Skip to content

Privacy Policy

Effective 2 August 2026 · Cayman Pty Ltd

CrankPilot has no account. You don't sign up, you don't log in, and no CrankPilot server stores your rides. Everything the app records lives on your iPhone or iPad. Your rides leave it only when you send one to Strava, TrainingPeaks or Apple Health yourself. Two things travel without a ride attached: a crash report, which carries the device model and what the app was doing when it stopped, and your YouTube sign-in if you choose to connect one, which goes to Google and not to us.

What CrankPilot stores on your device

Held in a local database on your device, never uploaded by default:

  • Your rides: power, cadence, heart rate, speed and distance, sampled while you ride.
  • Your settings: FTP, paired sensors, virtual gearing, metric layout and theme.
  • Analytics computed on the device from those rides: normalized power, intensity factor, TSS, your power curve, and training load (CTL, ATL and form).

Sensors and Bluetooth

The app connects over Bluetooth to your smart trainer, and optionally a heart-rate strap, power meter, speed/cadence sensor and the Zwift Ride controller. Readings come off those sensors live and are stored in the ride on your device. Bluetooth is used only to talk to your sensors.

What the app sends, and only when you turn it on

Three integrations can move ride data off your device. Each one is off until you connect it, and you can disconnect any of them at any time. YouTube, which sends no ride data at all, is covered separately below.

  • Strava — you sign in through Strava's own authorization page. After that, uploading a ride sends that ride's .fit file to your Strava account. Revoke access from your Strava settings whenever you want.
  • TrainingPeaks — the same: sign in through TrainingPeaks, then upload a ride to your TrainingPeaks account.
  • Apple Health — with your permission, CrankPilot writes each ride to Health as a cycling workout with heart rate, power, cadence and distance, and can read your weight and resting heart rate to sharpen calorie and training estimates. Health data is handled by Apple's HealthKit; CrankPilot does not keep its own copy, and you grant or revoke this in the iOS Health app.

Crash reporting

When the app crashes, it sends a crash report and diagnostic breadcrumbs to Sentry, our error-tracking service. That report carries the device model, OS version and app state at the moment of the crash so we can fix it. It does not carry your name, email or ride data, because the app holds no identity to attach. This data is not linked to you.

Video from YouTube

The ride screen can play a YouTube video behind your workout. This is optional. Until you connect a YouTube account, the app sends nothing to Google and you can ride without ever connecting one.

CrankPilot uses YouTube API Services. Connecting an account means you also accept theYouTube Terms of Service, and what Google does with your data is governed by theGoogle Privacy Policy.

What CrankPilot can see

You sign in on Google's own page, so the app never sees your Google password. It asks for a single read-only permission, youtube.readonly. That permission lets it list the channels you subscribe to and search public videos. It cannot upload, comment, edit or delete anything in your account. Searches run with YouTube's strict SafeSearch filter.

What it keeps, and where

  • Your Google access and refresh tokens, in the iOS keychain on your device.
  • Your channel name and avatar, so the app can show which account is connected.
  • The IDs of videos you block, so blocked videos stay hidden.

Your subscriptions and search results are held in memory while you browse and are gone when you sign out. Your device talks to Google directly. No CrankPilot server sits in between, and we never receive your YouTube data.

Turning it off

Disconnect YouTube in CrankPilot's settings. That tells Google to revoke the token and deletes the tokens, channel name and cached results from your device immediately. You can also revoke access fromGoogle's security settings page. Revoking there stops the app's stored token from working, and CrankPilot deletes everything it holds from the YouTube API within 30 days, in practice the next time you open the app.

Deleting your data

  • Delete a single ride from its summary screen in the app.
  • Delete the app from your device and everything it stored goes with it. There is no server copy to clear.
  • Anything you already uploaded to Strava, TrainingPeaks or Apple Health lives in those services — remove it there, and disconnect the integration in CrankPilot's settings.
  • Disconnect YouTube in settings to revoke the token and clear what the app kept from your Google account.

Children

CrankPilot is not directed at children and collects nothing that identifies anyone. It is rated 4+.

Changes to this policy

If this policy changes, the effective date at the top changes with it, and the current version always lives at this URL. Material changes are called out in the app's release notes.

Contact

Questions about privacy go to support@crankpilot.app. CrankPilot is made by Cayman Pty Ltd.