Your data

Privacy Policy

Effective 12 August 2026

OpenCycle is built to know as little about you as it can get away with. An account holds a handful of fields and the rides you ride while signed in, and there is no advertising and nothing sold to anyone. We count how the app is used, anonymously and without storing anything on your device. This page says exactly what does leave your browser, when, and why.

What stays on your machine

Everything except the account fields and, while you are signed in, your rides — both described below. Your rider, your settings, your FTP, your workouts and the worlds you make are stored in your browser's local storage on your own device. Data from a paired trainer, power meter, cadence sensor or heart-rate strap is read over Bluetooth and processed in the browser, live. When you download a ride it is written as a .fit file straight to your machine — that file does not pass through us, and what you do with it is your business.

What we don't do

• No third-party analytics, and no trackers belonging to anybody else. Nothing on this site talks to Google, Meta or an advertising network.
• No advertising, and no advertising identifiers.
• No selling or renting of data, because there is nothing to sell.
• No cookies at all until you sign in, and exactly one when you do — described below. Our own usage counting sets none.

Counting how the app is used

We count a short list of things — the landing page being opened, the sign-up form being shown, an account being created, a ride loading, a workout being started or finished, and which world was chosen. It is how we find out which parts of OpenCycle people actually reach, and it is the only measurement on this site.

It is not attached to you. An event records what happened and nothing about who it happened to: no account, no username, no email. Your browser deliberately omits your session cookie when it sends one, so even when you are signed in these arrive with no identity attached — and the table they are stored in has no column to put one in.

What groups them is a random value your browser invents when a page loads and forgets when you close the tab. It is never written to your device, so there is nothing stored to recognize you by. It can group events that happen on one page, but it is not carried from the front page into the app and cannot tell us that two visits were the same person.

A link may also carry a short source label such as newsletter or press_bikerumor. That label is the same for everyone who receives the link; it tells us which launch channel led to an anonymous event, not which person did. Your address is seen the way it is on any request — briefly, to stop one machine flooding us — and is never written to the event or used to work out who you are.

That is also why you have not been asked to accept anything: the rule that produces cookie banners is about storing or reading data on your device, and this stores nothing. Counts are deleted after 90 days.

Serving the site

Like every website, opencycle.net is delivered by servers that see your IP address and the pages you request; our hosting infrastructure processes these transiently in ordinary access logs, used only to deliver the site and defend it against abuse. They are not used to profile you.

Riding with friends

A shared ride works by relaying your position along the road, your speed, your display name and your rider's appearance through our server to the people in your ride — that is the entire feature, and the people you invited can see those things because that is what riding together means. Updates are relayed, not recorded: the server keeps no history of where you rode or how hard. A ride link admits whoever holds it, so share it with the people you want on your road.

Your account

Riding needs an account, because a ride has to belong to somebody and a rider has to be the same rider on a laptop and a phone. It exists to keep a small profile across browsers, and it holds, in full:

• your username — the name other riders see;
• your password, stored only in hashed form — we cannot read it;
• your email address, used to get you back in if you forget your password, and for nothing else. We do not send marketing, and the sign-up form has no box that asks to;
• your rider's appearance and your FTP;
• which version of the terms you accepted when you signed up.

That is the whole record, unless you ask us to keep a ride — which is the one thing below that we treat differently from everything else on this page.

Rides kept in your account

If you are signed in, a ride is saved to your account when it ends. We store the second-by-second record of it: power, speed, distance, elevation, cadence and — if you had a monitor paired, your heart rate. The download beside it does not go through us at all, and a ride you finish while signed out is not sent anywhere.

Heart rate is health data and the law treats it more carefully than anything else here. This currently saves without asking you first, and that is not where it should be — the specific opt-in that heart rate calls for is work we owe and have not done. If you would rather nothing were held in the meantime, delete the rides or the account, or ride signed out; each of those is immediate and complete.

You can change your mind at any time. Deleting a ride from your account removes it and its heart rate immediately and for good, and deleting your account takes every ride with it. There is no automatic expiry.

We do not sell rides, do not share them, and do not use them to profile you — they are here so that you can get them back from another browser, and for nothing else.

Signing in sets one cookie — an HttpOnly session cookie on opencycle.net, which is what keeps you signed in. It identifies your session and nothing else, and it is the only cookie OpenCycle sets.

Deleting your account from the account tab removes the record above and releases your name. It takes effect immediately and cannot be undone.

If you connect a coaching platform

You can link your OpenCycle account to a coaching platform, and the link is only made when you approve it on our consent screen. Once connected, the platform sends OpenCycle your planned session so it can appear in your workouts, and when you finish a ride the file is handed back to the platform. The file is passed on and swept — OpenCycle does not keep a copy, and does not see your training history on the platform. The platform sees nothing else about your OpenCycle account. You can disconnect at any time from the Coaching tab, or from the platform's side; what the platform keeps is governed by its own privacy policy.

Worlds you make with an AI

Describing a world hands you a prompt to paste into whatever AI chat you already use. OpenCycle sends nothing to any AI provider — the conversation happens between you and them, under their terms — and what comes back is stored in your browser like any other world.

Where this happens

OpenCycle is operated by Storybooks LLC — the company behind Transition — from the United States, and account data is stored and processed there. If you ride from somewhere else — the EU included — creating an account sends the fields above to the US, and this policy is the promise about what happens to them once they arrive. Everything that never leaves your machine, which is most of it, is wherever you are.

The two disclosures we reserve

Two situations could put account data in hands other than ours, and honesty means naming them. If we receive a legally binding demand — a court order or its equivalent — we will comply, disclose the minimum it compels, and tell you unless the law forbids us to. There is some comfort in how little there would be to hand over: no rides, no history, no messages.

And if OpenCycle itself changes hands — is acquired, or passed to a successor — the account records go with the service, still bound by this policy, and the change will be announced before it happens. A successor wanting to do more with the data than this page allows would need to ask you first.

Your rights

Depending on where you live — under the GDPR and laws like it — you have the right to see the data we hold about you, to correct it, to take it with you, and to have it erased. OpenCycle is ahead of the paperwork here: everything an account holds is shown in the app, editable in the app, and deletable in the app, and everything else never left your machine. If you want any of it done by hand, or you believe something here is wrong, write to privacy@opencycle.net. You also have the right to complain to your data-protection authority.

Children

OpenCycle is not directed at children. Riding needs an account, so if you are under the age at which your country lets you consent to one, do not create an account and do not ride — a parent or guardian has to hold the account and answer for the riding, which the terms set out. If you believe a child has created an account, write to privacy@opencycle.net and we will delete it.

Changes

If this policy changes, the new version will be posted here with a new effective date, and a change that matters — anything that means more data, or new hands on it — will be flagged on the site rather than slipped in quietly.

Contact

The controller of the data this policy describes is Storybooks LLC. Privacy questions: privacy@opencycle.net. Security reports: security@opencycle.net.