Privacy policy

Protecting your data matters to us. This app is "offline first" – your data lives primarily on your device and is stored in your personal cloud so you can use it across devices. We show no ad banners, embed no advertising networks and sell no data. The part recommendation links to shops partly via commission links – marked as such and at no extra cost to you (see section 13). To improve the app we collect pseudonymous usage statistics, which you can object to at any time in the settings (see section 10). On our public marketing pages we additionally use web analytics only with your consent (see section 10).

1. Controller

Tobias Meixner, c/o Online-Impressum #7711, Europaring 90, 53757 Sankt Augustin, Germany.
Email: support@bikecare.app

2. Account (email/password, "Sign in with Apple", "Sign in with Google")

For sign-in we store your email address, your optional name and your password exclusively as a cryptographic hash (PBKDF2) – never in plain text. Purpose: sign-in and cross-device storage. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR).

Alternatively you can use "Sign in with Apple" or "Sign in with Google". In that case we receive a unique user identifier from Apple or Google and – if you agree – your email address, in order to create or match your account. With "Sign in with Apple" you can choose whether your real address or an anonymous forwarding address ("…@privaterelay.appleid.com") is transmitted. Legal basis: performance of a contract or pre-contractual measure (Art. 6 (1) (b) GDPR). Apple (Apple Distribution International Ltd., Ireland) and Google (Google Ireland Ltd.) operate their respective sign-in service as independent controllers; their own privacy notices apply additionally (Apple: apple.com/legal/privacy/data/en/sign-in-with-apple). You can disconnect the link at any time in the settings.

3. App data (bikes, parts, rides, service)

The data you enter is stored in your personal cloud so that it stays available on all of your devices. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR).

Documents & receipts (optional). If you upload documents (e. g. a purchase invoice, a bike shop invoice, warranty paperwork, a photo), we store the file privately in your account with Cloudflare R2, located in the EU, together with its file name, file type, size, checksum, an optional document date and its assignment to a bike or a service. Only you can retrieve them; they appear neither in the buyer preview nor in share links or the PDF. BikeCare checks neither their content nor their authenticity. Documents may contain details of third parties (e. g. the name of a shop) – only upload what you are allowed to store. You can delete any document at any time; they are deleted along with the bike or your account when either is permanently deleted. Legal basis: Art. 6 (1) (b) GDPR.

Your own bike photo (optional, BikeCare Pro). With Pro you can add your own photo for each bike, which the app shows instead of the drawing. The app scales it down on your device before uploading; our server additionally removes embedded metadata (e. g. location, camera details, description). We store the photo privately in your account with Cloudflare R2, located in the EU, together with its file type, size, checksum and time. Only you can retrieve it; we do not analyse it, and it appears neither in the buyer preview nor in share links, the PDF or when the bike is handed over. If Pro ends, the photo stays stored and is only shown blurred until you have Pro again or delete it. You can delete it at any time (Edit bike → Remove photo), even without Pro; it is deleted along with the bike or your account when either is permanently deleted. A copy is kept on your device (section 9). Legal basis: Art. 6 (1) (b) GDPR.

Share link for buyers (optional). If you create a share link, we store a frozen extract of your service report (make/model, maintenance history; without costs, notes and documents; frame numbers masked). Anyone with the link can open it until it expires (7 to 180 days). You can withdraw it at any time; expired or withdrawn shares are deleted after 30 days. Legal basis: Art. 6 (1) (b) GDPR.

BikeCare Pass and handover to a new owner (optional). When you open the BikeCare Pass for a bike, we create a record for it: a pass identifier and the fact that this bike has been held in your account since a given date. The pass shows who holds a bike in BikeCare; it is not legal proof of ownership. If you hand the bike on, we create a transfer link at your request: usable once, valid for 7 days and shown only when it is created. Whoever redeems it takes over the bike and receives the documented technical history and the current neutral bike status as a section of its own in the pass – without any information about you: no name, no email address, no notes, no costs, no Strava activities and no documents. Your bike stays with you as an archived private copy. Conversely, if you take over a bike, you see the sections of earlier periods, likewise without any information about the people involved. If you delete the bike permanently or delete your account, the pass goes with it as long as no earlier owner holds a section on it; if one does, the pass remains without a current owner, and your closed period loses its link to your account. Legal basis: Art. 6 (1) (b) GDPR; for the sections of earlier periods, our legitimate interest and that of the respective owner in a traceable history (Art. 6 (1) (f) GDPR).

