Derny — Privacy Policy

Last updated: September 8, 2026

Derny (“the app”, “we”) is an indoor cycling training app that connects to a Bluetooth smart trainer and heart-rate monitor and drives adaptive workouts based on your live metrics. This policy explains what data the app handles and why.

The short version: The app works fully without an account, but while Derny is in beta the rides you record are shared with us to improve the app even if you never create one — see “Beta data sharing” below. If you sign in, your account email is stored too, and your workouts and ride history sync across your devices. The app has no ads or advertising trackers. The website counts visits without cookies, and uses limited conversion measurement for our Reddit ads.

Beta data sharing

While Derny is in beta, the app signs your device in automatically with a random, anonymous identifier the first time you open it. The rides you record — their metrics, the warm-up measurements the app uses to model your fitness, and basic usage events such as which screens you reach — are uploaded to our cloud under that identifier. This happens with no account, and during the beta it is not optional: it is how we find bugs and confirm that adaptive workouts behave correctly on real trainers and treadmills. The identifier is not your name, your email, or any advertising identifier, and we do not use this data for advertising. If you later create an account, that same identifier becomes your account, so the rides you already recorded stay yours. Deleting a ride in the app marks it deleted on our servers and removes its recorded samples; the remaining summary record is erased when the account it belongs to is deleted. While you have no account that is the only deletion route we can act on: an anonymous identifier carries no email address, so we have no way to match an emailed request to your install. If you want us to handle deletion by email, create an account first — it claims the rides that install already recorded — and then write to us at the address below.

Information we handle

• Account information. If you choose to create an account or sign in (with Apple, Google, or email), we store your email address to identify your account. Signing in is optional.
• Workouts and ride data. The workouts you create and the rides you record, including metrics such as power, cadence, heart rate, duration, and timestamps. This is stored on your device and synced to our cloud: during the beta from every install, and outside the beta only when you are signed in.
• Bluetooth device data. The app reads live data from your smart trainer and heart-rate monitor over Bluetooth to display metrics and adjust workout targets. Your ride metrics are processed on your device and leave it only as part of a ride you save. (Separately, we send limited technical information about the trainer itself; see below.)
• Trainer diagnostic & compatibility data. When you connect a smart trainer, we record limited technical information about that trainer: its advertised model, the control features it reports (such as ERG/power-target and resistance support) and their supported ranges, and whether the app was able to control it. We use this only to keep the app working reliably across the wide range of trainers our users own. It contains no health or ride data.
• Crash reports and performance diagnostics. Every install sends crash reports and performance diagnostics — hangs, excessive CPU or disk use, and whether a session ended in a crash — to Sentry, our error-reporting provider. These describe what the app was doing when it failed: no name, no email address, no account or anonymous identifier, and no ride or workout content. They are sent from every install, with or without an account, and there is no setting in the app to switch them off.
• Apple Health (optional, write-only). With your permission, the app saves your finished rides to Apple Health as indoor cycling workouts. The app does not read any data from Apple Health. Health data is managed by Apple on your device.
• Beta signup email. If you ask for a beta invite on our website, we store the email address you enter so we can send you your TestFlight invite and occasional beta updates, and so you can reply to us. We record whether you opened or clicked that email to gauge interest. You can unsubscribe at any time via the link in the email, and we will delete your address on request. We do not sell it or use it for advertising. We also store how you reached the form: any campaign tags in the link you followed, and the address of the page that linked to us, without its query string. That tells us which of our own posts and ads actually bring riders in. To carry it across our own pages, your browser holds it in session storage, which belongs to one tab and is gone when you close it. We receive none of it unless you submit the form.
• Reddit ad measurement. The beta signup page uses the Reddit Pixel. It records a page visit and, only after our signup endpoint accepts the form, a signup event. We do not give Reddit your email address, platform choice, form contents, account data, or ride data. Reddit receives the browser request and its own identifiers so it can attribute those two events to our ads. The pixel is not part of the app.
• Website visit counting. Our website pages use Cloudflare Web Analytics so we can see how many people reach them. It records the address of the page you opened, the address of the page that linked you to it, basic timings for how quickly the page loaded, and, from the request your browser makes, your country, your browser, your operating system, and whether you are on a phone, tablet, or desktop. It sets no cookies, reads nothing from your browser storage, and does not fingerprint your device, so it cannot recognize you from one visit to the next or follow you to other sites. It is not part of the app.

The app does not collect your location, contacts, photos, or advertising identifiers, and contains no advertising or cross-app tracking SDKs. We use Sentry for crash reporting, as described above, and count our own usage events in our own backend.

How we use it

Data is used solely to provide and improve the app’s features: to store and sync your workouts and ride history, show your training metrics, (optionally) mirror finished rides to Apple Health, and keep the app working reliably across different smart trainers. We use the website events described above only to measure our own Reddit ads, and the visit counts only to see how many people reach our pages and how many of them go on to sign up. We do not use your email, account data, or ride data for advertising.

Where your data is stored

When you are signed in, your account and ride data are stored using Supabase, our cloud backend provider, which processes this data on our behalf. During the beta your rides are stored there whether or not you have an account; outside the beta, when you are signed out your data stays only on your device. Our website is served by Cloudflare, which also provides the cookieless visit counting described above and processes it on our behalf. The crash reports and performance diagnostics described above are processed on our behalf by Sentry, in their United States data region.

Sharing

We do not sell your personal data. We share account and ride data only with the service providers above, strictly to operate the app, and where required by law. We share the limited website events described above with Reddit to measure our ads, but not your email address or app data.

Your choices and data deletion

You can use the app without an account, though during the beta your rides are still shared with us as described above. Without an account, deletion is in the app: delete a ride there and it is marked deleted on our servers and its recorded samples are removed; the remaining summary record is erased when the account it belongs to is deleted. We cannot act on an emailed request for such an install, because an anonymous install has no email address on record and we have no way to match your request to it. The other route is to create an account — it claims the rides that install already recorded — after which you can request deletion of your account and all of its cloud data by emailing us at the address below; we will delete it within a reasonable period. Workouts saved to Apple Health are controlled by you in the Apple Health app.

Security

Data in transit is protected with standard encryption (HTTPS/TLS), and cloud data is protected by access controls so each account can only reach its own records.

Children

Derny is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes

We may update this policy as the app evolves. Material changes will be reflected here with a new “last updated” date.

Contact

Questions or requests: [email protected].