1. Who we are
GearFix ("we", "us") is the data controller for the personal data described below. You can reach us at support@gearfixapp.co.uk. This policy covers the GearFix iOS app and the website at gearfixapp.co.uk.
2. What we collect
Account. When you sign in with Apple we receive an anonymous Apple user identifier and your email address — which is Apple's private relay address unless you chose to share your real one. We never receive or store a password; GearFix has no password of its own.
Strava. Once you connect Strava we store your Strava athlete ID, your OAuth access and refresh tokens, and your gear list (bike names and IDs). For each new upload we receive activity metadata — activity ID, name, start time, sport type, recording device name, and the gear currently assigned.
Sensor details (optional). If you connect Wahoo Cloud, the FIT file for each ride is fetched and parsed for the device and sensor information inside it: manufacturer, product name, serial number, and ANT+ device number. The FIT file itself is never stored — it is parsed in memory and discarded. The same applies to the Dropbox connection where that channel is offered.
Your rules. The detection rules you write, and the correction history showing what GearFix changed and why.
Notifications. If you allow notifications, the Apple push token for your device.
Subscription. If you subscribe to GearFix Pro, Apple sends us the transaction identifier, product identifier, and renewal status. We never see your card details, billing address, or Apple ID — Apple handles payment entirely.
What we never collect. GPS tracks or route data, heart rate or any other health measurement, precise location, your contacts, photos, or any advertising identifier. GearFix contains no analytics, advertising, or tracking SDK of any kind.
3. Why we use it, and our lawful basis
Every item above is used to run the service you asked for: matching rides to sensor data, evaluating your rules, updating the gear on Strava, and showing you what changed. Under UK GDPR our lawful basis is performance of a contract (Article 6(1)(b)) — without this data the app cannot do its one job. Notifications rely on your consent, which you can withdraw in iOS Settings at any time. We do not profile you, make automated decisions with legal effects, or use your data to train machine-learning models. Rule matching is deterministic logic that you write.
4. How long we keep it
Data is held on Supabase infrastructure in the UK/EU, encrypted in transit and at rest.
Strava activity data is deleted within 7 days, as the Strava API Agreement requires. The cached activity payload is purged automatically on a daily schedule; what remains after that is our own record of the correction we made (timestamps, which rule matched, the gear before and after), which is not Strava data.
Your rules, saved sensors, and correction history are kept while your account is active. Delete your account — Settings → Delete account, or email us — and everything is erased within 30 days, including your Strava tokens.
5. Who we share it with
We do not sell, rent, or share your personal data for advertising, and we do not disclose it to third parties for their own purposes. Data is processed only by: Supabase (hosting and database), Apple (sign-in, push notifications, payments), Strava (the account you connect, which we read from and write gear changes to), and Wahoo (only if you connect it). We may disclose data where the law requires it.
6. International transfers
Our infrastructure is in the UK/EU. Where a provider processes data outside the UK, that transfer is covered by the UK International Data Transfer Addendum or an adequacy decision.
7. Your rights
Under UK GDPR you can request access, correction, export, restriction, objection, or deletion at any time: in-app via Settings → Delete account, or by emailing support@gearfixapp.co.uk. We respond within one month. You can also revoke GearFix's access directly from your Strava and Wahoo account settings, which stops all further processing immediately. If you are unhappy with our response you can complain to the ICO (ico.org.uk).
8. Children
GearFix is not directed at children and is not intended for anyone under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, email us and we will delete it.
9. Security
Access to your data is enforced at the database level by row-level security, so one account cannot read another's. OAuth tokens are stored encrypted and never leave our servers. If a breach affects your rights we will notify you and the ICO as the law requires.
10. Changes & contact
Material changes are announced in the app before they take effect, and the date at the top of this page always reflects the current version. Questions, requests, or complaints: support@gearfixapp.co.uk.
11. Not affiliated with Strava
GearFix is an independent app that uses the Strava API. It is not affiliated with, endorsed by, or sponsored by Strava, Inc.