BikeManager is an iOS app for bicycle maintenance with Strava integration. We only collect what is necessary to make the app work. Your bikes, activities, components, and maintenance logs are stored in a private cloud account (Google Firebase, EU region) so the app can keep your maintenance status accurate, and are also cached on your device for offline use. We use optional, anonymous analytics that are off by default — you choose during onboarding. We show no advertisements, use no tracking cookies, and never sell your data.
1. Who we are
BikeManager is developed by Dynamic Stability Training, based in the Netherlands.
| App | BikeManager for iOS |
| Bundle ID | com.dst.bikemanager |
| Contact | contact@bikemanager.io |
2. What data we collect
2.1 Via Strava (with your permission)
When you connect your Strava account, we request access with the scopes read and activity:read_all. We retrieve the following:
| Category | Data |
|---|---|
| Profile | Athlete ID, username, first and last name |
| Bikes | Name, brand, model, total distance, primary bike |
| Activities | Name, type, distance, elevation gain, moving time, date, linked bike |
| Statistics | Year-to-date total distance |
The Strava API returns additional fields by default (such as speed, calories, and route polyline). These are not stored — only the fields listed above are kept.
Tokens: Strava access and refresh tokens are stored encrypted in the iOS Keychain (kSecAttrAccessibleWhenUnlockedThisDeviceOnly) and securely in our backend (Google Firestore, EU region), so the app can sync your activities in the background even when it is closed.
2.2 Entered by you
| Category | Data |
|---|---|
| Bike components | Name, type, icon, maximum kilometres, replacement date, width |
| Maintenance log | Task name, date, odometer reading, notes |
| Settings | Maintenance thresholds, notification preferences, sync settings |
| Feedback | Title, description, category (voluntarily submitted) |
2.3 Collected automatically
| Data | Purpose |
|---|---|
| FCM device token | Delivering push notifications |
| App version & iOS version | Only when submitting feedback |
| Device model | Only when submitting feedback |
| Anonymous usage events (only if you opt in) | Understanding which features are used, to improve the app |
Analytics is off by default. It only starts if you give explicit consent during onboarding (or later in Settings). We use Google Analytics for Firebase. Events are anonymous product-interaction signals — for example connected Strava, logged maintenance, replaced a component, opened a notification. We collect no advertising identifier (IDFA), do not use App Tracking Transparency, and perform no cross-app tracking.
2.4 What we do NOT collect
- No current location or GPS tracking
- No contacts or address book
- No advertising identifier (IDFA), and no cross-app or cross-site tracking
- No IP-based profiling
- No browsing behaviour outside the app
- No health data (beyond what Strava provides)
- No payment information (handled by Apple)
- No crash-reporting SDKs
- No cookies
3. Where your data is stored
3.1 In your private cloud account (Google Firebase)
BikeManager keeps your data in a private, per-user account in Google Firestore (region europe-west1), so that maintenance calculations stay consistent and your data survives a device change. A copy is cached locally on your device for offline use.
| Category | Data |
|---|---|
| Profile | Strava athlete ID, username, name |
| Bikes | Name, brand, model, distance, primary/retired status |
| Activities | Name, type, distance, elevation gain, moving time, date, linked bike |
| Components | Name, type, icon, maximum kilometres, replacement date, width |
| Maintenance logs | Task, date, odometer reading, notes |
| Settings | Maintenance thresholds, notification & sync preferences, snooze state |
| Sync state | Backfill/reconcile status, webhook deduplication records, FCM token & push preference |
Access control: Firestore security rules ensure that only you (authenticated via your Strava account) can read and write your own data.
3.2 Locally on your device
A subset of your data lives on your iPhone:
- Strava tokens (via iOS Keychain, encrypted)
- A cached copy of your bikes, components, activities, and maintenance logs for offline display
3.3 Processing by Cloud Functions
Our backend (Google Cloud Functions, europe-west1) processes your data to: exchange Strava OAuth tokens, receive Strava activity webhooks, backfill and reconcile your Strava history, compute your maintenance and replacement status, assign activities to the correct bike, send push notifications, and handle feedback and account deletion.
3.4 Sub-processors
| Sub-processor | Services used | Region |
|---|---|---|
| Google (Firebase / Google Cloud) | Firestore, Cloud Functions, Cloud Messaging, Firebase Auth, Analytics | europe-west1 / EU |
| Strava | Activity, bike, and profile API | Global (US-based) |
We do not share your data with advertisers, data brokers, or other third parties.
Strava may monitor and collect data related to your use of the Strava API through BikeManager, in accordance with the Strava Privacy Policy.
4. Why we process your data
| Purpose | Legal basis (GDPR) |
|---|---|
| App functionality (bikes, maintenance) | Performance of contract |
| Cloud sync & maintenance computation | Performance of contract |
| Strava integration | Your consent (OAuth) |
| Push notifications for activity sync | Your consent (in-app setting) |
| Anonymous usage analytics | Your consent (opt-in) |
| Processing feedback | Legitimate interest |
| Security and error prevention | Legitimate interest |
5. Data retention
| Data | Retention period |
|---|---|
| Cloud account data (Firestore) | Until you delete your account |
Webhook deduplication (processedEvents) | Automatically deleted after 30 days (TTL) |
| FCM token | Overwritten on new token; deleted on logout or account deletion |
| Strava tokens (Keychain + backend) | Deleted when you disconnect Strava or delete your account |
| Local cache | Cleared when you log out or delete the app |
| Analytics events | Google Analytics default retention; anonymous |
| Feedback tickets | Retained as long as necessary for support purposes |
6. Your rights
Regardless of where you live, we provide you with the following rights (in accordance with the GDPR):
| Right | How |
|---|---|
| Access | View your data in the app |
| Rectification | Edit your data directly in the app |
| Erasure | Delete your account via app settings — this removes your entire cloud account |
| Disconnect Strava | Disconnect in the app or via strava.com/settings/apps |
| Withdraw analytics consent | Turn analytics off at any time in Settings |
| Objection | Contact us to object to processing |
| Complaint | File a complaint with the Dutch Data Protection Authority |
Response time: Within 1 month, free of charge.
7. Security
We take the following measures to protect your data:
- Keychain storage: Strava tokens are stored encrypted using iOS Keychain, accessible only when your device is unlocked
- Encrypted backend storage: Strava tokens held server-side for background sync are stored securely in Google Firestore
- Firestore security rules: Only authenticated users can read/write their own data
- OAuth 2.0: Secure authentication with Strava via industry-standard protocol
- Firebase Auth: Custom token authentication linked to your Strava account
- HTTPS: All communication with external services is encrypted in transit
- No server-stored passwords: We do not store passwords; authentication is handled entirely via Strava OAuth
No method of electronic transmission or storage is 100% secure. We do our best, but cannot guarantee absolute security.
8. Children
BikeManager is not intended for children under 16 years of age. We do not knowingly collect data from children. If you believe a child under 16 has provided their data, please contact us so we can delete it.
9. International data transfers
Your data may be processed in countries outside the European Economic Area (EEA), specifically:
- Google/Firebase: Servers in
europe-west1(Belgium), but Google is a US-based company. Transfers are protected by Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
10. Changes to this policy
We may update this privacy policy from time to time. In the event of substantial changes, we will inform you via:
- A notification in the app
- An update to the "last updated" date at the top of this document
We recommend reviewing this policy periodically.
11. Contact
For questions about this privacy policy or your data:
Email: contact@bikemanager.io
Supervisory authority: Dutch Data Protection Authority — autoriteitpersoonsgegevens.nl