Quixit Privacy Policy

This Privacy Policy works together with the Quixit Terms of Service available at https://quixitapp.com/terms and the Quixit Consumer Health Data Privacy Policy available at https://quixitapp.com/healthdata and describes how Quixit, LLC (“we,” or “us”) collects, uses, discloses, and processes your Personal Information (“you” and “your”) through the Quixit app and our website, quixitapp.com, as well as rights that you may have regarding that information. We reserve the right to change this Privacy Policy at any time. If we change our Privacy Policy, we will post an updated version on this website with a new effective date, and the app will ask you to read and acknowledge the new version before you continue. We keep a record of which version you acknowledged and when. Updates to the Privacy Policy will be referenced by the " Effective Date & Last Updated Date" date shown above. By using our app or visiting the website, you acknowledge the privacy practices described in this Privacy Policy, including any revisions to this Privacy Policy that we post.

Definitions

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person, household or device. “Personal Information” does not include: (a) information that is lawfully made available from federal, state, or local government records; (b) information that we have a reasonable basis to believe is lawfully made available to the general public by you from widely distributed media; or (c) information that is deidentified or aggregated consumer information.

“Sensitive Personal Information” means Personal Information that is treated as sensitive under applicable privacy laws. For Quixit, this may include account credentials, precise geolocation, and certain health or fitness information. We process Sensitive Personal Information only for the purposes described in this Policy and obtain consent where required. Information that qualifies as Consumer Health Data is also subject to the Quixit Consumer Health Data Privacy Policy.

Privacy laws may use different terms or definitions for Personal Information and Sensitive Personal Information.

Information We Collect and the Categories of Source of Collection

Set forth below are the categories of Personal Information we collect and that have collected in the preceding 12 months and the categories of sources from which the Personal Information was collected. Please note that we may not collect all of the information referenced below regarding you.

* See the section entitled Online Technologies below.

We only use Sensitive Personal Information for purposes disclosed herein. As required by applicable privacy law, we obtain consent before processing such information. For example, iOS asks for your permission before we access your precise location, and we access Apple Health data only for the types you allow in the iOS permission screen.

Health data is never used for advertising or marketing, is never sold or shared with data brokers or advertisers, and is never shown to other riders or joined into any public or aggregate dataset. Health data is shared only (1) with service providers that host or operate Quixit and do not use it for their own purposes, (2) the training, fitness, or health service you have connected when data is synced back, and (3) only if you switch on AI reading in Settings, with an AI service provider as needed to provide that feature. Data from Apple Health is used only to provide the features you enable and is never used for any other purpose. You can edit or delete any single health value in Settings, delete every health value at once in Settings, and withdraw Apple Health access at any time in Settings or in the iOS Health app.

We also collect aggregated, de-identified or anonymous data that does not identify individual consumers. For example, roads that riders record are counted as popular as aggregate numbers only, never as who rode where, and road reports become condition observations shown to other riders without your name. We commit to maintain and use such data without attempting to re-identify the data.

Business or Commercial Purpose for the Collection of Personal Information

Set forth below are the business or commercial purpose for our collection of Personal Information. Please note that we may not use your Personal Information for all purposes set forth in this Privacy Policy.

• To provide you with and improve our services, including account servicing and customer support
• To create, maintain, and verify accounts and identities
• To confirm App Store purchases and subscriptions, where the app offers them
• To build routes, explain them, and navigate them, and to record rides and compute your statistics and training load
• To keep your training plan and your bike computers in sync when you connect them
• To make routing better for everyone using aggregate data, and to show road reports to other riders at that place without your name
• To respond to inquiries, send notices, messages, and related communications
• To operate our website and/or app, tailoring content, features, and user experiences
• To operate and manage IT and communications systems and facilities, including functionality and debugging of our website
• To maintain security on our app and website and internet-connected assets and to detect fraud
• To analyze usage and trends
• To audit interactions, transactions, and compliance
• To detect and prevent security incidents
• To protect against malicious, deceptive, fraudulent, or illegal activity
• To maintain the integrity of our systems and data
• To identify and fix errors that impair functionality.
• To undertake internal research and development
• To verify, maintain and/or improve the quality, safety, and performance of products, services, and devices
• To prevent and manage fraud and abuse
• To manage risk
• To meet and comply legal, regulatory, tax, and reporting obligations
• To enforce contracts and terms
• To exercise or defend legal claims
• To read your route notes and a coach’s workout text with a language model, only if you switch on AI reading in Settings (where you can switch it off again); our AI provider does not train its models on this data

