Bikit is an independent bike maintenance app created and operated by a single developer, not a company. This Privacy Policy explains what information Bikit stores, why it stores it, and what your rights are.
This policy applies to bikit.app and the Bikit app installed on your device.
Who is responsible
- Data Controller
- Miguel Gomes
- Contact
- support@bikit.app
- Country
- Portugal
What Bikit stores
Bikit only stores the information needed to provide the service. Everything listed below is either information you entered yourself or data returned by a service you chose to connect.
Account
Your email address, your name (if you provided one), and your preferences, including language, distance unit and notification settings.
If you sign in using email and password, authentication is securely managed by Supabase. Bikit never has access to your password.
Sign in with Google
If you choose to sign in with Google, Google provides your name, email address and a stable account identifier. Your Google password is never shared with Bikit.
Your bikes
Information about your bikes, including their name, brand, model, year, type, colour, serial number, frame and wheel size, purchase date, warranty information, photos and notes.
Most of this information is optional and only stored if you choose to provide it.
Components and maintenance
Information about your components, including category, brand, model, serial number, installation date, maintenance intervals and reminders.
Bikit also stores every maintenance event, repair or replacement you log, including the date, notes, and the bike mileage or usage at the time.
Usage totals
The accumulated kilometres and hours for each bike, either entered manually by you or synchronised from Strava.
Strava (optional)
If you connect your Strava account, Bikit stores:
- your Strava athlete ID;
- the access tokens required for synchronisation;
- for each activity matched to one of your bikes: the activity ID, distance and moving time.
Bikit does not request or store GPS routes, location history, heart rate, cadence, power, elevation data or any other ride information.
Push notifications (optional)
If you enable push notifications, Bikit stores the device endpoint assigned by your browser, the associated encryption keys, and your browser's user agent in order to deliver notifications.
Payments (optional)
If you subscribe to a paid plan, Bikit stores your Stripe customer ID, subscription ID, subscription plan and subscription status.
Your payment card details never reach Bikit. Payments are processed entirely by Stripe.
Notification history
Bikit stores a history of maintenance notifications that have already been sent so the same notification is not delivered multiple times.
How your data is used
Your information is used only to provide the service you signed up for, including:
- managing your account;
- storing your bikes and maintenance history;
- calculating maintenance schedules;
- sending maintenance reminders you requested;
- synchronising activities from Strava (if connected);
- processing subscriptions (if applicable);
- keeping the service secure and reliable.
These are the only purposes for which your data is used.
Bikit does not sell your personal information, does not share it for advertising purposes, does not build advertising profiles, and does not use analytics, advertising trackers or third-party profiling tools.
Legal basis (GDPR)
Under the General Data Protection Regulation (GDPR), Bikit processes your information on the following legal bases:
Performance of a contract
Providing your account, storing your data and delivering the core maintenance features. Without this processing, the service cannot function.
Consent
Connecting Strava, enabling push notifications and subscribing to the optional weekly summary email.
You can withdraw your consent at any time through the app settings without affecting the rest of the service.
Legal obligation
Keeping billing and accounting records where required by applicable tax laws.
Legitimate interest
Protecting the service, preventing abuse and maintaining security.
Service providers
Bikit relies on a small number of trusted service providers that process data only to deliver the services Bikit depends on.
- Supabase — authentication and database hosting.
- Vercel — website and application hosting, and cookieless audience measurement on the public pages.
- Stripe — subscription and payment processing.
- Resend — sending emails.
- Google — Sign in with Google (only if you choose it).
- Strava — activity synchronisation (only if you connect it).
- Apple, Google and Mozilla Push Services — delivery of push notifications (only if enabled). These providers receive only the encrypted notification payload and the device endpoint required for delivery.
Where your data is stored
Your primary database is hosted in the European Union (Ireland).
Some service providers may process limited information outside the European Union. Where this happens, they rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or other recognised legal transfer mechanisms.
How long your data is kept
Your information is kept for as long as your account exists.
If you delete a bike, component or maintenance record, it is removed from the active database.
If you delete your account, your personal data is permanently removed, except where certain records must be retained to comply with legal obligations.
Encrypted backups may temporarily contain deleted information until they are automatically overwritten.
Stripe may retain billing records independently for the period required by applicable tax laws.
Your rights
Under the GDPR, you have the right to:
- access your personal data;
- correct inaccurate information;
- request deletion of your data;
- receive a portable copy of your data;
- object to certain processing activities;
- withdraw consent at any time where processing is based on consent.
Many of these actions can be performed directly within the app. For anything else, contact the email address above and you will receive a response within 30 days.
If you believe your personal data has been handled unlawfully, you may lodge a complaint with the Portuguese Data Protection Authority (CNPD) or with the supervisory authority in your country of residence.
Security
Bikit uses industry-standard security measures to protect your data, including encrypted HTTPS connections, secure authentication and restricted access to production systems.
While no online service can guarantee absolute security, reasonable technical and organisational measures are in place to protect your information.
Cookies
Bikit uses only essential cookies. These include:
- a session cookie that keeps you signed in;
- a language preference cookie for the website.
Your light or dark theme preference is stored locally in your browser and is never transmitted to Bikit.
Bikit does not use advertising cookies or analytics cookies, and does not follow you across other websites.
On the public pages — the home page, these documents and the sign-in and sign-up screens — Vercel, which hosts Bikit, carries out cookieless audience measurement. It records the page visited, where the visit came from and the type of device, in aggregate, without storing anything on your device and without identifying you. Once you are signed in there is no measurement at all: what you do with your bikes and components is not observed.
Children's Privacy
Bikit is not intended for children under the age of 16, and accounts should not be created for them.
Changes to this Privacy Policy
This Privacy Policy may be updated from time to time.
When changes are made, the Last updated date at the top of this page will be updated. If any changes materially affect your rights or how your information is processed, Bikit will notify you through the app or by email where appropriate.