CycleNet ("the app") is a social network for cyclists. This policy explains what data the app collects, why, where it is stored, and how you can control or delete it.
Sign-in uses Sign in with Apple or Google Sign-In. We receive only the identifier the provider returns (Apple user id / Google sub) plus, optionally, your name and a relay email if you grant them. We do not see your password.
Your profile (display name, optional photo, bio, preferred units, language) is stored in Google Firestore under users/{uid} and is readable by other signed-in users so the social features (follows, messages, leaderboards) can work.
Location is only sampled while you actively press Bas Pedala (Start Ride). The app does not collect location in the background, does not use Significant Location Changes, and does not run when you close the app or end a ride.
When you save a ride, the polyline (the list of GPS points), distance, duration, elevation, average speed, and optional photo are stored under routes/{routeId}. You choose whether the ride is public (shareable, appears in feeds/leaderboards) or private (only you can see it).
Privacy radius. If enabled, the first and last N meters of the polyline are dropped before upload, and the exposed start/end points are snapped to a 250-meter grid so your home location is not exposed by markers, distance-to-you sorting, or leaderboards.
Bluetooth heart-rate & cadence sensors. If you opt in, the app connects to standard GATT sensors (services 0x180D, 0x1816) and stores readings only inside the active ride record. We never connect to a sensor without your explicit pairing action.
Apple Health (HealthKit). If you grant permission, finished rides are written to Health as HKWorkout samples. Health permission can be revoked any time from iOS Settings → Health → Data Access & Devices. We do not read your historical Health data unless you tap "Import from Apple Health," which lists only cycling workouts in a date range you choose.
Apple Watch companion. When you record from the watch, ride data is sent to your phone via on-device Wireless Connectivity (WCSession). It does not transit our servers until you press Save.
Follows, likes, messages, group chats, and the activity feed work by writing documents to Firestore that other signed-in users can read according to our security rules:
userFeeds/{uid}/items collection on write.When you grant permission, an APNs device token is exchanged for a Firebase Cloud Messaging token and stored under users/{uid}/devices/{deviceId}. Tokens are deleted server-side as soon as the device reports registration-token-not-registered. You can turn notifications off in iOS Settings → CycleNet at any time.
If you grant camera or photo-library access, the resulting image is uploaded only when you confirm (profile photo, ride memory, group photo). Images are stored in Firebase Storage; private images are gated by the same access rules as the parent document.
Files imported via the GPX import screen (Strava, Komoot, Ride with GPS exports) are parsed locally on your device. Nothing leaves the device until you choose to save the resulting ride.
The app uses Firebase Analytics and Crashlytics only for aggregate usage and crash diagnosis. Identifiers are reset when you delete your account. App tracking transparency (ATT) consent is requested before any tracking-class identifiers are collected.
Active accounts: data is kept until you delete it.
Deleted accounts: profile, rides marked private, social graph, messages, and FCM tokens are erased within 30 days. Rides you posted as public remain visible but are anonymized (owner replaced with "Deleted user") so the community keeps what you contributed; you can delete individual public rides before account deletion if you prefer.
CycleNet is intended for users aged 13 and over (16 in the EU/UK). The app does not knowingly collect data from children below that age.
Data is stored on Google Firebase (Firestore + Storage) in the region closest to the Jorasoft project. Standard Google Cloud security applies. Cross-border transfers are governed by Google's Standard Contractual Clauses.
If we make material changes we will note them in the app and update the effective date above.
Jorasoft · 07825 Blairstown, New Jersey · serifoglu.can@gmail.com