‹ Back to Bike Fit

BikeFit — Privacy Policy

STATUS: DRAFT — NOT FINAL. REQUIRES ATTORNEY REVIEW BEFORE PUBLICATION.

This document was AI-drafted from an internal engineering/product spec

(docs/designs/biometric-data-retention-proposal.md) to give counsel a fast,

technically-accurate starting point. **It is not legal advice, it has not

been reviewed by a lawyer, and it must not be published or relied on as a

binding privacy policy until a licensed attorney in the jurisdiction(s)

BikeFit actually operates in has reviewed and revised it.** In particular,

the "Biometric and Sensitive Data" section below describes a data-handling

design intended to be defensible under Illinois BIPA, Texas CUBI, Washington

HB 1493, California CCPA/CPRA, Canadian PIPEDA, and Quebec's Law 25 — but

whether it actually satisfies each of those regimes, in each jurisdiction

BikeFit operates in, is a legal determination this draft does not make. Every

placeholder below is a reasonable guess, not a decision — see the checklist

at the end.

Effective Date: [PLACEHOLDER — set on publication] Version: 1.0-draft

1. Overview

This Privacy Policy explains what personal data BikeFit ("we," "us") collects when you use the BikeFit mobile and web applications (the "Service"), why we collect it, how long we keep it, who we share it with, and the choices and rights you have over it. It's incorporated by reference into our Terms of Use.

If anything here conflicts with a more specific, in-product disclosure you see at the moment of collection (e.g. the training-data opt-in screen), the in-product disclosure controls for that specific choice.

2. Data we collect

3. Your scan video: two tracks

We treat your raw scan video differently depending on a choice you make. This is the core of our data-handling design, so we describe it in full here (a plain-language summary also appears in our Terms of Use, Section 5).

3.1 Default track — analyze, then delete (applies to everyone, always)

Every scan video you upload, whether or not you've made any choice about the training-data program below, is:

1. Uploaded directly to encrypted cloud storage (never routed through a human reviewer as part of the normal flow);
2. Processed automatically to extract body-joint positions and generate your fit report;
3. Deleted from storage as soon as processing completes successfully.

We do not retain a copy of your original scan video as part of this default path — this is true for every account, regardless of any other setting, unless and until you affirmatively opt into Section 3.2. If a processing attempt fails, your video is retained only long enough to allow a retry (so you don't have to re-upload) and is deleted once processing succeeds or you delete the scan.

The keyframe images extracted from your video (still frames used to illustrate your fit report) are retained as part of your scan history, the same way any other part of your results is, until you delete that scan or your account.

3.2 Opt-in track — face-blurred video retained to train our AI

Separately from the above, you can choose to help us improve BikeFit's fit-analysis and bike-detection models by opting in to let us retain a processed copy of your scan video for that purpose. This is:

• Off by default. We never enable this for you — you must take an explicit action to turn it on, and that action is never combined with, hidden inside, or defaulted by your acceptance of our Terms of Use.
• Presented as a real choice, at account creation, on both our mobile app and website, as a separate control from the (mandatory) Terms of Use acceptance.
• A face-blurred derivative, not your original video. Before this copy is stored, we automatically detect and blur any visible face in the frame. We do not retain an unblurred, identifiable copy as part of this program.
• Time-limited. Retained for up to one (1) year from the date it was created, then automatically and permanently deleted. We do not extend this window on a per-video basis.
• Access-restricted. Stored in a separate, access-controlled location that is not reachable through any of the normal channels used to serve you your own results — it is not part of your visible scan history.
• Used only for the stated purpose: improving our internal fit-analysis and bike-detection models (including via third-party AI training/fine-tuning infrastructure where applicable). We do not sell this data, and we do not use it for advertising or profiling unrelated to bike fit.
• Revocable at any time. Turning this setting off in your profile stops any *future* scan from being added — it does not automatically delete what's already retained (see below).
• Separately deletable on request. You can request deletion of everything already retained under this program at any time, independent of whether you also turn the setting off, from your profile settings. This removes the retained video; it does not affect your account, your own scan history, or your fit reports.
• Re-consent on material change. If we materially change what this program means (e.g. a materially different retention period or use), we'll ask you to review and re-confirm your choice before it applies to you.

3.3 Biometric and sensitive data — specific disclosures

We treat the face-blurring described above as a direct response to the fact that unblurred video containing a visible human face can implicate biometric identifier laws in some jurisdictions (e.g. Illinois' Biometric Information Privacy Act, which defines a "scan of face geometry" as a biometric identifier). To be transparent regardless of how that legal question resolves for our specific pipeline:

• What we collect: your scan video may contain your face in frame. MediaPipe-based pose analysis (the technology we use to measure joint angles) does not read or extract any facial geometry — it measures body joints only (shoulders, elbows, wrists, hips, knees, ankles). We do not perform facial recognition, and we do not generate a facial template or faceprint from your video at any point in our pipeline.
• Why: solely to generate your fit report (Section 3.1) and, only if you opt in, to build a de-identified (face-blurred) training dataset (Section 3.2).
• Retention schedule: immediate deletion for the default path; maximum one year for the opt-in training copy — see above.
• Destruction method: permanent deletion from cloud object storage via an automated process; not merely marked inactive.
• Consent: informed, opt-in, and revocable — never a default, never bundled with unrelated consents, as described in Section 3.2.

