Privacy policy
This policy describes how SpinFlow (“the app”) and related services handle information. Review it alongside your answers in App Store Connect App Privacy and update both when your product changes.
Who we are
SpinFlow is an iOS application for indoor cycling lesson planning and playback. The operator name and contact details should match what you publish in the App Store and on the support page—update this paragraph with your legal name or company.
Information the app stores on your device
SpinFlow keeps lesson plans, segments, library entries (including tracks and exercise definitions), and related preferences locally on your iPhone unless you add cloud sync or accounts in a future version. We do not receive a copy of that on-device content simply because you installed the app.
Spotify
When you use Spotify-related features, you interact with Spotify AB under Spotify’s terms and privacy policy. SpinFlow may open the Spotify app or request metadata associated with content you choose. SpinFlow is not affiliated with or endorsed by Spotify.
- Playback via the Spotify iOS SDK (App Remote) is handled between your device and Spotify’s services.
- Import / metadata may use public embeds (oEmbed) and/or an optional SpinFlow-operated API proxy—see below.
Optional metadata proxy (Cloudflare Worker)
If your build is configured with a proxy base URL, the app may send requests to our server-side worker to resolve Spotify identifiers (tracks, albums, or playlists) into normalised track rows (for example title, artist, duration, BPM where available). Those requests:
- Are HTTPS and scoped to resolving public catalogue metadata needed for your library—not for selling personal playlists.
- May include a shared API key header when you configure one, to reduce abuse.
- May be rate limited using network information such as IP address (and the API key fingerprint) to protect the service.
- May generate operational logs on the hosting provider (for example high-level request or error logs). We do not use this to advertise to you inside SpinFlow.
Align this section with what you actually deploy (logging retention, regions, subprocessors) before submission.
Analytics and crash data
If you do not integrate analytics or crash reporting SDKs, state that clearly here. If you add them later, list the provider, what is collected, and whether it is linked to the user.
Children
SpinFlow is not directed at children under 13 (or the minimum age in your jurisdiction). Do not use the app if you are not old enough to agree to these terms in your region.
Your rights
Depending on where you live, you may have rights to access, correct, delete, or port personal data we hold about you—often minimal for a primarily on-device app. Contact us via the support page for privacy requests.
Changes
We may update this policy when the app or backend changes. The “Last updated” date at the top will change; material changes may also be noted in release notes where appropriate.
Contact
Privacy questions: use the email on our support page (update both places to stay consistent).