WheelMark

Release legal

Privacy Policy

How WheelMark processes Strava account data, ride data, local garage state, photos, analytics, and support feedback.

Last updated: 2026-07-28

WheelMark is a local-first bicycle maintenance companion. It uses ride and bike information to help you keep track of bike assignments, wheelsets, components, service windows, and maintenance reminders.

Contact: wheelmark.lunji@gmail.com

Summary

  • WheelMark requires you to connect Strava for the first release.
  • Most WheelMark data is stored locally on your device.
  • Strava OAuth tokens are stored in iOS SecureStore/Keychain, not in SQLite.
  • The WheelMark token broker handles Strava token exchange, refresh, and revoke, but is designed not to persist tokens, authorization codes, ride payloads, gear payloads, or route data.
  • WheelMark Sync is currently disabled/hidden for release. If it is enabled later, this policy and the product UI must explain what syncs before users turn it on.
  • Analytics can run in off, local, or remote mode. Release builds must not send tokens, raw Strava payloads, ride names, route data, GPS coordinates, source IDs, or exact ride timestamps to analytics.

Information WheelMark Processes

Strava Account And Activity Data

When you connect Strava, WheelMark may access data allowed by the Strava scopes you approve, including:

  • Strava profile identity needed to show the connected source, such as display name, username/handle, avatar, and athlete id.
  • Cycling activity summaries, such as activity id, sport type, indoor/outdoor state, distance, moving time, elapsed time, start and end times, source device, and activity date.
  • Strava gear ids and gear details, such as bike name, nickname, retired state, and distance.
  • Route preview data available from Strava activity responses, such as summary polylines and route markers used to draw map previews.
  • Activity detail fields when you open an activity detail view, if the list response does not already contain enough data.

WheelMark uses this data to:

  • import rides you choose to import;
  • match rides to Strava bikes where possible;
  • let you correct bike assignments;
  • calculate mileage for bikes, wheelsets, tires, chains, brake pads, and other components;
  • detect duplicate ride recordings;
  • show route previews and source context back to you.

WheelMark does not use Strava data to build social features, leaderboards, advertising audiences, training datasets, AI models, or profiles for sale.

Local WheelMark Data

WheelMark stores local app data on your device, including:

  • bikes and source bike links;
  • local bike names, nicknames, statuses, photos, setup profiles, and weight;
  • ride assignment corrections and duplicate decisions;
  • components, wheelsets, tires, attachment periods, service windows, reminders, charge/check records, and maintenance history;
  • user preferences such as units, maintenance defaults, import range, and display settings;
  • tire pressure inputs such as rider weight, bike weight, tire widths, and tubed/tubeless setup.

Photos

If you choose a bike photo, WheelMark asks for photo library access so you can select that image.

Current release posture:

  • With WheelMark Sync off, bike photos should be stored as local persistent file URIs on your device.
  • If remote photo sync is enabled in a future release, WheelMark must clearly explain that upload before or at the time you enable it.

Support And Feedback

If you send feedback from Settings, WheelMark opens an email draft. You choose whether to send it.

The feedback draft may include optional diagnostics such as app version, platform, sync status, feature state, and aggregate local counts. It should not include tokens, raw Strava payloads, ride names, route data, GPS coordinates, or exact activity timestamps.

Analytics

WheelMark analytics is controlled by build/runtime configuration:

  • off: analytics events are dropped.
  • local: analytics events are printed locally for development.
  • remote: allowlisted analytics events may be sent to PostHog.

If remote analytics is enabled, WheelMark may send app usage events such as app opened, source connection state, sync started/completed/failed, ride assignment changes, component actions, settings changes, and coarse UI interactions.

Remote analytics may include:

  • app version and build profile;
  • platform and OS version;
  • coarse app surface, action, target, and state;
  • coarse counts, durations, and failure categories;
  • an install-level identifier or connected-source identifier/handle used to understand returning usage.

Remote analytics must not include:

  • access tokens or refresh tokens;
  • Strava authorization codes;
  • Strava client secret;
  • raw API requests or responses;
  • ride names;
  • route data, GPS coordinates, or map polylines;
  • raw source ride IDs or gear IDs;
  • exact activity timestamps;
  • bike names, component nicknames, or photo contents.

Before external TestFlight or public release, WheelMark should provide a user-facing analytics opt-out if remote analytics is enabled.

Where Data Is Stored

On Device

WheelMark stores most product data locally in app storage and SQLite on your device. OAuth tokens are stored separately in SecureStore/Keychain.

WheelMark Token Broker

The WheelMark token broker is used for Strava OAuth token exchange, refresh, and revoke. The broker may process OAuth token material in transit, but the intended design is that it does not persist tokens, authorization codes, raw token payloads, ride payloads, gear payloads, or route data.

Third Parties

WheelMark depends on third-party services:

  • Strava, for activity, athlete, and gear data you authorize.
  • Supabase, for the WheelMark token broker and any future optional WheelMark Sync services.
  • PostHog, only if remote analytics is enabled.
  • Apple, for App Store distribution and iOS platform services.
  • Your email provider, if you send support feedback.

Strava may monitor and collect usage data relating to API access and may use it for business purposes such as platform support, compliance, and API improvements.

Your Choices

You can:

  • choose whether to connect Strava;
  • disconnect Strava from WheelMark Settings;
  • revoke WheelMark access from your Strava account settings;
  • delete local WheelMark app data from the app where available, or by deleting the app;
  • decline photo library access;
  • choose not to send feedback emails;
  • use analytics opt-out once it is exposed in Settings.

Disconnecting Strava deletes the local SecureStore token. WheelMark also attempts token revoke through the broker when configured. If revoke fails because of network or provider issues, local disconnect should still remove local credentials.

Data Deletion

To request deletion of WheelMark data, contact wheelmark.lunji@gmail.com.

For local-only data, deleting the app or using the app's local data reset removes local app storage from that device, subject to iOS Keychain behavior for credentials. If iOS preserves Keychain items after reinstall, disconnect Strava or use the app reset path before uninstalling when possible.

For Strava data, you can also revoke WheelMark access from Strava. WheelMark should remove data obtained from Strava when you disconnect, revoke access, or request deletion, in line with Strava API requirements.

Children's Privacy

WheelMark is not intended for children under 13 or the equivalent minimum age in your jurisdiction. WheelMark does not knowingly collect data from children.

Changes

This policy may change as WheelMark evolves. Material changes should be reflected in the app or release notes before broader public release.

References