Privacy Policy
CycleLytic — how your data is handled
This policy covers the CycleLytic mobile app for Android (package com.cyclelytic.app) and iOS (bundle com.cyclelytic.ios) and the CycleLytic web app at cyclelytic.com. CycleLytic is developed and operated by Michael Falkson, the developer named on the Google Play and App Store listings. Contact: support@cyclelytic.com. Last updated 29 September 2026.
What data we collect
Account: your email address and display name, and a phone number only if you choose to sign in by SMS or WhatsApp. Sign-in uses a one-time code; we store no password.
Ride and activity data: ride name, date, distance, elevation, duration, speed, power, heart rate, cadence and GPS route. This comes from services you connect (Strava, Hammerhead, Wahoo, ROUVY, Suunto) or from rides you record in the app.
From Strava, if you connect it: we ask Strava for permission to read your activities that are visible to everyone or to your followers (not ones set to “Only You”). For each activity that means its summary (name, type, date, distance, time, elevation, the bike used, and averages such as speed, heart rate and power), its recorded data streams (time, GPS position, distance, altitude, speed, grade, heart rate, power and cadence), the Strava segments it matched, and its photos. From your Strava profile we read your name, profile photo, city, units, weight and sex, and your overall riding totals. We don’t read your followers, messages or anything else. If you turn on the optional wind & weather note, we also ask Strava for permission to edit your activities (Strava lists it as “Upload your activities”). We use it only to add the note below your own description, never to upload, delete or otherwise change a ride.
Location, when you record a ride in the app: the app reads the phone’s GPS to build the ride’s route, distance, speed and elevation. Collection starts when you tap Record and stops when you tap Finish. It continues in the background — with the screen off, the phone in a pocket, or the app not open — so the track has no gaps; a persistent notification is shown while this is happening. Location is never read at any other time, and the app works without it if you only import rides.
Bluetooth sensors (optional): heart-rate and power readings from sensors you choose to pair during a recording. The app scans for nearby sensors only when you ask it to.
Photos (optional): pictures you add to a ride, and comments and reactions you post.
Device: a push-notification token so we can tell you when a ride has finished processing, and basic in-app usage events (which screens are used) to improve the app. No advertising identifier is collected.
Why we use it
To show you your own riding analysed by terrain, to record rides, to run the community features you opt into, and to keep your account working. Nothing is used for advertising, and nothing is sold.
How data is stored and shared
Data is stored on CycleLytic’s hosted infrastructure (a PostgreSQL database and cache files) and encrypted in transit. Connected services such as Strava are sources of ride data; we send them only what is needed to authenticate and sync. The one exception is optional: if you turn on wind & weather on Strava, we add a short wind, weather and terrain note below the description of your new Strava rides. We never upload, delete or otherwise change your rides, and you can turn it off in Settings. Access tokens for those services are stored securely and used only on your behalf. We use no advertising or analytics SDKs from third parties. Payments for CycleLytic Pro are handled by Stripe (web) or the App Store; we never see card numbers.
Who can see your data
By default, only you. If you connect with other riders through the Community feature, they can see your rides, including routes — but only riders you have mutually accepted. You can share a read-only view of your dashboard by link and revoke it at any time. The application administrator has access to user-management functions. Wind & weather ride pages: if you turn on the wind & weather note, each noted ride gets a page at a hard-to-guess link, which appears in the note on Strava. Anyone with the link can see it: your first name, the ride’s name, date, distance and climbing, the weather and wind analysis, and a route map with the first and last 500 m hidden. These pages are not listed in search engines, and they disappear if you delete the ride or your account.
Your choices and rights
Location, Bluetooth, photos and notifications each ask for permission the first time and can be turned off in your phone’s settings. You can disconnect Strava or erase your ride history without deleting your account, from Settings on the web.
Data deletion
You can delete your account and all associated data at any time from Settings → Delete account in the app or on the web. Deletion removes your user record, rides and routes, photos, comments, connections, device tokens and provider access tokens; only a minimal deletion record (email, date, reason) is kept to confirm the deletion and prevent abuse. Full steps are at cyclelytic.com/delete-account.
Children
CycleLytic is intended for adults (18+) and is not directed at children.
Cookies
The website uses first-party cookies only: a session cookie to keep you logged in, one that remembers which version of the home page you were shown, and a random visitor ID (also kept in your browser’s local storage) for up to a year. The visitor ID contains no personal information; we use it only to understand how the site is used — the pages you view and the links you click — and to tell real visitors from bots. It is never shared with advertisers or other third parties, and clearing your browser’s site data resets it. No third-party or advertising cookies are used, and the mobile apps use none of these.
Changes
If this policy changes materially we will note the new date here and, for significant changes, tell you in the app.