Privacy Policy

Effective July 30, 2026 · Version 2026-07-30.1 · Sykla is made by Hibiscus Consulting, LLC

This policy was rewritten on July 30, 2026, because the previous version was out of date. It said Sykla had no accounts and no cloud sync. Accounts, effort upload, leaderboards and shared routes have since shipped, and the old wording no longer described what the app does. It is corrected below rather than quietly amended, because a privacy policy that overstates your privacy is worse than none at all.

The short version: you have an account, your efforts are stored on our servers, and you choose what is public. An effort marked private is never published anywhere, and some things — sleep and recovery data, and anything you never upload — genuinely never leave your phone.

What leaves your device

• Your account — email address, a password (stored only as an Argon2 hash, never in the clear), and your display name.
• Efforts you upload — the GPS trace, timestamps, elevation including barometric pressure readings, and heart rate and power if you pair sensors. This is stored on our servers so your history, your section times and your leaderboard entries can exist.
• Photos you attach to an effort, with the location they were taken.
• Live location, only while you have ride sharing switched on or an active safety beacon, and only to the people you sent the link to. It stops when the ride ends.
• Voice, only while you have joined voice in a group ride. Audio passes through our server and is not recorded or stored.
• Payment details go directly to Stripe. We never see or store your card.

What stays on your phone

• Health data (HealthKit) — sleep, resting heart rate, heart-rate variability and, if you turn it on, cycle data. Readiness is computed on your device. This data is never transmitted to us, never used for advertising, and never shared with anyone.
• Personal details you enter (weight, height, max heart rate, birth year) stay local and are used to compute your zones and estimates.
• Any effort you never upload.

Public, private, and the difference

• An effort marked private is stored for you and published nowhere. It does not appear on leaderboards, does not create or improve public map geometry, and is counted in no popularity or heat aggregate.
• Shared efforts can appear on leaderboards and segments and contribute to shared maps.
• Trimming cuts the start and end of a shared route so your home is not exposed, with a random extension on top of the distance you choose so the cut point itself cannot be used to triangulate.
• The heat map only shows an area once several distinct riders have been through it, so one person's route is never the map.
• Shakas carry no identity and no exact position: locations are rounded to a roughly 500 m grid before anything is stored, and the sender is never recorded.
• We keep a list of restricted areas, such as military installations. Rides crossing one are kept in full for you and published nowhere, and photos taken inside are refused rather than stored.

What we do not do

• No advertising, no ad identifiers, no tracking across apps or websites.
• No third-party analytics SDKs.
• No sale or sharing of personal data with anyone.
• No use of your data to train anything without asking you first.

Your data is yours

You can export your efforts as GPX at any time from the app, and you can ask us to delete your account and everything attached to it by writing to the address below. Deleting an account removes your efforts, your photos and your account record.

Safety features

Beacons, hazard alerts and live sharing exist to get help to you, and they are never behind a paywall. They are also best-effort: they depend on your phone, its battery, and a signal. They are not a substitute for calling emergency services.

App Store & TestFlight

Apple provides us basic App Store and TestFlight information (install status, crash reports as configured by your own device settings). That data is governed by Apple's terms.

Changes and contact

When this policy changes materially, the version above changes and the app asks you to read it again. Questions, or a deletion request: blake@thepayhive.com.