Partner workshops – only after you grant access. If you release a single bike to a partner workshop, that workshop can view the maintenance data for that one bike in a limited form and confirm a service. Without your release no workshop gets access, and never to another of your bikes. You issue a code for this that can be used exactly once and must be redeemed within 30 minutes; we store it only as a checksum. The release lasts at most 90 days. You can withdraw it at any time – that takes effect immediately – and it ends by itself if you hand the bike on. We delete the record of an ended release after 30 days; if you delete the bike permanently or delete your account, immediately.

What the workshop sees: model year, bike type and motor system, kilometres and how they break down by source, the types of components and the maintenance history – in each case only as values from our catalogue – plus a statement of what is missing from the documentation. All free-text entries stay out, including make and model: anyone can write anything in a free-text field, and we cannot check whether something personal is in there. Also not transmitted are your name and email address, your notes, costs and purchase prices, individual rides, route and location data, connections to other services, conversations with the AI functions, documents and your other bikes. The workshop does not receive frame or serial numbers, not even shortened – less, therefore, than a prospective buyer sees through a share link.

When a workshop confirms a service. The confirmation appears next to your entry and in the summary a later buyer sees. It contains the day of the service, the odometer reading where recorded, the component type and the activities from our catalogue, and the name of the workshop at the time of the statement. There are no free texts: the workshop cannot leave a note, a recommendation or a description – we compose the content from your own entry, and the workshop only says yes to it. A confirmation is not a seal of approval and says nothing about the condition of your bike: we do not check whether the service took place, only that the workshop was released by you at that time and that the statement matches an existing entry. If your workshop uses our programming interface, it can also submit a service itself; a new entry then appears in your history at your device’s next sync, marked as having come from outside. Only date, odometer reading, catalogue activities, costs and whether it was billed under warranty or no invoice was issued can be submitted – no free text. If no sync happens within 30 days, the submission lapses.

How long a confirmation stays, and your rights. It stays with the bike – even if you withdraw the release, the workshop ends its contract or you delete your account, in which case it stays without any link to your account. The reason: a statement about the past that can be removed later would be worthless to a buyer. But it does not stay longer than the bike itself: if you delete the bike permanently or delete your account and no one else has ever owned the bike in BikeCare, its record is removed entirely – and the confirmation with it, because nobody could see it any more. If the bike has changed hands before, its record remains for the other owner, and the confirmation remains with it. The legal basis is our legitimate interest and that of the respective owner in a traceable history (Art. 6 (1) (f) GDPR). The workshop can withdraw its confirmation at any time; after that you see that a confirmation existed and when it was withdrawn – no longer its content. Your own entry is unaffected; it is your statement, not the workshop’s. You may object to the further storage of a confirmation on grounds relating to your particular situation (Art. 21 GDPR); we then examine whether compelling legitimate grounds override – in particular the interest of a current or future owner in a complete history – and record the decision with reasons. Write to support@bikecare.app.

Who is responsible for what. We are responsible for storing and displaying a confirmation. The workshop decides for itself whether to make a statement; for that it is an independent controller with its own duty to inform. We have agreed with every partner workshop who fulfils which duty: we inform you and answer your enquiries about the data stored with us; the workshop answers enquiries about the content of its statement and informs its own customers and staff. You can exercise your rights with either side; our point of contact is support@bikecare.app.

4. Strava connection (optional) – including health data

If you actively connect Strava, we process and store Strava access tokens as well as retrieved activity data (e. g. distance, duration, route, elevation, bike assignment). Where your Strava activities contain them, this also includes heart rate and power data (watts/kilojoules). Heart rate data is health data within the meaning of Art. 9 GDPR. We process it exclusively to show you your rides, statistics and records – there is no further evaluation, no scoring and no disclosure; it is never shared in the community.

