XCADEY Connect Privacy Policy

Version: 2026-09-30.2 | Updated: September 30, 2026

Pre-release draft: the operator has been confirmed; contact details have been confirmed, while actual production data locations and retention periods still require confirmation. This draft does not establish completion of store compliance review.

1. Scope and operator

This policy describes how XCADEY Connect (“we”) processes personal information when connecting your XCADEY bike computer and managing rides, routes and training. Operator’s legal name: Guangzhou Zhunchuang Technology Co., Ltd. (广州准创科技有限公司); address: Room 603, Building 6, Huangzhou Industrial Zone, No. 1 Ruihua Road, Tianhe District, Guangzhou, China (广州市天河区瑞华路1号黄洲工业区6栋603室); privacy email: info@xcadey.com; official website: https://www.xcadey.com. This policy does not replace the policies of independent third-party services.

2. Information and purposes

Account and sign-in: your submitted email address and password, account identifier and session are used for registration, authentication, recovery and secure access. When you choose Apple or Google sign-in, that provider processes authorization; we use the returned user identifier, identity token and authorized account information to authenticate you. You may need to bind an email after third-party sign-in. We do not receive your Apple or Google password.

Personal and bicycle profiles: your nickname, avatar, gender, birth year/month, height, weight, maximum/resting/threshold heart rate, FTP, heart-rate and power zones, and bicycle settings such as wheel size and crank length support profile display, training calculations and bike computer configuration. We process information you provide or generate through these features. Avatars are resized and re-encoded before upload.

Rides and training: records synchronized from your connected bike computer or imported from files you choose may contain times, GPS tracks, coordinates, elevation, distance, duration, speed, heart rate, cadence, power and training load, depending on the device and file. Routes, workouts, training plans, calendars and completion records support display, analysis, planning, device transfer and account cloud synchronization.

Devices and connections: we process pairing QR information, device identifiers, Bluetooth connection identifiers, binding status and device information needed for synchronization. Necessary pairing records and connection credentials are stored locally. Network requests disclose your IP address and necessary request information to receiving servers. The app checks connectivity to schedule synchronization.

Settings and local records: we retain language, units, relevant training settings, and the version, time and language of your policy acceptance. Acceptance records are stored on your phone to remember your choice. Account sessions use system secure storage; activity files, routes, training content and some preferences use local app storage.

3. Automatic cloud synchronization and sensitive information

After you sign in and enter the home screen, the app automatically uploads new or changed rides, routes, training content and profiles while in the foreground and when network conditions permit, and restores cloud content missing locally. These features do not store information solely on your phone. The current version has no separate switch to disable automatic cloud backup. Understand this behavior before importing, synchronizing or entering information.

Precise location, ride tracks, heart rate and related health or fitness information may be sensitive personal information and can reveal your movements or physical condition. They are processed for the route, ride analysis, training and synchronization features you choose; disclosure could affect privacy or personal safety. Do not import or share another person’s information without authority. General acceptance on the welcome screen does not replace legally required separate consent or feature-specific system permissions.

4. Permissions and phone notifications

Bluetooth / nearby devices: used to scan, pair, connect and synchronize with your bike computer. Some Android systems also require location permission for Bluetooth scanning. Denying permission prevents the corresponding connection features. iOS declares Bluetooth background mode for connection activity permitted by the system.

Location: route planning uses your current position after authorization. The embedded planner can receive location through the authorized location interface. Map and routing requests can also reveal the area you view, start/end points or waypoints. The app does not request continuous background location permission.

Camera: used to scan pairing codes or take an avatar photo. Photo/file selection: used for your chosen avatar or ride, route and training imports; we process selected content rather than upload your entire library. Pairing-code scanning itself does not require uploading camera footage to your account cloud storage.

Notification access / sharing (optional): after you enable phone messages and grant system access, Android/HarmonyOS process notification identifiers, source app identifiers/names, categories, titles and bodies for Bluetooth forwarding to your connected bike computer. iOS uses system Bluetooth notification sharing. Notifications may contain personal information from calls, messages and social apps. Notification content is not uploaded through this app’s cloud backup. You can disable phone messages, filter apps or hide message bodies; hiding bodies does not prevent the operating system from supplying them to the notification listener. Display and retention on the bike computer also depend on device settings.

