Privacy notice

Kris Kristiansen, trading as Apex Velocity Spin is the data controller for Apex Velocity Spin. This is a sole trader, not a limited company. Write to 10 Linkstor Road, Liverpool, L25 6HW, United Kingdom or email [email protected].

On your user record we store: name; email address (stored lowercased); a hashed password (we do not keep the plain password); and the time your email was verified (email_verified_at).

Optional profile fields: a nickname (needed only if you join the leaderboard); a leaderboard opt-in (show_stats_publicly, off by default); and optional weight (kg), age and biological sex (female or male), which you can set in Account Settings. We also store lifetime ride time and estimated calories, your plan (free or pro), and marketing_opted_out_at (whether you have opted out of lifecycle/marketing emails).

Sign-in uses Laravel Sanctum personal access tokens. They last until you log out, change or reset your password, or delete your account. Password-reset tokens last 60 minutes.

Workout data stored with your account: custom workout templates you create or copy; completed rides; and achievements. We also keep a log of lifecycle emails we have sent to you. Completed rides, achievements and that email send log are deleted with your account.

The public leaderboard is opt-in. If you turn on “show stats publicly” and set a nickname, the public board can show that nickname, estimated calories and level. Weight, age and biological sex are never shown there. If you leave the toggle off, you do not appear.

Weight, age and biological sex are optional. You do not need them to create an account or ride. If you choose to save them in Account Settings (via PATCH /api/me), we store them on your user record and use them for calorie and effort-zone estimates in the app. They are not shown on the public leaderboard.

This kind of fitness information may count as health data (special category) under UK GDPR. The lawful basis we rely on is your explicit consent. Saving those fields is the consent; you can withdraw it at any time by clearing the fields and saving, or by deleting your account. We keep the values until you clear them or delete the account. They are not stored in cookies or localStorage.

The app does not set advertising or analytics cookies. It uses localStorage for strictly necessary items: spin_token (your login token), spin_terms_accepted (whether you ticked the sign-up terms box on this device), and a short-lived cache of built-in workout templates (spin_builtin_templates) so the dashboard loads faster.

You can clear these by logging out (token), using the browser’s site-data controls, or visiting /fresh.html which unregisters the service worker and clears caches. No cookie banner is required for this strictly necessary storage.

We send email via Resend for: email verification; password reset; lifecycle and marketing messages; and an admin “new signup” notification that contains the new rider’s name and email. Resend processes those addresses as our processor.

Lifecycle and marketing emails include a signed unsubscribe link. Use that link to opt out. We record the opt-out as marketing_opted_out_at on your account. Transactional mail (verification and password reset) is still sent so you can use the service.

Registration is protected by Cloudflare Turnstile. Cloudflare may see your IP address and related signals to tell humans from bots. Apex does not store those Turnstile signals. Cloudflare’s Turnstile Privacy Addendum and Privacy Policy describe that processing.

Admin (staff) sessions store IP address and user agent for admin users only, to help secure the admin panel.

If Cloudflare Web Analytics is switched on, we use Cloudflare’s cookieless beacon to see aggregate page views. It does not use cookies and is not used for advertising. If the beacon token is not configured, that script is not loaded.

Account, login, workout history, templates and transactional email are used to provide the service you asked for (contract). Optional leaderboard visibility is your choice. Security (Turnstile, hashed passwords, tokens, admin session IP/user agent) is legitimate interests in keeping the service safe. Lifecycle/marketing email uses the unsubscribe control described above. Weight, age and biological sex use explicit consent, as in section 4.

This summary should be checked against UK GDPR (including Articles 6 and 9) and the ICO’s guidance on the right to be informed.

Account data, including optional fitness fields, ride totals, plan, marketing opt-out, templates, rides, achievements and the lifecycle email send log, is kept while the account exists. Password-reset tokens expire after 60 minutes. Sanctum tokens last until logout, password change/reset or account deletion. Built-in template cache in localStorage is local to your browser and is not a server record.

You can update name, email, nickname, leaderboard opt-in and the optional fitness fields in Account Settings, and you can clear weight, age and sex there at any time. You can delete your account yourself (DELETE /api/me). That removes the account, completed rides, achievements and the lifecycle email send log. Custom workout templates and password-reset tokens may briefly remain after deletion (a fix is pending). If anything is left, email [email protected] and we will delete it on request.

You also have UK GDPR rights of access, rectification, erasure, restriction, objection and data portability, and the right to complain to the Information Commissioner’s Office (ico.org.uk). To use those rights, email [email protected].

The app is not aimed at children. If you choose to save an age, the field only accepts 13–120.

The site is served over HTTPS. Hosting, Cloudflare (CDN, security, Turnstile, optional analytics) and Resend may process data outside the UK. Those providers’ terms describe their transfer safeguards. Details of the exact hosting region should be confirmed by the operator.