Privacy policy

Effective 17 October 2026

Whirr is run by Bluespark (John Ballinger) in New Zealand ("we", "us"). This policy explains what we collect, why, and the choices you have. We comply with the New Zealand Privacy Act 2020 and, for riders in the UK and European Economic Area, the GDPR.

The short version

  • We never sell your data. There are no ads in Whirr.
  • We never use your data to train AI models, and we don't let anyone else do so.
  • Your rides are only as public as you choose. Privacy zones and hidden start/end points protect where you live.
  • You can delete your account in the app at any time. Deletion is permanent and removes everything.

What we collect

  • Account details: your name, handle, email address, profile photo, city and bio. If you use Sign in with Apple we receive a private identifier from Apple and, if you choose to share it, your name and email (which may be an Apple relay address).
  • Rides and location: GPS tracks, times, distance, elevation, speed, and any heart rate, power, cadence or temperature your device records. Location is collected only while you record a ride in the app or when you import a ride; Whirr does not track you in the background otherwise.
  • Health data: if you allow it, we import cycling workouts (and their routes and heart rate) from Apple Health. We read only what you grant, we use it only to show your rides, and we never use it for advertising or share it with data brokers.
  • Connected services: if you connect Hammerhead, Wahoo or intervals.icu, we receive your rides from them and store the access tokens needed to keep syncing. From intervals.icu we read your bike rides only (read-only access). Disconnect any time in Settings.
  • Club and social activity: clubs you join, ride RSVPs, comments, ride chat, props, follows, blocks and reports.
  • Device data: push notification tokens, your app version and time zone.

How we protect your location

  • Privacy zones (we suggest one around your home when you join) hide any part of a ride inside the zone from other people. The circle we hide is centred on a randomly offset point, so its centre never reveals your address.
  • By default we also hide the first and last 400 m of every ride from others. You can change this distance.
  • Every ride has its own visibility: everyone, followers and club-mates, club only, or only you. Your default is set in Settings, and we never make anything more public without you choosing it.

Why we use your data (lawful basis)

  • To provide Whirr (contract): showing your rides, running club rides, leaderboards, notifications and comments.
  • To keep Whirr safe (legitimate interests): filtering objectionable content, handling reports, flagging e-bike or motorised efforts, preventing abuse.
  • With your consent: Apple Health import, location while recording, push notifications and connected services. You can withdraw consent at any time in iOS Settings or in the app.

Who we share it with

Only the people you choose (according to each ride's visibility and your clubs), plus the service providers that run Whirr:

  • Cloudflare hosts our servers, database and files.
  • Apple provides Sign in with Apple, delivers push notifications, and supplies ride forecasts (Apple Weather receives a club ride's meeting-point location and time — never your own location).
  • Hammerhead, Wahoo and intervals.icu, only if you connect them.
  • Garmin, only if you use the Whirr data field on your Edge: your ride's track travels from the Edge through the Garmin Connect app to Whirr.

We do not sell, rent or trade personal information. We will disclose information only if New Zealand law requires it.

Where your data is stored

Cloudflare runs a global network, so your data may be stored or processed outside New Zealand, including in the United States and Europe. We rely on Cloudflare's contractual safeguards (including Standard Contractual Clauses) to protect it to a standard comparable to the Privacy Act 2020 and the GDPR.

How long we keep it

We keep your account and rides until you delete them. Sign-in codes expire after 10 minutes and are deleted; expired sessions are removed automatically. Reports are kept as long as needed to keep the community safe.

Your rights

  • Access and correction: see and edit your profile and rides in the app, or ask us for a copy of what we hold.
  • Portability: download the original FIT or GPX file of any ride at any time.
  • Deletion: delete your account in Settings → Account → Delete account. This permanently deletes your profile, rides, files, photos, comments, messages and everything else linked to your account. It cannot be undone.
  • Objection and restriction (GDPR): contact us and we will respond within 30 days.
  • You can complain to the Office of the Privacy Commissioner in New Zealand, or your local data protection authority.

Children

Whirr is for people aged 16 and over. If you believe a younger child has an account, contact us and we will delete it.

Security

All traffic is encrypted. Session tokens and sign-in codes are stored hashed. File links are unguessable. No system is perfect; if we ever have a breach that could cause serious harm, we will tell you and the Privacy Commissioner as the law requires.

Changes

If we change this policy in a way that matters, we will tell you in the app before it takes effect.

Contact

Privacy questions or requests: support@heywhirr.com. Bluespark, New Zealand.