Privacy policy
Last updated 3 September 2026.
Open Bike is an indoor cycling app. This policy covers the iOS and Android app and this website.
The short version
The app works completely without an account, and with the network switched off. Your rides live on your phone. If you choose to sign in, they are also copied to our database so a second device can see them — nothing else changes. There is no analytics SDK, no advertising, no tracking, and no third party that receives your rides. We do not sell or share your data, and we never see your payment card.
What stays on your phone
By default, everything. The app keeps a database on the device holding your bike setup, your rider settings, any workouts you have written, and every ride you have finished. That database is inside the app's own storage, which iOS and Android keep out of reach of other apps. If you never sign in, that is the only copy that exists and we cannot see it.
What we store, if you sign in
An account is optional and exists for one reason: to carry your history between devices. Creating one stores the following on our servers, hosted by Supabase.
| What | Why it exists |
|---|---|
| Your email address, and a hash of your password | To let you sign in again, and to send you a sign-in code |
| Bike setup and rider settings — resistance range, bike name, weight, riding age | So a second device prescribes the same numbers as the first |
| Finished rides — the workout, the timings, and the estimated effort | Your history, and the trend the Stats tab draws |
| Workouts you wrote yourself | So they follow you to another device |
| Your referral code, and which accounts used it | To credit the free days an invite earns |
| Your subscription status and its expiry date | To know whether the app is paid for; it arrives from Apple, not from you |
| The date you installed the app | To run the free month, and to stop a reinstall starting a second one |
| Anything you type into the feedback box | Because you sent it to us on purpose |
Every one of those rows is protected by row-level security in the database, which means the rules that keep one rider out of another rider's history are enforced by the database itself rather than by the app asking politely.
Your weight is in that list because the power and calorie model needs it — watts on a bike are a function of a body. It is not shared with anyone.
Apple Health
If you allow it, a finished ride is written to Apple Health as an indoor cycling workout, so it counts toward your rings like any other. The app also reads back what your watch recorded during that ride — heart rate and energy — for the minutes of the ride you just finished, and nothing else. Health data is read and written on your device. It is never sent to our servers, never used for advertising, and never shared. You can revoke it in the iOS Health app, and the ride still records normally without it.
Fitbit, through the Google Health API
Optional, and off unless you connect it. If you do, a finished ride is written to your Fitbit account as a stationary bike exercise. The permission asked for is write-only: the app can add a workout and cannot read anything from your Fitbit or Google account. Disconnect it in Settings and the writing stops.
Payments
Subscriptions are sold and charged by Apple. Your card details go to Apple and never touch this app or our servers. What we receive is Apple telling our server that a subscription exists and when it expires.
What we do not do
No analytics or crash-reporting SDK. No advertising and no ad identifiers — the app does not ask for the advertising identifier and would have nothing to do with it. No tracking across apps or websites, and no data brokers. No selling or sharing your data under any definition, including the CCPA's. No location — the app never asks for it, and distance is estimated from the effort you rode because the bike does not move. No cookies on this website, and no analytics or tracking scripts on it either.
How long it is kept
For as long as your account exists. Delete the account and every row above goes with it — the database is set up so that removing the account removes the rides, the settings, the workouts, the referral records and the feedback in the same operation.
Your choices
Do not sign in, and nothing reaches us at all. Sign out, and your rides stay on the phone while syncing stops. Delete your account and everything in it by emailing support@planfor120.com from the address the account uses — within 30 days, usually the same week. Ask for a copy of your data, or ask us to correct it, at the same address. Revoke Health access in iOS Settings and Fitbit access in the app's own Settings.
If you are in the EU or UK, the legal basis for storing the rows above is performance of the contract you entered into by creating an account, and you have the rights to access, rectification, erasure, restriction, portability and objection under the GDPR. You may complain to your national data protection authority.
Children
Open Bike is not directed at children under 13 and we do not knowingly collect anything from them. If you believe a child has created an account, write to us and we will remove it.
Changes
If this policy changes in a way that affects what we collect, the date at the top changes and the app will say so before the change applies to you.