Legal basis: your explicit consent, which you give when connecting your Strava account (Art. 6 (1) (a) and Art. 9 (2) (a) GDPR). You can withdraw that consent at any time with effect for the future by choosing "Disconnect Strava" in the settings – rides already imported stay in your account and can be removed there individually or completely by deleting your account.

5. Push notifications (optional)

If you enable reminders, we store your device push subscription in order to send you maintenance reminders. Depending on the device, delivery runs through a different service:

• Web / installed web app: via your browser's web push service (endpoint + keys).
• Android app: via Firebase Cloud Messaging (FCM) from Google – a device token is transmitted to Google.
• iOS app: via the Apple Push Notification service (APNs) from Apple – a device token is transmitted to Apple.

Only the technical token and the content of the reminder are transmitted (e. g. "Chain due soon"). Legal basis: consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time via "Disable notifications" in the settings.

6. Weather (optional)

For the weather tip on the overview, approximate coordinates are transmitted to Open-Meteo (open-meteo.com) – only if you allow location access. For imported rides the start location, rounded to roughly one kilometre, is additionally queried together with the ride date in order to detect wet rides and add the temperature; you can switch that off in the Strava settings. No account or identity data is sent. Nothing is stored at Open-Meteo; the result ("wet", temperature) is then part of your ride. Legal basis: consent / legitimate interest (Art. 6 (1) (a)/(f) GDPR).

7. Friends & comparison (optional)

If you enable sharing, friends and groups you are connected with can see exclusively aggregated figures (e. g. kilometres, elevation, streak, badges, records) and your display name – never costs, locations or individual rides. Legal basis: consent (Art. 6 (1) (a) GDPR). Withdrawal: switch sharing off or leave the connection/group.

8. Password reset emails

If you request a new password, we send an email containing a time-limited link via our service provider Amazon Web Services (Amazon SES, data centre in Frankfurt am Main). Legal basis: performance of a contract (Art. 6 (1) (b) GDPR).

9. Local storage on the device

For offline use the app stores your content locally (IndexedDB/localStorage). If you have added your own bike photo (section 3), a copy is kept in a separate app storage so that it also appears offline; it is deleted when you sign out. This storage is technically necessary to operate the app (Art. 6 (1) (b) GDPR, § 25 (2) TDDDG) and does not serve advertising purposes. For the pseudonymous usage statistics and the device identifier used for them, see section 10.

10. Usage analytics

a) In the app (iOS/Android app as well as the logged-in web app): to understand which functions are used and to improve the app, we collect pseudonymous usage statistics via Google Analytics 4 / Firebase (Google Ireland Ltd., Dublin). Events such as "bike created", "maintenance recorded" or "AI report generated" are recorded together with technical context (platform, app version) and a random app instance identifier. We transmit no advertising ID (no IDFA; on iOS there is therefore no ATT "app tracking" dialog), we do no profiling for advertising purposes, show no ad banners and sell no data. The statistics are not linked to the commission links of the part recommendation (section 13): we do not learn who clicked what or who bought what. Legal basis: our legitimate interest in improving the app in line with actual demand (Art. 6 (1) (f) GDPR). You can object to the usage statistics at any time – under Settings → Data → "Anonymous usage statistics"; after that no analytics events are collected any more.

Crash and error reports: If the iOS/Android app crashes or a programming error occurs, it sends a technical report to Firebase Crashlytics (Google Ireland Ltd., Dublin): type and location of the error, device model, operating system and app version, a random installation identifier, the last screen opened, the startup step reached, the most recent usage-statistics events (e. g. "login", "screen viewed") and your pseudonymous account identifier (no email address, no name). In addition, the app – also in the browser – reports programming errors to our own server, which notifies us by email: error text, technical call stack, page visited, app version and the browser/device identifier. Content such as notes, locations, credentials or your email address is not included; we remove such details from error texts before sending. The sole purpose is finding and fixing errors. Legal basis: our legitimate interest in an error-free, secure app (Art. 6 (1) (f) GDPR). Google processes the crash reports as our processor (transfers to the USA based on EU standard contractual clauses and the EU-US Data Privacy Framework) and stores them for at most 90 days. You can object to crash reports to Crashlytics with the same switch as the usage statistics (Settings → Data → "Anonymous usage statistics"); the objection takes effect from the next app start, reports not yet sent are then discarded.