Permissions are requested for relevant features and can be revoked in system settings. Denial affects the corresponding feature; it does not delete your account or existing data. The app does not read your address book using contacts permission or your SMS database/call log using SMS/call-log permissions. Notification previews can nevertheless contain related information.

5. Service providers and disclosure

Accounts and cloud storage: the Parse SDK connects to the configured Parse/SashiDo backend to process accounts, authentication sessions, profiles and synchronized content. The backend service provider is SashiDo. The operator reports service regions in Europe and the United States; actual production database, attachment, log and backup locations still require verification against deployment settings. The provider’s contracted legal entity, infrastructure/storage providers and subprocessors remain to be confirmed.

Apple / Google: participate in authentication when you choose their sign-in option, processing authorization and relevant device/network request information. Official policies: https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy .

OpenStreetMap: map tiles default to tile.openstreetmap.org. Loading maps sends your IP address, client request information and tile coordinates for the viewed area. Official policy: https://osmfoundation.org/wiki/Privacy_Policy .

BRouter: the default embedded route planner loads www.brouter.de/brouter-web/. The website and its routing/map services may process your IP address, requested route coordinates, searches and authorized location. If production uses a self-hosted planner, this section must reflect its operator, domains and data flows. Website: https://www.brouter.de/ .

Platform components provide QR scanning, camera/file selection, system sharing, WebView, secure storage and preferences; HarmonyOS scanning uses system Scan Kit. When you share through another app or import from a URL, the recipient app or target website receives the chosen file or request information under its own policies.

The current client integrates no advertising or advertising-tracking SDK. We do not sell personal information or share ride or health data for targeted advertising. Disclosures for service delivery, security or legal obligations should be limited to necessary purposes and scope with appropriate safeguards, and separate consent must be obtained where required by law.

6. Storage, retention and international processing

Information resides in local app storage and configured cloud services. The operator reports SashiDo service regions in Europe and the United States; actual production storage countries/regions and the location of each data category: [to be verified]; retention during an active account: [to be confirmed]; post-deletion cleanup periods for attachments, logs and backups: [to be confirmed]. Information should be retained only as needed for the stated purposes or legal requirements, then deleted or anonymized.

Apple, Google, mapping and routing services may operate outside your region. The operator must confirm actual recipients, locations, transfer mechanisms and any required separate consent based on production deployment. Tapping Get started must not be treated as blanket authorization for all international transfers.

7. Security

Account backend connections use HTTPS; sessions use system secure storage; local business data is organized by account; backend debug logging that would expose passwords and session tokens is disabled in the app. Server access controls, backup protection, operational access and incident response also require implementation by the operator. No system guarantees absolute security. We will take remedial and notification measures required by applicable law if a personal information incident occurs.

8. Your choices and rights

You can review and edit account/rider profiles in settings, manage content through relevant screens and stop future camera, location or notification access in system settings. Signing out stops synchronization for that account’s current session but does not automatically remove downloaded files or cloud data. Withdrawal does not affect prior lawful processing.

Account deletion is available through Settings → user information → account editing. The current client deletes the account, associated cloud business records and local account data. Complete removal of cloud attachments, old avatars, orphan files and server backups still requires a server-side deletion process; its timing is awaiting confirmation. An offline bike computer may require manual unbinding or deletion on the device. Copies shared with others must be managed with those recipients.

Subject to applicable law, you may request access, copies, correction, deletion, withdrawal of consent, restriction, objection, portability or lodge a complaint. Use the privacy contact in section 1. Following identity verification, requests will be handled within applicable legal deadlines, with reasons given for any lawful refusal. We will respond within 48 hours of receiving a request with its status and next steps. Requests requiring identity verification or further processing will be completed within applicable legal deadlines. This response time does not mean all deletions, backup cleanup or other requests will be completed within 48 hours.

9. Minors

The app is not directed at children. Users below the age at which they can independently consent in their region should involve a guardian and obtain legally required consent before use. If children’s information is processed without required guardian consent, the processing should stop and the information be deleted as required by law. Regional age thresholds and handling procedures must be established for the release markets.

10. Changes

We may update this policy for changes in features, providers or law and make the latest version available in the app. Material changes to purposes, methods or information categories will be communicated appropriately, with renewed consent where legally required. The policy is available from the welcome screen, sign-in screen and settings, and can be read offline. It follows the system language: Chinese for Chinese systems and English otherwise, independently of your in-app language choice.