uses HTTPS/TLS.
  • Authentication: Supabase Auth issues short-lived JWTs; Google/Apple sign-in uses industry-standard OAuth flows.
  • Token storage: Strava tokens live only on your device, never in our cloud — so even a compromise of our backend cannot expose your Strava credentials.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work to protect your information using industry-standard practices.

9.1 Data Breach Notification

If we become aware of a data breach affecting your personal information, we will notify you and the relevant supervisory authority as required by applicable law (e.g., within 72 hours under the GDPR, where feasible).

10. Cookies and Tracking

The SpinPilot mobile app does not use cookies in the traditional web-browser sense. Third-party services we use (e.g., Supabase, Google, Apple) may use equivalent technologies (e.g., session tokens) to maintain authentication. These are functional only and are not used for cross-app tracking or behavioral advertising.

If we launch a marketing website, that site will have its own cookie notice governed by this Policy.

11. Region-Specific Disclosures

11.1 European Economic Area & United Kingdom (GDPR / UK GDPR)

  • Data Controller: SpinPilot (see Section 14 for contact).
  • Lawful bases: See Section 4.
  • Rights: See Section 8.
  • Complaints: You have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, the CNIL in France). We encourage you to contact us first.

11.2 California (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the CPRA:

  • Know the categories and specific pieces of personal information we collect.
  • Delete your personal information.
  • Opt out of the "sale" or "sharing" of your personal information. We do not sell or share your personal information for cross-context behavioral advertising, so no opt-out is necessary.
  • Limit the use of sensitive personal information. Precise geolocation is collected only during active ride recording and is not used for purposes beyond the Service.
  • Non-discrimination: We will not discriminate against you for exercising your rights.

To exercise CCPA/CPRA rights, contact us at [privacy@spinpilot.fit].

11.3 Other U.S. State Privacy Laws

Residents of states with comparable privacy laws (e.g., Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA) may have rights similar to those above. Contact us to exercise any applicable rights.

11.4 Other Regions

Users in Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act), and other jurisdictions with privacy laws have rights that we will honor to the extent required by applicable law.

12. Children's Privacy

The Service is not intended for children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete it.

13. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last Updated" date at the top indicates when the Policy was last revised.

  • Material changes will be communicated through an in-app notice, email, or prominent notice in the Service, and will take effect on the "Effective Date" shown.
  • We encourage you to review this Policy periodically.
  • Continued use of the Service after a change takes effect means you accept the updated Policy.

14. Contact

If you have questions, requests, or concerns about this Privacy Policy or your personal data, contact our Data Protection contact at:

SpinPilot

  • Privacy email: [privacy@spinpilot.fit]
  • General support: [support@spinpilot.fit]
  • Website: [https://spinpilot.fit/legal/privacy]
  • Postal address: [Null]

For EU/UK residents acting as Data Controller representative inquiries, please use the privacy email above and include "GDPR Request" in the subject.

*This Privacy Policy is provided alongside our Terms of Service. Please read both documents to understand the complete terms under which SpinPilot operates.*

Questions? Reach us at privacy@spinpilot.fit or read our Terms of Service.