Pinned Privacy Policy

Hard-enduro ride recording for iPhone and Apple Watch

Effective: 2026-05-05 · Last updated: 2026-05-05

Pinned ("we", "us") is a ride-recording app for hard-enduro and trail dirt-bike riders. This policy explains what data the app collects, how we use it, and the choices you have. We try to keep it short and plain.

Data we collect

• Email address — used to sign you in. Either supplied directly (email + one-time code) or via Sign in with Apple (which may use Apple's relay address).
• Display name — what you choose to be called. Optional; you set it the first time you sign in and can edit it in Settings.
• Ride GPS data — latitude, longitude, altitude, speed, and bearing recorded once per second by your Apple Watch while a ride is active.
• Heart rate — read from the Apple Watch sensor during rides, with your HealthKit consent.
• Workout metadata — duration, distance, elevation gain/loss, time-in-zone, written back to Apple Health as a workout (with your HealthKit consent).
• Bike garage — bike names, makes/models you enter, optional photos you attach, and maintenance interval data you create.
• Apple Sign In identifier — an opaque user ID that lets us recognize you across launches. Stored locally in the iOS Keychain so we can detect when you revoke access.
• Device identifier (Apple's, not ours) — Apple may pass us a stable user ID specific to our app. We don't combine it with anything else.

We do not collect: contacts, photo library beyond what you explicitly attach to a bike, microphone, advertising identifiers, browsing history, or third-party social-network data. We don't run any analytics SDK, attribution SDK, or advertising SDK.

How we use your data

• Provide the core service: recording your rides, syncing them between your watch and phone, computing summaries.
• Show your bike garage with cumulative usage and maintenance intervals.
• Save your rides as workouts in Apple Health (with your consent).
• Email you a one-time sign-in code when you log in via email.

We do not use your data for advertising, profiling, or training machine learning models, and we do not sell or rent your data.

Where your data is stored

Your account and ride data are stored on Supabase, our hosting provider, on servers located in the United States. Data is encrypted in transit (HTTPS) and at rest. Photos you attach to bikes are stored in private Supabase Storage with per-user folder access control — no one else can read them.

Some data also lives locally on your iPhone and Apple Watch: SwiftData stores your rides on-device for offline access, and refresh tokens for your session live in the iOS Keychain (this-device-only — they never sync via iCloud Keychain or device backups).

Subprocessors

We use a small number of vendors to deliver the service:

• Supabase — database, authentication, file storage, and Edge Functions hosting.
• Apple — Sign in with Apple, HealthKit, push notification infrastructure, App Store, App Store Connect.
• OpenStreetMap contributors / OpenTopoMap / CyclOSM — map tile data shown in the app, served as static tiles. These providers receive your map's bounding box when you view a map but not your identity.

We don't share your personal data with anyone else. Subprocessors are bound by their own privacy commitments.

Your rights and choices

• Delete your account — Settings → Account → Delete Account. This permanently removes your account and all associated rides, photos, and bike data from our servers, immediately and without recovery.
• Edit your profile — Settings → Account → Name.
• Revoke Apple Sign In — iOS Settings → Apple ID → Sign-In & Security → Pinned. We detect the revocation on next launch and sign you out.
• Disable HealthKit access — iOS Settings → Health → Data Access & Devices → Pinned.
• Disable location access — iOS Settings → Privacy & Security → Location Services → Pinned.
• Request a copy of your data — email us at privacy@cfandersen.com and we'll export your data within 30 days.

If you're in the EU, EEA, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA: access, rectification, erasure, restriction, portability, and objection. To exercise any of these, email privacy@cfandersen.com. We don't sell or share personal information for the purposes defined under CCPA.

Data retention

We keep your account and ride data for as long as your account is active. When you delete your account, all data is removed from our database immediately; backups are rotated out within 30 days.

Children

Pinned is not directed to children under 13 (or under 16 in the EU/UK), and we don't knowingly collect data from children. If you believe a child has signed up, contact us and we'll delete the account.

Security

We use HTTPS for everything, encrypt data at rest, and apply row-level security so each user can only access their own rides and bikes. Refresh tokens on your device are stored in the iOS Keychain with this-device-only protection. We rotate database access credentials and review access controls regularly.

Changes to this policy

If we materially change how Pinned handles your data, we'll update this page and bump the "Last updated" date at the top. For significant changes we'll also send a notification through the app.

Contact

Questions, requests, or concerns: privacy@cfandersen.com.

Pinned is built independently. We're not affiliated with Apple, Inc., the OpenStreetMap Foundation, or any motorcycle manufacturer.