Privacy policy

Updated November 1, 2026

In short: we don't sell your data. Your health data is used only to guide you and keep your history: it never goes to analytics or advertising. Ads are not personalized, and analytics is only turned on if you accept it.

1. Who is the controller

The data controller is Insodia LLC, 530b Harkle Road, Suite 100, Santa Fe, NM 87505, United States (EIN 61-2065518). Privacy email: privacidad@insodia.com.

Representative in the European Union: Oskar Laguillo, Calle Matilde de la Torre, 3, 39500 Cabezón de la Sal (Cantabria), Spain.

2. What data we process and why

• Your training profile: name, age, weight, FTP, maximum heart rate and zones. Used to calculate your targets. This is health data: we process it with your explicit consent (Art. 9(2)(a) GDPR), which we ask for in the app before you start.
• Your workouts: second-by-second power, cadence, speed and heart rate, distance and elevation. Used for your history and your stats. Also with your explicit consent.
• Apple Health and Health Connect, only if you turn them on: we read your weight and save your workouts there (with calories, distance and heart rate).
• Apple Watch, if you use it: your heart rate during the workout, which goes from the watch to the app.
• Your account: an anonymous account is created when you open the app. If you link it with Google, Apple or email and password, we store your email and, if the provider supplies them, your name and photo. Used for your cloud backup.
• Profiles and PIN: stored only on the device; the PIN, encrypted.
• Bluetooth: the devices you connect are remembered only on the device. On Android, searching for Bluetooth devices requires the system location permission: PedalForce does not read or store your location.
• Device report, only if you tap “Send report” in Sensors: manufacturer, model, firmware version, Bluetooth services and the first readings, without the device identifier, without the MAC address and without heart rate values. Used so that PedalForce works with more devices.
• Crash reports (Firebase Crashlytics): the state of the app and the device when something fails, without health data. Based on our legitimate interest in keeping the app working.
• Usage and performance analytics (Firebase Analytics and Performance): only if you accept it, and you can turn it off at any time in “Your profile”. No health data.
• Authenticity check (Firebase App Check, with Apple's App Attest and Google's Play Integrity): verifies that requests to our servers come from the genuine app.
• Subscription (RevenueCat): your subscription status and purchase history, linked to an anonymous identifier. Payment is handled by Apple or Google: we don't see your payment details.
• Ads (Google AdMob), only without Premium: they are not personalized. Even so, Google may use device identifiers and your IP address to limit how often you see an ad, measure it and prevent fraud. In the European Economic Area, the United Kingdom and Switzerland we ask for your permission with Google's form, which you can change in “Tablet settings”.
• Sharing by link: a workout of yours travels inside the link, after the “#”, which never reaches our servers. For library workouts, the link only carries its identifier.
• Catalog: the app downloads new workouts from this website. Like any website, our provider logs the IP address of each visit.

3. Health data

• We only store what you enter, what your sensors measure and what you allow us to read from Health or Health Connect.
• It never goes to analytics, crash reports or advertising, it is never used for profiling and it is never sold or shared.
• You can withdraw your consent in “Your profile”: your account and your cloud backup are deleted.

4. Where it is stored and for how long

• On your device, until you delete the app or the profile.
• If you are signed in, in your cloud backup (Firebase Firestore, on servers in the European Union), until you delete your account.
• Device reports, for at most two years; crash reports, for 90 days.

5. Providers

• Google LLC: Firebase (Firestore, Authentication, Crashlytics, Analytics, Performance, App Check and Hosting), AdMob, Google Sign-In and Health Connect. Firebase privacy · Google's policy.
• Apple Inc.: Sign in with Apple, Health and Apple Watch. Apple's policy.
• RevenueCat, Inc.: subscriptions. RevenueCat's policy.

6. International transfers

We are a US company and some providers are located outside the European Economic Area. For these transfers we use the standard contractual clauses approved by the European Commission and, where the provider is certified, the EU-US Data Privacy Framework, together with encryption in transit and at rest.

7. Your rights

You can ask us for access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent at any time, by writing to privacidad@insodia.com. We will reply within one month.

You can delete your account and your cloud backup from within the app, in “Your profile”. Your workouts can be exported as .FIT from the history.

If you are not satisfied, you can lodge a complaint with the data protection authority in your country. In Spain, the Agencia Española de Protección de Datos (the Spanish Data Protection Agency).

8. Minors

PedalForce is not directed at children under 14 (in Spain; the minimum age varies by country). If you believe a minor has given us data, write to us and we will delete it.

9. Changes

If we change this policy, we will update the date above and, if the change is significant, we will let you know in the app.