[PLACEHOLDER — counsel should confirm this section actually satisfies BIPA's written-notice/retention-schedule publication requirement (and the equivalent under CUBI, WA HB 1493, and Quebec's Law 25), and should assess whether face-blurring is sufficient to take the retained artifact outside the scope of "biometric identifier" entirely, or whether it should still be treated as biometric data out of caution regardless of blurring.]

4. Third-party service providers

We share limited data with the following categories of third parties, solely to operate the Service:

• Cloud infrastructure / storage (currently DigitalOcean) — hosts our application, database, and object storage (including your scan video, for as long as it's retained per Section 3).
• AI/LLM providers (currently Google Gemini, with OpenAI configured as a fallback) — we send derived numeric measurements from your scan (joint angles, positional deltas, and similar computed values) to generate the natural-language portion of your fit report. We do not send your video or any image extracted from it to these providers. This happens for every scan you submit, regardless of your choice under Section 3.2, because it's part of how every fit report is generated — not specific to the training-data program.

We do not sell your personal data. We do not share your scan video with any third party except as described above and in Section 3.2 (our own internal model training, which may use third-party AI infrastructure providers acting on our behalf under confidentiality/data-processing terms — not public release or sale). [PLACEHOLDER — if BikeFit's model-training approach involves a third-party AI training vendor rather than in-house infrastructure, name them here and confirm a data-processing agreement is in place; counsel should also confirm current disclosures accurately reflect whichever LLM providers are actually configured at any given time, since this is an env-var-level choice on our side that can change.]

5. How long we keep your data

6. Your rights and choices

Regardless of where you live, you can, at any time, from your account:

• Access the personal data associated with your account;
• Correct inaccurate body metrics or profile information;
• Opt in or out of the training-data program (Section 3.2);
• Delete your retained training-data video without deleting your account;
• Delete your entire account, which removes your account data, including any retained training-corpus video, subject to any legally-required retention.

If you're a resident of a jurisdiction that grants additional statutory rights (e.g. California's CCPA/CPRA right to know/delete/correct/opt out of sale-or-sharing of sensitive personal information; Quebec's Law 25 access and rectification rights; other comprehensive state privacy laws), those rights apply to you in addition to, not instead of, the self-service tools above. [PLACEHOLDER — counsel should confirm whether a formal request-verification process is required in addition to the in-product self-service tools, and whether an appeals process is required for any jurisdiction BikeFit serves.]

7. Children's privacy

BikeFit is not directed to, and is not intended for use by, individuals under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact us at [CONTACT EMAIL PLACEHOLDER] and we will delete the account and associated data. [PLACEHOLDER — if BikeFit later wants to support minors (e.g. junior racers), this section and the eligibility section of the Terms need substantial rework for COPPA and similar child-specific consent regimes — out of scope for this draft.]

8. Security

We use industry-standard technical and organizational measures to protect your data, including encryption in transit, access-controlled cloud storage, and hashed password storage. No system is perfectly secure, and we cannot guarantee absolute security. [PLACEHOLDER — counsel/security should confirm this is accurate to actual practice and whether more specific claims are warranted or should be avoided.]

9. International users and data transfer

BikeFit's infrastructure is currently hosted in [DATA-CENTER REGION PLACEHOLDER]. If you access the Service from outside that region, your data will be transferred to, stored, and processed there. [PLACEHOLDER — needs a real cross-border-transfer mechanism/disclosure if BikeFit serves Canadian or other non-US users from US-hosted infrastructure — particularly relevant given Quebec's Law 25 and PIPEDA.]

10. Changes to this policy

We may update this Privacy Policy from time to time. Each published version carries a version identifier. If we make a material change to how we handle your data — especially anything affecting the training-data program in Section 3.2 — we will ask you to review and re-confirm your choice before it applies to you going forward, as described in our Terms of Use.

11. Contact

Questions about this policy, or to exercise any of the rights in Section 6 outside of the in-product tools: [CONTACT EMAIL PLACEHOLDER, e.g. [email protected]]. [PLACEHOLDER — some jurisdictions require a named Data Protection Officer/privacy contact; confirm whether that applies to BikeFit's scale and jurisdictions.]

Placeholders / open items for you before this goes to a lawyer

• Legal entity name and registered business address.
• Governing law / jurisdictions actually operated in — drives which of BIPA/CUBI/WA HB 1493/CCPA-CPRA/PIPEDA/Law 25 apply, and whether this draft's BIPA-shaped biometric-notice section (3.3) is sufficient or needs jurisdiction-specific additions.
• Whether face-blurring is legally sufficient to treat the retained training copy as outside "biometric identifier" scope, or whether it should still be handled as biometric data regardless (this draft takes the cautious approach of disclosing as if it might still count).
• Data center region(s) actually used, for the cross-border-transfer section.
• Whether any third-party AI training vendor (beyond the LLM providers named for fit-report generation) is used for the model-training program itself, and whether a data-processing agreement is in place with them.
• Formal data-subject-request process — whether the self-service tools described are sufficient, or whether a manual request/verification/appeals path is also required for specific jurisdictions.
• Contact email(s) for privacy questions and rights requests, and whether a named DPO/privacy officer is required.
• Consent-record post-deletion retention period.
• Effective date, set at actual publication.