Privacy Policy

This Privacy Policy explains what personal information Crankworthy (crankworthy.com) collects, why, and who it's shared with. Crankworthy is operated as a sole proprietorship; the app targets riders in the United States. You can reach us any time at crankworthy2026@gmail.com.

1. What we collect

If you just use the free baseline-assessment and compatibility tools without an account, we don't collect any personal information from you directly — your bike details and answers are sent to our server only to generate a response and aren't tied to an identity. If you create an account, we additionally collect:

• Your email address and basic profile info, via Firebase Authentication (Google, Apple, or email/password sign-in).
• The bike configurations and upgrade builds you save.
• Your installation checklist progress.
• Whether you've purchased the Workshop Guide unlock, and the related order/transaction ID from Paddle (we don't see or store your card details — Paddle handles that).

2. How we use it

To run the Service: authenticate you, save and restore your bikes and progress across devices, generate upgrade and installation guidance tailored to what you've told us about your bike, grant access after a purchase, and respond if you email us for support.

3. Who we share it with

We don't sell your personal information. We do share it with the service providers that make Crankworthy work:

• Google / Firebase — authentication and database storage (Firebase Authentication, Firestore) for your account, saved bikes, and progress.
• Google Gemini API — the bike and upgrade details you provide are sent to Google's Gemini models to generate compatibility checks, upgrade proposals, and installation guidance. Google's own terms govern how it processes API requests.
• Paddle.com — our merchant of record for payments. If you make a purchase, Paddle collects and processes your payment and billing information directly; we only receive confirmation that you paid and an order ID. Paddle's own privacy notice applies to what it collects.
• Canopy API / Amazon Product Advertising API — used server-side to look up current product links, prices, and images for parts we recommend. Your bike/build details aren't sent to these providers as identifying information — only search terms for products.
• Jenson USA and Worldwide Cyclery — when you click through to buy a recommended part, standard affiliate tracking parameters are included in the link so we can earn a commission; we don't share your account information with these retailers.

We don't use third-party advertising trackers, and we don't share your data with data brokers.

4. Cookies and similar technology

Signed-in sessions use the cookies/local storage that Firebase Authentication sets to keep you signed in. We don't currently use advertising or cross-site tracking cookies.

5. Data retention and deletion

We keep your account data for as long as your account exists. You can request deletion of your account and all associated data (saved bikes, progress, purchase record) at any time by emailing crankworthy2026@gmail.com. We'll delete it within 30 days, except where we're required to keep transaction records for tax or legal purposes (Paddle, as merchant of record, retains its own transaction records independently of us).

6. Your rights

Regardless of where you live, you can ask us to access, correct, or delete your personal information, or to tell you what we hold, by emailing us. If you're a California resident and the California Consumer Privacy Act applies to us, you additionally have the right to know what categories of personal information we've collected and to opt out of any sale or sharing of it — as noted above, we don't sell or share personal information with third parties for their own marketing purposes. If you're in the EU or UK, you have equivalent rights under the GDPR, including the right to lodge a complaint with your local data protection authority.

7. Children's privacy

The Service is not directed at, and we don't knowingly collect personal information from, anyone under 18. If you believe a child has created an account, contact us and we'll delete it.

8. Security

We rely on Firebase's and Paddle's security infrastructure for authentication and payment data respectively, and we don't store payment card details ourselves. No method of transmission or storage is 100% secure, but we take reasonable steps to protect your information.

9. International data transfer

Crankworthy's operator is based in Slovakia; our service providers (Google/Firebase, Paddle) may process and store data in the United States and other countries. By using the Service, you understand your information may be transferred to and processed in countries other than your own, including the United States.

10. Changes to this policy

We may update this Privacy Policy from time to time; the "Last updated" date above reflects the most recent version. Material changes will be reflected here.

11. Contact

Questions about this policy or your data? Email crankworthy2026@gmail.com.