Privacy Policy
Last updated: October 25, 2026
Spiniq ("we", "us", "our") operates the Spiniq mobile application (the "App"). This Privacy Policy explains what data we collect, how we use it, and your rights regarding your information.
1. Data We Collect
1.1 Account Data
When you sign in with Google, we collect:
- Email address and display name from your Google account
- A Firebase UID (a unique identifier generated by Firebase Authentication)
This data is stored in Firebase Authentication and on our backend server. If you connect an AI assistant (see Section 1.10), its sign-in page also lets you sign in with Apple or with an email address and password; the same account data is collected.
1.2 Fitness Data
- FTP (Functional Threshold Power): You enter this value manually. It is stored locally on your device and on our backend server.
- Heart rate, power, and cadence: Collected in real time from Bluetooth Low Energy (BLE) fitness devices during workouts. The App records one sample per second and uploads the samples to our backend, where they are stored with the workout to show your history, session summaries and personal records. Raw readings are also written to local log files on your device.
- Workout configuration: Duration and effort level selections are sent to our backend to produce a personalized workout plan.
1.3 Workout Records
When you start a workout, a record (title, duration, FTP, effort level, status, timestamps and the workout plan) is created on our backend and associated with your account. When it ends, we store summary statistics (such as average and maximum power, cadence and heart rate, training load) and your best efforts, which make up your personal records.
1.4 BLE Device Data
During Bluetooth scanning, device names and MAC addresses of nearby BLE fitness devices are read. This data is held in memory and may be written to local log files. It is not sent to our servers.
1.5 Local Log Files
The App writes timestamped log files to your device's cache directory. These logs may include BLE connection events, raw sensor data, device names, and device MAC addresses. Log files are only exported if you explicitly choose to do so using Android's file picker.
1.6 Health Connect
If you connect Spiniq to Health Connect in Profile, the App writes each completed workout (exercise session, heart rate, power and calories burned) to Health Connect on your device. The App does not read data from Health Connect. Data in Health Connect is managed by Android and stays there if you delete your Spiniq account.
1.7 Feedback and Diagnostic Data
When you submit feedback using the in-app "Send feedback" feature, we collect the feedback message and any attachments you choose to include (such as a screenshot), plus diagnostic information (device model, OS version, app version, network type, battery and memory status, and a log of recent in-app activity). Feedback is processed by Shake, our third-party feedback provider.
If the App crashes, a crash report (stack trace, device model, OS and app version, and the app state at the time of the crash) is sent to Firebase Crashlytics, which uses a random installation identifier to count how many devices a crash affects. We use this data only to diagnose issues and improve the App (see Section 4).
1.8 Usage Analytics
To understand how the App is used and improve it, we collect pseudonymous usage events with Google Analytics for Firebase: which screens you open, and events such as signing in, setting your FTP, generating, starting, completing or abandoning a workout, and connecting a device type. Events carry only non-personal details (for example workout duration, effort level, or device type) and are linked to your Firebase UID. Our backend also records server-side events, such as workout generations and access by connected AI assistants, in the same analytics property.
Analytics never includes your name, email address, or raw sensor data, does not use your advertising ID, and is not used for advertising. You can turn analytics off at any time in the App under Profile → Share anonymous usage analytics.
1.9 AI Workout Generation
When you generate a workout, our backend sends the workout request (duration, effort level, your FTP and any adjustments you chose) to OpenAI, which returns the workout plan. Your name, email address and recorded workout data are not sent. We record the number of tokens used and the estimated cost of each request to enforce daily limits.
1.10 AI Assistants (optional)
You can connect an AI assistant (such as Claude or ChatGPT) to Spiniq, or create a personal access token, so the assistant can read your profile, workouts and personal records. Access is read-only, only starts after you approve it on our sign-in page, and can be revoked at any time. Data the assistant reads is then handled under that assistant provider's own privacy policy.
2. Data We Do Not Collect
- GPS or location data (fine-location permission is required by Android for BLE scanning only)
- Photos, camera, or microphone data
- Contacts or calendar data
- Device identifiers (IMEI, Android ID, advertising ID)
- Behavioral data for advertising or ad personalization
3. How We Use Your Data
| Data | Purpose |
|---|---|
| Email and display name | Identify your account and personalize the App |
| FTP | Calculate workout power zones and generate workouts |
| Heart rate, power, cadence | Display real-time metrics during your workout, and store your workout history, summaries and personal records |
| Workout configuration | Generate personalized workout plans on our server |
| Workout records | Maintain your workout history |
| Usage analytics | Understand which features are used and improve the App (can be turned off in Profile) |
4. Third-Party Services
| Service | Provider | Data Shared | Purpose |
|---|---|---|---|
| Firebase Authentication | Google LLC | Email, display name, Google ID token | User sign-in and authentication |
| Google Sign-In | Google LLC | Google account selection | Authentication flow |
| Google Analytics for Firebase | Google LLC | Pseudonymous usage events, Firebase UID, app version, device model and OS version, approximate country | Usage analytics (opt-out in Profile) |
| Firebase Crashlytics | Google LLC | Crash reports, device diagnostics, installation identifier | Crash reporting |
| Spiniq Backend API | Spiniq | Account data, FTP, workout records and samples | Workout generation and history |
| Google Cloud (Cloud Run) | Google LLC | All backend data, in transit | Hosting our backend (Belgium, EU) |
| Neon | Neon, Inc. | Account data, workout records and samples | Database hosting (Frankfurt, EU) |
| OpenAI | OpenAI, L.L.C. | Workout request: duration, effort, FTP, adjustments | Generating workout plans |
| Shake | shakebugs.com | Feedback messages, screenshots, device diagnostics | In-app feedback |
We do not use any third-party advertising services. Usage analytics is used only to improve the App, never for advertising.
5. Data Storage and Security
- Backend data is served by our backend at
api.spiniq.app(Google Cloud, Belgium), stored in a database hosted by Neon in Frankfurt, Germany, and transmitted over HTTPS. - Local data is stored on your device. Android's auto-backup may back up local data to your Google Drive; you can disable this in Android settings.
- Authentication tokens are short-lived and handled by Firebase Authentication.
6. Data Retention
Account and workout data is retained on our servers for as long as your account exists, and deleted when you delete your account. Analytics events are retained for 14 months and then deleted automatically. Crash reports are retained by Firebase Crashlytics for up to 90 days. Local log files are stored in the device cache and may be cleared by the operating system or by you at any time.
7. Data Sharing
We do not sell, rent, or share your personal data with third parties for marketing purposes. Data is only shared with the services listed in Section 4, solely for the purposes described.
8. Your Rights
You have the right to access, correct, or delete your data. You can delete your account and all its data at any time in the App under Profile → Delete account, or by following the steps at spiniq.app/delete-account. For anything else, contact us. You can opt out of usage analytics at any time in the App under Profile. If you are in the European Economic Area (EEA), you may also have additional rights under the GDPR, including the right to data portability and to lodge a complaint with a supervisory authority.
9. Children's Privacy
The App is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have collected such data, please contact us so we can delete it.
10. Permissions
| Permission | Reason |
|---|---|
| Internet | Communicate with our servers and Firebase |
| Bluetooth Scan | Discover nearby BLE fitness devices |
| Bluetooth Connect | Connect to BLE fitness devices |
| Fine Location | Required by Android for BLE scanning; no location data is collected or stored |
| Health Connect (write exercise, heart rate, power, calories) | Save completed workouts to Health Connect, only if you connect it in Profile |
11. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date at the top. Continued use of the App after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights, contact us at: info@spiniq.app