1. Who we are
Cyclo does not sell your personal data, and we use it only to run the features you ask for. This policy explains what we collect, why, and the choices you have.
Cyclo is a bike ride tracking, bike management and analytics app operated by Cyclo Systems Inc. ("Cyclo", "we", "us"), located at 2726 Cabrillo St, San Francisco, CA. This policy applies to the Cyclo website, apps and related services (the "Service").
Effective date: October 13, 2026
2. Information we collect
We collect only what Cyclo needs to track rides, manage bikes and show analytics.
| Category | Examples | Source |
|---|---|---|
| Account information | Name, email address, password (stored hashed), profile settings | You |
| Ride and activity data | GPS routes, distance, duration, speed, elevation, heart rate, power, cadence, timestamps | You, or connected services such as Garmin Connect |
| Bike and equipment data | Bike names, components, mileage, maintenance records | You |
| Health and fitness data | Resting heart rate, sleep or other wellness metrics you choose to share | Connected services such as Garmin Connect |
| Device and usage data | IP address, browser or device type, app version, crash logs, pages viewed | Collected automatically |
| Communications | Support requests and feedback you send us | You |
Location data from ride recordings can reveal where you live or regularly ride. You control which rides are recorded or imported, and you can delete any ride at any time.
3. How we use your information
We use your information only to provide and improve the Service:
- Record, import, store and display your rides
- Track bikes, component wear and maintenance reminders
- Calculate statistics, trends and performance analytics
- Keep your account secure and prevent abuse
- Respond to support requests and send essential service notices
- Diagnose bugs and improve app performance, using aggregated or de-identified data where possible
We do not use your data for advertising profiles, and we do not use Garmin data for any purpose other than providing Cyclo features to you. Where the law requires a legal basis (such as under the GDPR), we rely on your consent, the performance of our contract with you, and our legitimate interest in running a secure, working service.
4. Garmin Connect integration
If you connect your Garmin account, Cyclo receives only the data you approve on Garmin's consent screen, and you can withdraw that approval at any time.
- How it works: You sign in to Garmin Connect directly on Garmin's site. Cyclo never sees or stores your Garmin password. Garmin gives us an access token tied to your Garmin API user ID.
- What we receive: Depending on the permissions you grant, this may include activities (rides, GPS tracks, sensor data) and health or wellness summaries. We check which permissions you granted and receive only that data.
- How we use it: To import your rides and display them, along with related analytics, inside Cyclo. We do not sell, rent or share Garmin data with third parties for their own purposes.
- Disconnecting: You can disconnect Garmin in Cyclo under [Settings > Connections], or remove Cyclo from your Garmin Connect account settings. When you disconnect inside Cyclo, we notify Garmin to end the connection and stop receiving new data.
- Deletion: After you disconnect, you can ask us to delete previously imported Garmin data, or delete it yourself by deleting the rides or your account.
Garmin's handling of your data is governed by Garmin's Privacy Policy. Garmin and Garmin Connect are trademarks of Garmin Ltd. or its subsidiaries.
6. Retention, deletion and security
We keep your data while your account is active and delete it within 30 days after you delete your account.
- Account deletion: Delete your account in [Settings > Account] or by emailing us. This removes your profile, rides, bike records and imported third-party data, and disconnects linked services such as Garmin.
- Backups: Deleted data may remain in encrypted backups for up to 90 days before it is overwritten.
- Legal holds: We keep limited records longer only where the law requires it.
- Security: Data is encrypted in transit (TLS) and at rest. Access tokens for connected services are stored encrypted, and staff access is limited to what is needed to run the Service. No system is perfectly secure, and we will notify affected users of a data breach as required by law.
7. Your rights and choices
You can access, correct, export or delete your data at any time, and we respond to requests within 30 days.
- Access and export: Download your rides and account data from [Settings > Export], or ask us for a copy.
- Correction: Edit your profile, rides and bikes in the app.
- Deletion: Delete individual rides or your whole account.
- Withdraw consent: Disconnect Garmin or other services at any time.
- Regional rights: Depending on where you live (for example, under the GDPR or the California Consumer Privacy Act), you may also have the right to object to or restrict processing, and to complain to your local data protection authority. We will not discriminate against you for exercising these rights.
8. Children
Cyclo is not intended for children under 13 (or under 16 in the EEA and UK), and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
9. International transfers
Your data is stored in the western United States. Where we transfer data across borders, we use appropriate safeguards such as Standard Contractual Clauses.
10. Changes to this policy
We will post any changes here and update the effective date. If a change is material, we will notify you by email or in the app before it takes effect.
11. Contact us
For questions or privacy requests, contact Cyclo Systems Inc. at teddy@cyclo.bike or by mail at 2726 Cabrillo St, San Francisco, CA.