Hard-enduro ride recording for iPhone and Apple Watch
Effective: 2026-05-05 · Last updated: 2026-10-01
Pinned ("we", "us") is a ride-recording app for hard-enduro and trail dirt-bike riders. This policy explains what data the app collects, how we use it, and the choices you have. We try to keep it short and plain.
We do not collect: contacts, photo library beyond what you explicitly attach to a bike, microphone, advertising identifiers, browsing history, or third-party social-network data. We don't run any analytics SDK, attribution SDK, or advertising SDK.
We do not use your data for advertising, profiling, or training machine learning models, and we do not sell or rent your data.
Your account and ride data are stored in a PostgreSQL database running on hardware we own and operate in the United States — not on a third-party cloud platform. Photos you attach to bikes and rides are stored in Cloudflare R2, in a private bucket. Every object is filed under your own user ID, and the server derives that ID from your session rather than accepting it from the app, so one account cannot request another account's photos.
Encrypted backups of the database are kept in Cloudflare R2 for 30 days, then deleted automatically.
About encryption in transit. Traffic between the app and our server travels over HTTPS, but it reaches us through Cloudflare, which terminates that TLS connection at its edge. That means Cloudflare is technically able to see the contents — including GPS tracks and session tokens — before passing them on to us. This is how most sites using Cloudflare work, and we think you should be told rather than left to infer it from an "encrypted in transit" claim. Cloudflare is contractually bound not to use that data; we simply can't state that nobody but us can read it in transit, so we don't.
Some data also lives locally on your iPhone and Apple Watch: SwiftData stores your rides on-device for offline access, and refresh tokens for your session live in the iOS Keychain (this-device-only — they never sync via iCloud Keychain or device backups).
We use a small number of vendors to deliver the service:
We don't sell your personal data or share it for advertising. Subprocessors are bound by their own privacy commitments.
Live ride sharing is off unless you turn it on for a ride. When you do, we publish that ride's current position — latitude, longitude, speed, altitude and bearing — to a web page at a link you choose who to send to.
Being clear about what that means: the link is not password-protected. Anyone who has it can watch your position while the share is live, so treat it the way you would treat your location itself. The link contains an unguessable 16-byte token, so it cannot be found by guessing, but it also cannot be taken back from someone you have already sent it to — other than by stopping the share.
The page shows only the position. It does not show your name, email, which bike you are on, or any of your other rides. A share ends when you tap Stop Sharing, when the ride ends, or automatically after 12 hours, whichever comes first — and the link stops working immediately at that point.
If you're in the EU, EEA, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA: access, rectification, erasure, restriction, portability, and objection. To exercise any of these, email privacy@cfandersen.com. We don't sell or share personal information for the purposes defined under CCPA.
We keep your account and ride data for as long as your account is active. When you delete your account, all data is removed from our database immediately; backups are rotated out within 30 days.
Pinned is not directed to children under 13 (or under 16 in the EU/UK), and we don't knowingly collect data from children. If you believe a child has signed up, contact us and we'll delete the account.
Every request to our server is authenticated, and every database query is scoped to the account that made it. Your user ID is taken from your signed session token, never from the request itself — so the app cannot ask for another account's rides, bikes or photos even if it tried. Photo filenames are checked against a strict allowlist before they are used, so a crafted name cannot reach someone else's files.
Sign-in codes are hashed before being stored and expire quickly. Session refresh tokens are stored hashed on the server and, on your device, in the iOS Keychain with this-device-only protection — they are never written to iCloud Keychain or to device backups. Refresh tokens rotate on every use, and reuse of an old one invalidates the whole session.
Photos and database backups in Cloudflare R2 are encrypted at rest by Cloudflare. The database itself runs on hardware we own and physically control; its storage volume is not separately encrypted at rest, so physical control of that hardware is the protection there. We would rather say this plainly than imply more than we do.
If we materially change how Pinned handles your data, we'll update this page and bump the "Last updated" date at the top. For significant changes we'll also send a notification through the app.
Questions, requests, or concerns: privacy@cfandersen.com.
Pinned is built independently. We're not affiliated with Apple, Inc., the OpenStreetMap Foundation, or any motorcycle manufacturer.