Privacy Policy
Last updated 8 October 2026
This privacy policy explains which personal data the Cycleping app and service process, why, on which legal basis, who helps us, how long we keep it and which rights you have. We wrote it in plain English. If anything is unclear, contact us (see "Contact" at the end).
Short version:
- We only collect what we need to run Cycleping: your email address, password (stored as a secure hash), country, plan, push settings, the pings you send and the races you pick.
- We do not show ads, we do not track you across other apps or websites, and we never sell or rent your data.
- Our database and login run in the European Union (Frankfurt, Germany).
- You can delete your account and data at any time, directly in the app.
1. Who is responsible
The controller of your personal data is:
Bynker BV Knokuilstraat 11, 8800 Roeselare, Belgium Company number: BE 1021.968.145 Email: info@bynker.be Website: https://cycleping.io
In this policy, "Cycleping", "we", "us" and "our" mean Bynker BV. "You" means anyone who uses the Cycleping app or our website.
We have not appointed a Data Protection Officer, because the law does not require one for a service of our size and type. You can contact us about privacy at info@bynker.be.
2. What Cycleping does
Cycleping tells cycling fans when to start watching a race. Fans who are watching tap a ping ("Sprint is starting", "Final 10 km", "Major attack"). When enough fans ping the same moment, every other fan gets a push notification. To make this work, we need a small amount of personal data.
3. Which data we process
3.1 Data you give us
| Data | When | Required |
|---|---|---|
| Email address | When you sign up | Yes |
| Password | When you sign up or reset it. We only store a one-way hash, so nobody at Cycleping can read your password | Yes |
| Country | When you sign up, and when you change it in Account | Yes |
| Messages to support | When you email us | Only if you contact us |
3.2 Data created when you use the app
| Data | What it is |
|---|---|
| Account ID | A random identifier that links your data together inside our system |
| Plan | Free, Premium or Premium Plus, and whether you are a lifetime member |
| Push token and push setting | A technical address for your phone provided by Apple and Expo, so we can deliver alerts, and whether you turned Push alerts on or off |
| Pings | Which race, which moment (sprint, final 10 km or attack) and when you sent it |
| Race picks | The races you selected in My races (Premium Plus) |
| Alerts | When an alert is sent we record the race, the moment, how many fans received it and, for alerts sent by our team, which team member sent it |
| Account dates | When your account was created and when you last signed in |
| Technical logs | Our hosting provider keeps short-lived server and security logs, which include IP addresses, device and app information, and timestamps of requests |
On your phone, the app stores your login session so you stay logged in. It is removed when you log out or delete the app.
3.3 Data we receive from others
- Lifetime members. Some early supporters bought lifetime access outside the app. For them we may import their email address (and an internal note, such as how they supported us) into a list of lifetime invites, before they create an account. When you sign up with that address and confirm it, your account becomes a lifetime account. We log when lifetime access is granted, claimed or removed.
- Subscriptions (when paid plans are available). Apple handles all payments. Apple and our subscription provider RevenueCat tell us which plan you bought, whether it is active and when it renews or ends. We never receive your card or bank details.
3.4 Data we do not collect
We do not collect your precise location, contacts, photos, health data, browsing history or advertising identifier. We do not use analytics or advertising tools, and we do not build profiles of you for marketing.
4. Why we use your data and on which legal basis
The GDPR requires a legal basis for each use of your data. These are ours:
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and secure your account, let you log in and reset your password | Email, password hash, account ID, account dates | Performance of our contract with you (Art. 6(1)(b)) |
| Show your profile and plan in the app | Email, country, plan, lifetime status | Performance of contract (Art. 6(1)(b)) |
| Count pings and send alerts to other fans | Pings, account ID, alerts | Performance of contract (Art. 6(1)(b)) |
| Send you push alerts for the races of your plan | Push token, push setting, plan, race picks | Performance of contract (Art. 6(1)(b)). iOS also asks your permission before any notification is shown, and you can switch alerts off at any time |
| Prevent misuse, false pings, spam and fraud, and keep the service secure | Pings, account ID, technical logs | Our legitimate interest in a reliable and safe service (Art. 6(1)(f)) |
| Understand, in aggregate, in which countries our fans live, so we can choose which races to cover | Country | Our legitimate interest in improving the service (Art. 6(1)(f)) |
| Manage subscriptions and give you the features you paid for | Account ID, plan, purchase status from Apple and RevenueCat | Performance of contract (Art. 6(1)(b)) |
| Grant and keep a record of lifetime memberships | Email, internal note, lifetime log | Performance of contract (Art. 6(1)(b)) and our legitimate interest in being able to prove who received lifetime access (Art. 6(1)(f)) |
| Answer your questions | Your email and message | Performance of contract (Art. 6(1)(b)) or our legitimate interest in helping you (Art. 6(1)(f)) |
| Keep records we must keep by law, and defend legal claims | Relevant account and payment records | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have balanced our interest against your rights. You can object at any time (see section 9).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The rule that sends an alert when enough fans ping the same moment is automatic, but it only decides whether a notification is sent to fans.
5. Push notifications
When you allow notifications, your phone receives a push token from Apple. Expo, our push delivery provider, turns it into an Expo push token, which we store with your account. When an alert is sent, we pass the token and the alert text (race name and event, for example "Major attack. 14 fans pinged. Watch now.") to Expo, which delivers it through the Apple Push Notification service.
