BikeShed
Last updated · 2026-06-28

Privacy Policy

BikeShed (“the app,” “we,” “our”) is an iOS app for tracking your bikes, their components, service history, and rides. This policy explains what data the app handles and how. In plain terms: your bike data lives on your device and syncs only to your own private iCloud. There are no accounts to create, we do not operate a server that stores your bike data, we collect no analytics or usage data, and we do not show ads or sell or share your information.

If you have questions, contact us at [email protected].

1. Who we are

BikeShed is an independent app built and maintained by its developer. For the limited processing described below, we are the data controller. The most reliable way to reach us is [email protected].

2. No account, and where your data lives

BikeShed has no login and no user accounts. You do not give us a name, email, or password, and we never ask for one. Everything you enter stays on your device and is mirrored, by Apple, into your own private iCloud database so it can sync across your Apple devices. This uses CloudKit’s private database, which is tied to your iCloud account and is not visible to us — we have no server-side copy of it and no way to read it. If iCloud is unavailable, the app simply works locally.

Everything you enter is covered: bikes, components (including any serial numbers, purchase prices, retailers, and warranty dates you choose to record), service records (costs, who performed the work, notes), rides (distance, duration, dates, notes), and any resource links you add.

Photos you attach to a bike or component are stored as files in the app’s private on-device storage; the database holds only the filename. Photos stay on the device that took them and are not synced through iCloud.

3. Apple Health (optional)

If you choose to connect Apple Health, BikeShed reads your cycling workouts to import rides and keep each bike’s mileage current. Specifically it reads, with your permission, each cycling workout’s date, duration, distance, whether it was indoor/trainer, and — if present — the workout’s route, which is simplified into an overview map line stored on your device.

  • Access is read-only. BikeShed never writes to or modifies your Health data.
  • Health data is read on your device and stays there (and in your private iCloud, like the rest of your bike data). It is not sent to us or to any third party.
  • You can turn this off at any time in iOS Settings → Privacy & Security → Health → BikeShed, or simply never grant it.

4. Connecting Ride with GPS (optional)

If you choose to connect a Ride with GPS account:

  • We store the OAuth access/refresh tokens for that connection in the device Keychain (encrypted, device-only, excluded from backups). We never see or store your Ride with GPS password.
  • We import ride data: trip name, distance, moving time, date, activity type, the bike (“gear”) name the ride was recorded on, and the route of the ride, which is simplified into an overview map line stored on your device.
  • The OAuth token exchange and webhook updates are routed through a small proxy server we operate (at thebikeshed.org) solely so that the Ride with GPS application secret is not embedded in the app. The proxy passes your request straight through to Ride with GPS. It does not log or retain your tokens or your ride data — it keeps no database of users and writes no access tokens or ride contents to its logs.
  • You can disconnect at any time in the app, which deletes the stored tokens.

Ride with GPS is a separate company. Your use of it is governed by Ride with GPS’s privacy policy.

5. Purchases

BikeShed offers an optional paid upgrade (a subscription or a one-time lifetime unlock) through Apple’s In-App Purchase. Apple handles the entire transaction — we never receive or store your name, payment-card details, or Apple Account information. Apple reports to the app only whether a valid purchase or trial is active, so it can unlock features. See Apple’s privacy policy.

6. What we do NOT do

  • No accounts, no passwords. There is nothing to sign into.
  • No analytics or telemetry. The app contains no first-party usage reporting and no third-party analytics or tracking SDKs. We do not measure how you use the app, and we do not collect identifiers, your location for tracking, or your country.
  • No trackers or advertising IDs. The app contains no advertising SDKs and never uses the device advertising identifier.
  • No advertising.
  • No selling or sharing of your data with third parties for their own use.
  • No backend database of your bike data — we do not have a copy.

7. When data leaves your device

Your data leaves your device only in these cases, all of which you initiate:

  1. iCloud sync — your bike data mirrors to your own private iCloud database, handled by Apple under Apple’s privacy policy.
  2. Connecting Ride with GPS — your sign-in and ride sync go to Ride with GPS (via our pass-through proxy). See section 4.
  3. In-App Purchase — handled entirely by Apple. See section 5.
  4. Export / sharing — when you use Settings → Export Data, you choose where the JSON file goes via the standard iOS share sheet. Where it ends up is up to you.

8. How we protect data

  • Connected-service tokens are stored in the iOS Keychain with device-only, when-unlocked protection — encrypted at rest and excluded from iCloud/iTunes backups.
  • iCloud sync is encrypted in transit and at rest by Apple, scoped to your account.
  • All network requests use HTTPS.
  • The app bundle does not contain any third-party login secret.

9. Data retention and deletion

Your data stays on your device (and in your private iCloud) until you delete it. You can:

  • Delete individual items (bikes, components, service records, rides) at any time.
  • Disconnect Ride with GPS, which removes the stored tokens.
  • Delete All Data in Settings → Data, which permanently erases every bike, component, service record, and ride from the device. This cannot be undone.

Uninstalling the app removes its local data. Data already mirrored to your private iCloud can be removed in iOS Settings → [your name] → iCloud → Manage Account Storage.

10. Children

BikeShed is not directed to children under 13 (or the equivalent minimum age in your country) and we do not knowingly collect data from them.

11. Your rights

Because your data is stored on your device and in your own private iCloud, you have direct control over it through the app (view, edit, export, and delete). Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA; because we do not maintain a server-side copy of your bike data, the most complete way to exercise access/erasure rights is through the in-app tools above. For other requests, contact us at the email below.

12. Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected by an updated “Last updated” date and, where appropriate, surfaced in the app.

13. Contact

[email protected]