Online Technologies

A cookie is a small file of letters and numbers that is stored on your browser or the hard drive of your computer. Cookies contain information that is transferred to your computer's hard drive. We use cookies or similar technologies to administer our website and app and keep you signed in. Quixit has no third-party analytics or advertising software development kits, and we do not track you across other apps and websites.

We may use several types of cookies and other tracking technologies on our website, as described below.

• Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
• Functionality/preference cookies. These are used to recognize you when you return to our website. This enables us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Statistical, analytical or performance cookies. These allow us to recognize and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.

Emails that we and our service providers send may include similar technologies that provide us with information related to whether you’ve opened an email or clicked on a link contained in an email. More information on how to unsubscribe from our marketing emails is found below.

If you want to remove existing cookies from your device you can do this using your browser options. If you want to block future cookies being placed on your device you can change your browser settings to do this. Please bear in mind that deleting and blocking cookies may have an impact on your user experience as parts of the site may no longer work.

Personal Information We Disclose, Share for Targeted Advertising or Sell and the Purpose for It

Disclosure of Personal Information to Service Providers

We disclose and have disclosed in the preceding 12 months Personal Information to our service providers and contractors for the following purposes.

• Security and Fraud Detection: We disclose Personal Information for our security and fraud detection services including detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity; and prosecuting those responsible for that activity.
• Functionality & Debugging: We disclose Personal Information to engage in debugging to identify and repair errors that impair existing intended functionality.
• Services on Our Behalf: We disclose Personal Information in order to receive services performed on our behalf, including database and file storage, hosting, background processing (road data, weather, training sync, and exports), account email, confirming App Store purchases, and, only if you switch on AI reading, reading your route notes and workout text.
• Research & Development: We disclose Personal Information for internal research related to technological development and demonstration.
• Quality Control & Improvement of Products and Services: We disclose Personal Information to verify, maintain, and improve our products and services.

The following chart sets forth the categories of Personal Information we have disclosed to our service providers for a business purpose over the past 12 months. Please note that we may not have disclosed all of the information referenced herein regarding you to our service providers and/or may not have disclosed all information regarding you to our service providers for all purposes set forth in this Privacy Policy.

Our service providers (processors) currently include:

• database and file storage provider;
• hosting provider for the app service and website;
• background processing provider, including road data, weather, training sync, and exports;
• account email provider;
• app store purchase confirmation provider, using your Quixit account ID and what you bought (but never your name, email, or card); and,
• only if you switch on AI reading in Settings, an artificial intelligence large language model provider that reads the notes you type for a route and a coach’s workout text, together with your start area, the options you tapped, and, for a workout, its title, planned time, and your FTP, but never your name, email, or account;
• under its commercial terms and/or settings, our artificial intelligence large language model provider does not train on this data.

These companies process Personal Information under our instructions and are required to protect it.

Disclosure for Other Purposes

We disclose or have disclosed Personal Information to the following categories of third parties for the following additional purposes. Please note that we may not have disclosed all of the information referenced herein regarding you and/or may not have disclosed all information regarding you for all purposes set forth in this Privacy Policy.

• Services you choose to connect. If you connect a training, fitness, calendar, device, or other third-party service, they receive what the connection needs (such as workouts and routes) and handle it under their own policies.
• Apple. Apple provides Sign in with Apple, the App Store and TestFlight, and Apple Maps in the app, and handles information under its own policies.
• Weather and map data providers. Weather, mapping, geocoding, and related data providers receive the approximate area a route covers or a place name you typed for a route, never your account.
• Other riders and the public. Road reports may be shown to other riders at their location with your description and photo but without your name. Rides and saved routes are private unless you make them public or create a share link, which anyone with the address can see until it expires after 30 days or you stop sharing. Privacy zones hide the start and end of your rides and shared routes near places you define from everyone but you.