You can stop alerts at any time with the Push alerts switch in Account, or by turning off notifications for Cycleping in the iOS Settings app. Alerts are time-sensitive notifications, which iOS may show during Focus modes; you can change this in the iOS Settings app.
6. Who processes your data
We do not sell your data. We share it only with service providers (processors) that help us run Cycleping, under a contract that obliges them to protect it and use it only on our instructions:
| Provider | What they do for us | Data | Where |
|---|---|---|---|
| Supabase, Inc. | Database, login, server functions and file storage | All data in section 3, except payment data | Data stored in the EU (Frankfurt, Germany, on Amazon Web Services). Support and maintenance access may happen from the United States |
| Resend, Inc. | Sends account emails (confirming your account, resetting your password, security notices) | Email address, email content | Emails sent from the EU (Ireland). Resend is based in the United States |
| Expo (650 Industries, Inc.) | Delivers push notifications. Also hosts our internal admin tool and builds the app | Push token, alert text | United States |
| Apple | Delivers push notifications (Apple Push Notification service) | Push token, alert text | United States and other countries |
| RevenueCat, Inc. (only once paid plans are available) | Manages subscription status | Account ID, purchase and renewal status, App Store country | United States |
| Airtable (Formagrid, Inc.) | Where our team edits the race calendar | Race information only. No personal data of fans | United States |
Apple as an independent controller. When you download the app or buy a subscription, Apple processes your data under its own privacy policy (apple.com/legal/privacy) as the seller. We do not receive your payment details.
Our team. A small number of Cycleping team members can see account data (email, country, plan, lifetime status) in our internal admin tool, only when needed to run the service and help users. Access requires an admin account.
Authorities. We may disclose data if the law requires it, for example to comply with a court order, or to protect our rights or the safety of others.
Business transfer. If Cycleping is sold or merged, your data may be transferred to the new owner, who must respect this policy. We will tell you in advance.
7. Transfers outside the European Economic Area
Our main database is in the EU. Some providers (Expo, Apple, RevenueCat, Resend and Supabase for support access) are based in the United States or may access data from there. When data is transferred outside the European Economic Area, we make sure it is protected, either because the recipient is certified under the EU-US Data Privacy Framework, or through the Standard Contractual Clauses approved by the European Commission, together with additional safeguards where needed. You can ask us for more information or a copy of the relevant safeguards.
8. How long we keep your data
| Data | How long |
|---|---|
| Account data, country, plan, push token and setting | As long as you have an account |
| Pings and race picks | As long as you have an account |
| Alerts | Kept as a history of the service. When you delete your account, any link to you is removed |
| Lifetime invites (email and note) | Until the invite is claimed, until you ask us to remove it, or until the lifetime programme ends |
| Lifetime log (email, date, action) | As long as the lifetime programme runs, so we can prove and restore a lifetime membership. You can ask us to delete it |
| Support emails | Up to 2 years after the conversation ends |
| Technical and security logs | A short period, typically from a few days to a few weeks, depending on our hosting provider |
| Records we must keep by law | As long as the law requires (for example, Belgian accounting rules: up to 10 years) |
Deleting your account. In the app, go to Account and tap Delete account. Your account, profile, pings and race picks are deleted right away. Alerts other fans received remain, without any link to you. Copies in our providers' backups are overwritten within their normal backup cycle (usually a few weeks). If you have a subscription, delete your account and also cancel the subscription in your Apple Account settings, because Apple manages billing.
9. Your rights
Under the GDPR you have the right to:
- Access your data and get a copy of it.
- Rectify incorrect data. You can change your country in the app at any time.
- Erase your data. You can delete your account in the app at any time.
- Restrict our processing in certain cases.
- Data portability: receive the data you gave us in a structured, machine-readable format.
- Object to processing based on our legitimate interest.
- Withdraw consent at any time, where we rely on consent (for example, notification permission in iOS), without affecting earlier processing.
To use your rights, email info@bynker.be. We may ask you to confirm the request from the email address of your account, so we know it is really you. We answer within one month. This is free of charge, unless a request is clearly unfounded or excessive.
Complaints. If you think we handle your data incorrectly, please tell us first so we can fix it. You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live or work. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be, contact@apd-gba.be.
10. Children
Cycleping is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe a child under 16 has created an account, contact us and we will delete it.
11. Tracking, ads and selling data
- No tracking: we do not track you across apps or websites owned by other companies, and we do not use the advertising identifier.
- No ads: Cycleping shows no advertising.
- No selling: we never sell or rent your personal data.
- No analytics tools: the app contains no third-party analytics or advertising software.
12. Security
We protect your data with appropriate technical and organisational measures, including:
- encrypted connections (HTTPS/TLS) between the app and our servers;
- passwords stored only as a secure one-way hash;
- database rules (row level security) so each fan can only read and change their own data;
- secret keys kept only on our servers, never in the app;
- admin access limited to a few team members, with every lifetime change logged.
No system is perfectly secure. If a data breach is likely to put your rights at high risk, we will inform you and the authorities as the law requires.
13. Changes to this policy
We may update this policy when the app or the law changes, for example when paid plans become available. The date at the top shows the latest version. If a change is important, we will tell you in the app or by email before it takes effect.
14. Contact
Bynker BV Knokuilstraat 11, 8800 Roeselare, Belgium Email: info@bynker.be Website: https://cycleping.io