Privacy Policy

The controller of your personal data is 2BikeFit (“2BikeFit”, “we”, “us”), reachable at support@2bikefit.com.

This policy covers 2bikefit.com and the 2BikeFit service. It sits alongside our Terms of Service, which govern the contract between us.

Account data. Your email address, an encrypted password or a Google sign-in identifier, and the date you registered and confirmed your account.

Fit data. The videos you upload, the bike and position details you enter, questionnaire answers, and the measurements, joint angles, observations and recommendations we derive from them.

Payment data. When you buy an access pass, Stripe processes the payment and we receive a record of the transaction and its status. We never see or store your full card number.

Usage data. Pages visited, features used, approximate country derived from your IP address, device and browser type, and how you first arrived at the site (for example a link from Instagram, a search result, or a shared link).

Support and messages. Anything you send us by email or through the in-product assistant.

To provide the service (contract). Creating your account, processing your video, producing your fit, granting access after purchase and providing support. Without this data we cannot deliver what you asked for.

To take payment and meet accounting duties (contract and legal obligation). Processing purchases, issuing records, and retaining what tax and accounting law requires.

To keep the service secure and working (legitimate interests). Preventing abuse, diagnosing faults, and protecting accounts. Our interest here is running a service that is not broken or defrauded, balanced against your interest in not being monitored beyond that.

To understand and improve the product (legitimate interests, or consent where required). Aggregate analytics about which features are used and where riders drop out.

To measure advertising (consent where required). Understanding which adverts lead to signups and purchases. See section 5.

To send service and lifecycle email (contract and legitimate interests). Account emails such as confirmation and password reset, and occasional messages about finishing a fit you started. Every non-essential email carries an unsubscribe link, and unsubscribing is honoured permanently.

Your video is the most sensitive thing you give us, so it gets its own section.

We use it for one purpose: to produce the fit you requested. It is stored in our hosting infrastructure and processed by automated pose-estimation and AI models, which may run on specialised GPU compute providers acting as our processors. Those providers process it only to return the analysis to us.

We do not publish your video, we do not use it in marketing without asking you separately and explicitly, and we do not send it or the measurements derived from it to advertising platforms. Deleting a fit deletes its video.

Human review is limited to what support and quality require. If you contact us about a specific fit, we may look at that fit to answer you.

Strictly necessary cookies. Sign-in sessions and security. These are required for the service to function and cannot be switched off.

Attribution cookie. A first-party cookie recording how you first reached the site, so we can tell which channels bring riders in. It holds a referring domain, campaign tags and a click identifier, and it does not follow you to other websites.

Analytics. PostHog records how the product is used so we can find where it fails people.

Advertising measurement. If we brought you here through a Facebook or Instagram advert, we tell Meta that the visit, signup, fit scan or purchase happened, so we can tell which adverts work. This uses cookies Meta sets in your browser and a matching signal derived from your email address. For the events we send from our own servers, that address is hashed with SHA-256 before transmission, so Meta receives an irreversible fingerprint rather than a readable address. We send Meta the fact and value of a purchase, never the contents of your fit, your measurements or your video. We also use equivalent measurement for Google advertising.

Automatic collection by Meta's tools. Beyond the events we send deliberately, Meta's measurement script collects some information in your browser on its own. This includes detecting interactions such as button clicks, and deriving matching signals from details you enter in forms. Those values are hashed by Meta's script in your browser before they are sent, so they are not transmitted in readable form, but the collection is performed by Meta rather than by us. Declining non-essential cookies, browser privacy settings, or an ad blocker will prevent it.

Where the law requires consent for non-essential cookies and advertising measurement, we rely on that consent and you may withdraw it at any time. You can also block these technologies in your browser or through its privacy settings, and a browser-level ad blocker will stop most of them.

We do not sell personal data. We share it only with providers who process it on our instructions, and only as far as their function requires:

• Supabase — authentication, database and file storage.
• Railway — application hosting.
• Stripe — payment processing. Stripe acts as an independent controller for parts of its fraud and compliance work.
• GPU and AI compute providers — automated analysis of your video and generation of fit guidance.
• PostHog — product analytics.
• Meta Platforms — advertising measurement, on the limited terms in section 5.
• Google — sign-in, when you choose it, and advertising measurement.
• Our email delivery provider — sending account and lifecycle email.
• MaxMind — a local database used to derive approximate country from an IP address.

We may also disclose data where the law requires it, or to establish, exercise or defend legal claims.

We host the service and your data in the European Union. Some providers listed above are established outside the EU or process data outside it, which means your data may be transferred internationally.

Where that happens, the transfer relies on an adequacy decision or on Standard Contractual Clauses together with supplementary measures, as applicable. You can ask us for details of the safeguards that apply to a specific provider.

Account data — while your account exists, and a short period afterwards to handle disputes.

Videos and fit data — until you delete the fit or your account. Deleting a fit deletes its video.

Purchase records — for the period tax and accounting law requires, which is longer than the life of your account.

Analytics and attribution data — retained in aggregate or pseudonymous form for trend analysis.

Unsubscribe records — kept indefinitely, because that is the only way to guarantee we do not email you again.

Under the GDPR you have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent where processing relies on it. Withdrawing consent does not affect processing that already happened.

You can delete individual fits and your account from within the product. For anything else, write to support@2bikefit.com and we will respond within the time the law allows, normally one month.

If you believe we have handled your data unlawfully you may complain to your local supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD).

Access to production data is restricted, traffic is encrypted in transit, and passwords are stored only in hashed form by our authentication provider. Payment card details never reach our servers.

No online service can promise perfect security. If a breach affects your personal data and the law requires it, we will notify the supervisory authority and, where the risk to you is high, you directly.

The service is not directed at children. If you are under the age at which you may consent to online services where you live, a parent or legal guardian must create and supervise the account. If we learn we have collected a child's data without the required authorisation, we will delete it.

We may update this policy as the service changes. The effective date at the top always reflects the current version, and we will tell you about significant changes through the service or by email before they take effect.

Questions about this policy, or a request about your data: support@2bikefit.com.