As Necessary Disclosures

We may also use and/or disclose Personal Information, as necessary: (a) to comply with any law, regulation and/or legal process and/or exercise or defend legal claims; (b) to respond to requests from public and government authorities; (c) to enforce our terms and conditions; (d) to protect our operations and protect our rights, privacy, safety or property, and/or that of you or others; and (e) to allow us to pursue available remedies or limit the damages that we may sustain. We may also use and disclose your Personal Information in connection with or during negotiation of any reorganization, acquisition, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings). You acknowledge that such transfers may occur and that any acquirer of or successor to us may continue to use your Personal Information as set forth in this Privacy Policy.

Selling and Sharing (for Targeted Advertisement) of Personal Information

We do not sell your Personal Information, and we do not process your Personal Information for targeted advertising, as those terms are defined under applicable privacy laws. We do not show advertising, share data with data brokers, or track you across other apps and websites. We do not sell Sensitive Personal Information.

Our Retention Policy – How Long We Keep Your Personal Information

We will retain each category of your Personal Information identified above for an amount of time that is reasonably necessary for us to use the information for the purposes disclosed herein and for any other permitted purposes, including retention of Personal Information pursuant to any applicable contract, law or regulation. To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal requirements.

In particular, we keep your data for as long as your account exists. You can delete your account in the app under Settings. When you do, you are signed out everywhere and your profile, password, and share links are deleted at once; your rides, routes, training and health data, photos, and connections to other apps are erased shortly afterwards; connected apps and the service you signed in with are told to revoke our access; and copies kept for recovery are deleted within 30 days. Road reports you made stay on the map as a hazard at a place, with your name, description, and photo removed, and the road-condition observations derived from them remain; neither is linked to you. A ride, route, or photo you delete disappears from the app at once and is erased permanently 30 days later. Data exports remain available to download for 7 days and are then removed. Deleting your account does not cancel a subscription billed by Apple; please cancel it in your Apple ID settings first.

Data Security

We implement technical, organizational, administrative and physical measures to help ensure a level of security appropriate to the risk to the Personal Information we collect, use, process and disclose. These measures are aimed at ensuring the on-going integrity and confidentiality of Personal Information. For example, data travels over TLS, passwords are stored as hashes, credentials for connected services and the token that lets us end a Sign in with Apple grant are encrypted at rest with AES-256-GCM, and access to production systems is limited to what running the service requires. We evaluate these measures on a regular basis to help ensure the security of the processing. Please be aware that, despite our ongoing efforts, no security measures are perfect or impenetrable.

Children

Quixit is only for people who are at least 18 years old and have reached the age of majority where they live. We do not direct our websites or applications to children, and we do not knowingly collect information from children under 13 years of age or provide any Personal Information from such persons to any third party for any reason whatsoever. No information should be submitted to our website or applications by persons under 18 years of age. We delete accounts we learn do not meet our age requirement.

Consumer Rights

If you reside in a state with a comprehensive privacy law with which Quixit must comply, you have the following rights regarding your Personal Information under that law, as applicable. You may exercise these rights free of charge up to twice annually. You can also see, export, correct, and delete much of your data directly in the app under Settings, and switch AI reading on or off in Settings.

Please note that not all of these rights may be applicable to you, these rights are subject to certain exceptions and limitations, and certain of these rights are subject to verification mechanisms.