b) On our public marketing pages (home page, features, pricing, FAQ, login etc.) we use – only with your consent given via the cookie banner – Google Tag Manager and Google Analytics 4 (Google Ireland Ltd., Dublin) in order to understand how our website is used (e. g. page views, where visitors come from, clicks on "Start for free"). Without consent no analytics cookies are set and no data is transmitted to Google (Google Consent Mode v2, default: denied). We manage consent via the consent tool CookieScript; you can withdraw or adjust it at any time via "Cookie settings" in the footer. Legal basis: consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

c) Server-side conversion measurement. In addition our server transmits certain events directly (server to server, Google Measurement Protocol) to Google Analytics 4: sign-in and registration, purchase and subscription events (including transaction ID and order value), subscription cancellation and reactivation as well as account deletion. The transmission is pseudonymous, based on the GA4 client ID, and happens only if you have not objected to analytics (in-app statistics active, section a) or have consented on the web (section b) – if you switch the statistics off, the client ID is removed and no such events are sent any more. Purpose: conversion measurement (sign-ups, purchases). Legal basis: legitimate interest (Art. 6 (1) (f) GDPR) or consent on the web ((a)).

Google processes the analytics data as our processor. Transfers to the USA are based on EU standard contractual clauses and the EU-US Data Privacy Framework. Retention in Google Analytics: 14 months at most.

d) Meta pixel and Meta Conversions API (advertising measurement). If you consent to the “Targeting” category in the cookie banner, we use the Meta pixel and transmit certain events to Meta Platforms Ireland Ltd. (Dublin, Ireland). The purpose is measuring and optimising our ads on Facebook and Instagram and building audiences. Transmitted are: page views, completed registration, creating a bike, connecting Strava, the first calculated maintenance need, opening the Pro page and starting a checkout; server-side additionally the start of a free trial and a subscription purchase (including amount and currency). The data processed are the Meta cookies _fbp/_fbc, your IP address, your browser identifier (user agent) and a hashed internal account identifier. Email address, name and phone number are not transmitted – advanced matching is switched off. Without your consent no Meta script is loaded, no Meta cookies are set and no server-side events are sent to Meta either. In the mobile apps there is no cookie banner; there you control it under Settings › Data › Ad measurement. This measurement is active by default there and can be switched off at any time, permanently. While it is active we start the Meta SDK. It reports installation and app launches and – without any further details about you or your bike – three steps: completed registration, creating your first bike and the first calculated maintenance need. We also pass an anonymous, app-scoped device identifier to our subscription provider RevenueCat, which uses it to report subscription events to Meta. On iPhone and iPad this additionally happens only if you agree in Apple's “Tracking” dialog – if you decline there, nothing is transmitted, regardless of the switch. An advertising ID (IDFA or Google advertising ID) is never used. You can withdraw your consent at any time – on the web via “Cookie settings” in the footer, in the apps via the same switch. Legal basis: consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). We and Meta are joint controllers for the collection and transmission of the data (Art. 26 GDPR); any further processing by Meta is carried out under its sole responsibility. Meta also processes data in the USA on the basis of EU standard contractual clauses and the EU-US Data Privacy Framework. Details: Meta’s privacy policy at facebook.com/privacy/policy.

