Privacy Policy

Who we are

Quixit is an independent app made by Johnny Fairbank in the United States. Questions and requests about your data go to support@quixitapp.com.

What we collect

• Account. Your email address, name, username, a hashed password, your time zone, and the photo, bio, location text, birth date and experience level you choose to add. With Sign in with Apple, Apple gives us your name and email, or a relay address if you hide your email.
• Rides. When you record a ride we store its GPS track with times, speed and altitude, plus heart rate, power and cadence when a sensor provides them, the bike you chose, and the statistics we compute. Rides you import from a file are stored the same way.
• Location. Your precise location while you record or navigate a ride, including in the background while a recording is running, if you allow it. The start point of each route you ask for. iOS asks before either happens, and you can change it in Settings at any time.
• Routes. The requests you make (distance, preferences, start point and anything you type), the routes we build, the ones you save, and any share links you create.
• Bikes and road reports. Bikes you add. Road reports you file: the location, the kind of problem, your description and a photo if you attach one.
• Rider profile and health data. Height, weight, FTP, resting, maximum and threshold heart rate, VO2 max and cycling workouts, whether you type them in or, once available, share them from Apple Health. The health data page covers this in detail.
• Connected services. If you connect Intervals.icu, TrainingPeaks, TrainerRoad, a calendar feed, Wahoo or Garmin, we store the credentials for that connection encrypted, and the workouts or routes that pass through it.
• Usage. A small set of product events, such as an account being created or a route being built, with the app version and platform, stored in our own database, and ordinary server logs. Quixit has no third-party analytics or advertising SDKs.
• Preferences. Units, route defaults, and whether you want product updates by email.

How we use it

• To build routes, explain them, and navigate them.
• To record rides and compute your statistics and training load.
• To keep your training plan and your bike computers in sync when you connect them.
• To make routing better for everyone. Roads that riders record are counted as popular as aggregate numbers only, never as who rode where. Road reports become condition observations shown to other riders at that place, without your name.
• To send account email, keep the service secure, and answer support requests.

We do not sell your data, show advertising, share data with data brokers, or track you across other apps and websites.

Who processes it for us

These companies run parts of Quixit under contract and only on our instructions.

Services you choose to connect, such as Intervals.icu, TrainingPeaks, Wahoo or Garmin, receive what the connection needs and handle it under their own policies. Purchases, where the app offers them, are made through Apple and confirmed through RevenueCat, which sees your Quixit account id and what you bought, never your card. We keep a record of the routes you were given, bought and used; it is part of your data export.

Public and private

Rides and saved routes are private unless you make them public or share a link. A share link opens a web page anyone with the address can see. It stops working after 30 days, or as soon as you stop sharing in the app. Privacy zones hide the start and end of your rides and shared routes near places you define, such as home, from everyone but you, including rides and routes you saved before you added the zone. Road reports are shown to other riders at their location without your name.

Keeping and deleting

We keep your data for as long as your account exists. You can delete your account in the app under Settings, Your data. You are signed out everywhere and your profile, sign-in details and share links go at once. Your rides, routes, training and health data, photos and connections to other apps are erased shortly afterwards, those apps are told to revoke our access, and backups follow within 30 days. Road reports you made, and road-condition observations derived from them, may remain with no link to you.

A ride, route or photo you delete disappears from the app at once and is erased for good 30 days later.

You can export everything we hold about you from the same screen: a ZIP archive with your rides and routes as GPX files and the rest as JSON. The archive stays available to download for 7 days and is then removed.

Security

Data travels over TLS. Passwords are stored as hashes. Credentials for connected services are encrypted at rest with AES-256-GCM. Access to production systems is limited to what running the service requires. No system is perfectly secure, and we will tell you if a breach affects you.

Children

Quixit is not for children under 16. We delete accounts we learn belong to them.

Your rights

You can see, export, correct and delete your data from the app, and switch off product email in Settings, Notifications. If you are in the European Economic Area or the United Kingdom, we process your data to provide the service you asked for, for our legitimate interest in keeping it secure and improving routing, and, for health data, with your consent, which you can withdraw by deleting the data. If you are in California, you have the rights the CCPA gives you, and we do not sell or share personal information as that law defines it. For anything you cannot do in the app, email support@quixitapp.com.

Changes

When this policy changes we post the new version here with a new effective date, and tell you in the app or by email if the change matters to you.