• The Right to Know: You have the right to confirm whether we are processing your Personal Information.
• The Right of Access: You have the right to access your Personal Information, and to obtain a copy of it in a readily usable format, if feasible.
• The Right to Correct Inaccuracies: You may request that inaccuracies in your Personal Information be corrected.
• The Right to Delete: You have the right to request that your Personal Information be deleted, except in cases where retention is required, for example by law or contractual obligation.
• The Right to Data Portability: You have the right to obtain a copy of your Personal Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means. You can export everything we hold about you under Settings, as a ZIP archive with your rides and routes as GPX files and the rest as JSON.
• The Right to Opt-Out: You may elect to prevent your Personal Information from being processed for the following purposes (although, as described above, we do not currently process Personal Information for any of these purposes):
• Targeted advertising;
• The sale of Personal Information; or
• Profiling in furtherance of a decision that produces legal or similarly significant effects concerning you.
• The Right to Non-Discrimination for Exercising Your Rights: If you choose to exercise any of your rights, you have the right to not receive discriminatory treatment by us.
• Rights Regarding Sensitive Personal Information: We do not process your Sensitive Personal Information without obtaining your consent. You have the right to withdraw your previous consent and opt out of further processing of your Sensitive Personal Information, for example, by switching off location access in iOS Settings, in Settings, withdrawing Apple Health access, or switching off AI reading in Settings.

How to Make a Consumer Request

You you can exercise your rights by: (a) using the tools in the app under Settings (to see, export, correct, or delete your data); (b) sending us an email at support@quixitapp.com; or (c) for opt-out requests, enabling an opt-out preference signal (also known as a universal opt-out mechanism) in a browser or device that supports it, which we will treat as a valid request to opt out.

When you make certain requests (e.g., a request to confirm, access, delete, correct, or port your Personal Information), to help protect your privacy and maintain security, we will take steps to verify your identity. Our verification procedure may differ depending on whether you have an account with us or not and the request you are making. The following generally describes the verification processes we use:

• Password Protected Accounts. If you have a password-protected account with us, we may use existing authentication practices to verify your identity but will require re-authentication before disclosing, correcting or deleting data. If we suspect fraudulent or malicious activity relating to your account, we will require further verification (as described below) before complying with the request.
• Verification for Non-Accountholders. If you do not have, or cannot access, a password-protected account with us, we will generally verify your identity as follows:
• For valid requests for access and data portability, we will verify your identity to a reasonably high degree of certainty by matching at least three data points provided by you with reliable data points maintained by us.
• For valid requests to correct or delete Personal Information, we will verify your identity to a reasonable degree or a reasonably high degree of certainty depending on the sensitivity of the Personal Information and the risk of harm posed by unauthorized deletion. We will act in good faith when determining the appropriate standard to apply.

If there is no reasonable method by which we can verify your identity, we will state so in response, including an explanation of why we have no reasonable method to verify your identity.

You may designate an authorized agent, including by way of a technology such as a browser setting or global device setting, to submit a request on your behalf to opt out of the processing of your Personal Information for targeted advertising, sale, or profiling. We may require the authorized agent to provide proof of its authority to act on your behalf, and we may decline the request if we cannot verify, using commercially reasonable efforts, your identity and the agent’s authority.

There may be situations where we cannot grant your request. If we decline to take action on your request, we will notify you of that decision and the justification within the time required by the applicable law, along with instructions for how to appeal. You may appeal our decision by emailing support@quixitapp.com with the subject line “Privacy Request Appeal” within a reasonable period after receiving our decision. We will respond to your appeal within the required amount of time from the date of receipt, including a written explanation of any action taken or not taken and the reasons for it. If we deny your appeal and you reside in Texas, you may submit a complaint by contact the Texas Attorney General at https://consumerprotection.texasattorneygeneral.gov/consumercomplaintportal/s/, or if you reside in Nebraska, you may contact the Nebraska Attorney General to submit a complaint at https://ne.accessgov.com/ago/Forms/Page/ago/2efd1471-06a7-4cd1-9bd2-cc8fe4e37c02/eaa18f8a-30e7-48c7-b97b-eaabb1ab6ce8/1.

Do Not Track

Some browsers offer a “Do Not Track” (DNT) setting that sends a signal to websites requesting that they not track the user. DNT is not a universally adopted or recognized standard, and there is no industry consensus on how to respond to DNT signals. Accordingly, we do not currently respond to DNT signals.

How to Contact Us

If you have any questions or concerns about our privacy policies and practices, please feel free to contact us by emailing us at support@quixitapp.com.