e) Ad clicks and server-side conversion measurement (Google Ads, OpenAI Ads). If you arrive on our website via an ad from Google, Meta or OpenAI (ChatGPT) and consent to the “Targeting” category in the cookie banner, we store the click identifier the ad appends to the address (gclid, gbraid, wbraid, fbclid, oppref), the campaign parameters (utm_*), the landing page (without address parameters), the time of the click and your consent status – first in your browser, then, once you sign in, on your account. Without this consent none of it is stored. If you then register, start a free trial or buy your first subscription (also later in the app), our server transmits this event to the ad platform your click came from: to Google Ads (Google Ireland Ltd., Dublin) directly via Google's "Data Manager API" – transmitted are the type of event, its time, the Google click identifier, whether it happened on the web or in the app and your consent status, for a purchase additionally the transaction ID, amount and currency; to OpenAI Ads (OpenAI) via our own server container at Stape(withoutsense.bikecare.app, processor) – transmitted are the type of event, its time, the OpenAI click identifier and campaign parameters, the landing page, a hashed account identifier, a pseudonymous event identifier and your consent status, for a purchase additionally the transaction ID, plan, amount and currency. Email address, name, phone number and IP address are not transmitted. The purpose is to measure which ads lead to registrations and purchases. The identifiers are kept on the account for at most 90 days from the click and are deleted with the account. You can withdraw your consent at any time via “Cookie settings” in the footer; on your next signed-in visit we then also delete the identifiers stored on your account. Legal basis: consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Google and OpenAI also process data in the USA on the basis of EU standard contractual clauses or the EU-US Data Privacy Framework.

11. Payment processing – BikeCare Pro (Stripe, app stores, RevenueCat)

For paid Pro subscriptions we use the payment service provider Stripe (in the EEA: Stripe Payments Europe, Ltd., Dublin, Ireland). Payment and billing data is processed (e. g. name, email, payment method, invoice and subscription data). Full card details are processed exclusively by Stripe – they are not held on our servers. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR) and fraud prevention ((f)). Transfers to the USA are based on EU standard contractual clauses and the EU-US Data Privacy Framework. Stripe's privacy policy: stripe.com/privacy.

Purchases in the apps (iOS/Android): If you take out the Pro subscription inside the app, payment is handled exclusively by the respective store (Apple or Google, under their own privacy policies) – we receive no payment data. To match and manage these store subscriptions we use RevenueCat (RevenueCat, Inc., USA) as a processor. Processed are your account ID and pseudonymous purchase/subscription status data (product, term, store, transaction identifiers) – no names, email addresses or payment details. Legal basis: performance of a contract (Art. 6 (1) (b) GDPR); transfers to the USA are based on EU standard contractual clauses. RevenueCat's privacy policy: revenuecat.com/privacy.

12. AI functions – BikeCare Pro (Anthropic & Perplexity)

If you use the AI functions, the inputs and bike data required for them are transmitted to our AI service providers – exclusively in order to provide the respective function (Art. 6 (1) (b) GDPR):

• Anthropic (Claude) – copilot chat. Content submitted via the API is not used for training and is deleted automatically after 7 days at most.
• Perplexity (Sonar) – live web research for the bike auto setup and data sheet. Zero data retention: requests and answers are neither stored nor used for training.

Both process data in the USA (EU standard contractual clauses). Please do not enter particularly sensitive data into the AI functions – it is not needed there.

13. Shop recommendations & affiliate links

The part recommendation suggests suitable spare parts and links to them in online shops. Some of these links are commission links (affiliate links) of the networks ADCELL (Firstlead GmbH, Rosenstr. 17, 10178 Berlin, Germany) and AWIN (AWIN AG, Eichhornstr. 3, 10785 Berlin, Germany). If you buy something after clicking one, we receive a commission from the shop. The price does not change for you. These links are marked as advertising in the app.

When you click such a link, the network forwards you to the shop and sets a cookie or identifier in order to attribute the purchase to our recommendation. This processing happens only after your click and within the responsibility of the respective network or shop – as long as you do not click, nothing is transmitted to them. From the networks we receive only aggregated billing data, no personal details about your order (no names, no addresses, no baskets linked to a person). The legal basis for embedding the links is our legitimate interest in financing the free function (Art. 6 (1) (f) GDPR); for the processing after the click the networks and shops are independent controllers. Their privacy notices apply (adcell.de/datenschutz, awin.com/de/rechtliches).

The selection of products depends solely on how well they fit your bike – not on the size of the commission. Where we find no suitable part at a partner shop, we link to other shops without any commission. Price and availability information comes from the merchants' product data and is updated daily; the price in the shop at the time of your order always prevails. The recommendations are non-binding suggestions – please check compatibility before buying.

14. Recipients / processors

• Cloudflare, Inc. (hosting, database, worker, R2 file storage) – processor under a corresponding agreement (DPA).
• Strava, Inc. – only with an active Strava connection.
• Open-Meteo – coordinates for the weather forecast only.
• Amazon Web Services (Amazon Simple Email Service, data centre in Frankfurt am Main) – sending BikeCare's emails (e. g. password reset, confirmation codes, reminders), processor under a corresponding agreement (DPA).
• Resend – fallback route for sending emails, only if Amazon SES is disrupted.
• Stripe – payment processing (BikeCare Pro only, purchases on the website). See section 11.
• RevenueCat – management of app-store subscriptions (BikeCare Pro only, purchases in the app). See section 11.
• Anthropic (Claude) & Perplexity – AI functions (Pro only). See section 12.
• ADCELL (Firstlead GmbH) & AWIN AG – affiliate networks for the shop links of the part recommendation; both independent controllers, processing only after your click. See section 13.
• Google Ireland Ltd. (Tag Manager, Analytics 4, Firebase) – web analytics on the marketing pages (only with consent), in-app usage statistics, app crash reports (Firebase Crashlytics) and server-side conversion measurement (Measurement Protocol) and Google Ads via the Data Manager API (only with consent). See section 10.
• Stape – operation of our server container for Tag Manager and conversion measurement (withoutsense.bikecare.app), processor; forwards server-side conversions to OpenAI. See section 10.
• OpenAI – ad measurement for ads in ChatGPT (only with consent). See section 10 e.
• CookieScript – consent management (cookie banner) on the marketing pages.
• Apple Distribution International Ltd. (Ireland) – "Sign in with Apple" (only if used, Apple as independent controller) and the Apple Push Notification service (only in the iOS app with notifications enabled). See sections 2 and 5.
• Google Ireland Ltd. (Firebase Cloud Messaging) – delivery of push notifications in the Android app (only with notifications enabled), processor. See section 5.
• Partner workshops – only the one bike you released yourself, and only for the duration of your release. A partner workshop is not a processor but an independent controller for its decision to confirm a service. See section 3.
• The new owner of a bike – only if you hand the bike on yourself via the BikeCare Pass, and only the technical history without any information about you. See section 3.

Where data is transferred to the USA, this happens on the basis of appropriate safeguards: Cloudflare, Stripe, Google, Apple and Amazon Web Services are certified under the EU-US Data Privacy Framework; with the other US providers (Anthropic, Perplexity, Resend, Strava) there are EU standard contractual clauses (SCC) in place.

15. Retention period

We store your data for as long as your account exists. On account deletion (possible in the app at any time) your data including all community entries is removed. Short-lived security data deletes itself automatically: password reset links after 60 minutes, email confirmation codes after 30 minutes, login sessions after 180 days at the latest. Invoice and payment data for Pro subscriptions is kept by us and by Stripe for up to 10 years for tax and commercial law reasons (§ 147 AO).

Two exceptions, both described in section 3: if someone else has taken over your bike via the BikeCare Pass, the section covering your ownership period remains as the origin of their history – without any link to your account and without any information about you. The same applies to a partner workshop’s confirmation, as long as the bike’s record still exists – otherwise it is removed too (section 3). Both are statements about a bicycle’s past whose value lies precisely in the fact that they cannot be removed after the event. You may object to them under Art. 21 GDPR (section 3).

16. Your rights

You have the right to information, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority – the one responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany; you may also contact the authority where you live. There is no automated decision-making.

Please send requests to support@bikecare.app.

17. Minimum age

Our service is aimed at people who are at least 18 years old. By registering you confirm that you have reached this minimum age. We do not knowingly collect data from children.

Last updated: 21 October 2026